なぜ、パスワードハッシュのソルトはハッシュと同じ場所に置いて良いのか

by akatsuka

Slide 1

Slide 1 text

ͳͥɺύεϫʔυϋογϡͷιϧτ͸ ϋογϡͱಉ͡৔ॴʹஔ͍ͯྑ͍ͷ͔ 1)1ΧϯϑΝϨϯε໊ݹ԰ QIQDPO@OBHPZB ͔͔͋ͭ

Slide 2

Slide 2 text

ύεϫʔυɺ ϋογϡԽ͍ͯ͠·͔͢ʁ

Slide 3

Slide 3 text

ιϧτ͚͍ͭͯ·͔͢ʁ

Slide 4

Slide 4 text

ιϧτ͕ԿͷͨΊʹ͋ͬͯɺ Ͳ͜ʹอଘ͞Ε͍ͯΔʁ

Slide 5

Slide 5 text

ͦΜͳٙ໰ʹ౴͑ΒΕΔΑ͏ʹ ͳ͍ͬͯΔ͸ͣͰ͢

Slide 6

Slide 6 text

͓͠ͳ͕͖ w ࣗݾ঺հ w ϋογϡͱ͸ w ύεϫʔυೝূͷ࢓૊Έʢύλʔϯʣ w ιϧτͱ͸ w ͍͞͝ʹ w ·ͱΊ

Slide 7

Slide 7 text

͔͔͋ͭ w ੺௩ܒلʢ͔͔͖͋ͭ͋ͷΓʣ w 1)1FS!ਆށ w 1)1ΧϯϑΝϨϯεؔ੢࣮ߦҕһ௕ 𝕏 BLJ@BSUJTBO

Slide 8

Slide 8 text

1)1ΧϯϑΝϨϯεؔ੢ 🎉ୈճ🎉 ⚓ॳͷਆށ։࠵🚢 𝕏 QIQ@LBOTBJ

Slide 9

Slide 9 text

1)1ΧϯϑΝϨϯεؔ੢ 𝕏 QIQ@LBOTBJ PHPカンファレンス名古屋をお楽しみのみなさん！今すぐ宿取ろう！

Slide 10

Slide 10 text

ϋογϡͱ͸Կ͔

Slide 11

Slide 11 text

ϋογϡؔ਺ͱ͸ ) 1)1ΧϯϑΝϨϯε໊ݹ԰ bb331ec7eb4e43ceb1e32b 0ef65cf56e5fcf7ce1 ϋογϡ

Slide 12

Slide 12 text

ϋογϡؔ਺ͱ͸ ) BBBC f1abd73aa0858634f18d36 bf5666194958a8b7d2 ) BBBB 70c881d4a26984ddce795f 6f71817c9cf4480e79 ) BBBD 00b25f15212ed225d3389b 5f75369c82084b3a76 গ͠Ͱ΋ҧ͏σʔλΛೖྗ͢Δͱ͔ͳΓҧ͏ϋογϡ͕ग़ྗ͞ΕΔ

Slide 13

Slide 13 text

ϋογϡؔ਺ͱ͸ ) QBTTXPSE 5baa61e4c9b93f3f068225 0b6cf8331b7ee68fd8 ) QBTTXPSE 5baa61e4c9b93f3f068225 0b6cf8331b7ee68fd8 ) QBTTXPSE 5baa61e4c9b93f3f068225 0b6cf8331b7ee68fd8 ಉ͡σʔλΛೖྗ͢Δͱಉ͡ϋογϡ͕ग़ྗ͞ΕΔ

Slide 14

Slide 14 text

҉߸ֶతϋογϡؔ਺ CCFDFCFDFCF CFGDGFGDGDF m1 m2 H(m1) = H(m2)

Slide 15

Slide 15 text

ύεϫʔυೝূͷ࢓૊Έ

Slide 16

Slide 16 text

ύεϫʔυೝূͷ࢓૊Έʢ❌ϋογϡԽͳ͠ʣ JE FNBJM QBTTXPSE BBB!FYBNQMFDPN IMZQF BBC!FYBNQMFDPN ODCPLMC BBD!FYBNQMFDPN LQNWQP 6TFS BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ৽نొ࿥ LQNWQP

Slide 17

Slide 17 text

BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ϩάΠϯ ύεϫʔυೝূͷ࢓૊Έʢ❌ϋογϡԽͳ͠ʣ JE FNBJM QBTTXPSE BBB!FYBNQMFDPN IMZQF BBC!FYBNQMFDPN ODCPLMC BBD!FYBNQMFDPN LQNWQP 6TFS LQNWQP LQNWQP ൺֱ

Slide 18

Slide 18 text

ͳͥύεϫʔυΛϋογϡԽ͢Δඞཁ͕͋Δͷ͔ w %#͕ྲྀग़ͨ࣌͠ʹଈ࠲ʹѱ༻͞Εͳ͍Α͏ʹ͢Δ w ύεϫʔυϦετ߈ܸͰଞαʔϏεʹ΋Өڹͯ͠͠·͏৔߹΋͋Δ w %#͕ྲྀग़͢Δͷ͸͋Γಘͳ͍ͱࢥ͏͔΋͠Εͳ͍͕ɺաڈʹ࿙Ӯࣄ݅͸ى͖ ͍ͯΔ w ୐;͍͊Δศ<> w ໿ສ݅ͷฏจύεϫʔυ͕ྲྀग़ˠͦͷޙαʔϏεऴྃ w స͹͵ઌͷ伺ͱͯ͠ϋογϡԽ͸ඇৗʹॏཁ <>IUUQTXXXOJLLFJDPNBSUJDMF%(9.;07$"

Slide 19

Slide 19 text

ͦ͜Ͱϋογϡͷग़൪Ͱ͢ʂ w ϋογϡԽ͓͚ͯ͠͹ɺٯํ޲΁ͷม׵͕ࠔ೉ͳͷͰɺ ݩͷύεϫʔυ͕௚ͪʹ͸஌ΒΕͳ͍ w ѱ༻Λ๷͙͜ͱ͕Ͱ͖Δ CCFDFCFDFCF CFGDGFGDGDF

Slide 20

Slide 20 text

ύεϫʔυೝূͷ࢓૊Έʢ⚠ιϧτͳ͠ʣ JE FNBJM QBTTXPSE BBB!FYBNQMFDPN BFGF FDFCCDBBG BBC!FYBNQMFDPN DCFB DGDFCDFBC BBD!FYBNQMFDPN GEEGBBBEDGEF ECECBFBC 6TFS BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ৽نొ࿥ GEEGBBBEDGEF ECECBFBC LQNWQP )

Slide 21

Slide 21 text

JE FNBJM QBTTXPSE BBB!FYBNQMFDPN BFGF FDFCCDBBG BBC!FYBNQMFDPN DCFB DGDFCDFBC BBD!FYBNQMFDPN GEEGBBBEDGEF ECECBFBC 6TFS ύεϫʔυೝূͷ࢓૊Έʢ⚠ιϧτͳ͠ʣ GEEGBBBEDGEF ECECBFBC GEEGBBBEDGEF ECECBFBC ൺֱ BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ϩάΠϯ LQNWQP )

Slide 22

Slide 22 text

ʮϋογϡԽͷΈʯͷ໰୊఺ w Α͘஌ΒΕͨγϯϓϧͳύεϫʔυ΍୹͍ύεϫʔυͩͱɺ͙͢ʹݩͷ஋Λݟ ͚ͭΒΕͯ͠·͏ w ྫ͑͹ɺ࿙Εͨϋογϡ͕NE RXFSUZ ͷ݁ՌͱϚον͢Ε͹ɺύεϫ ʔυ͕RXFSUZͩͱΘ͔ΒΕͯ͠·͏ʢࣙॻ߈ܸʣ w NE΍TIBͳͲͷ༗໊ͳϋογϡؔ਺Ͱ͸ɺϨΠϯϘʔςʔϒϧΛ࢖ͬͯ ݩͷύεϫʔυΛݟ͚ͭΒΕͯ͠·͏

Slide 23

Slide 23 text

ιϧτͱ͸

Slide 24

Slide 24 text

ιϧτͱ͸ w ϋογϡͷݩσʔλʹ෇Ճ͢Δจࣈྻ w 1)1Ͱ͸QBTTXPSE@IBTI Λ࢖͏͜ͱͰϥϯμϜͳιϧτΛ͚ͭͯ͘ΕΔ w ࠓ೔͸৮Εͳ͍͕ɺQBTTXPSE@IBTI͸QBTTXPSE@WFSJGZͱ૊Έ߹ΘͤΔ͜ ͱͰɺλΠϛϯά߈ܸʹରͯ͠΋༗ޮͳͷͰɺΑ΄Ͳͷࣄ৘͕ͳ͍ݶΓ͜Ε Λ࢖͏ͷ͕͓͢͢Ί

Slide 25

Slide 25 text

Slide 26

Slide 26 text

ύεϫʔυೝূͷྲྀΕʢ✅QBTTXPSE@IBTIʣ BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ৽نొ࿥ JE FNBJM QBTTXPSE BBB!FYBNQMFDPN $2y$10$..De BBC!FYBNQMFDPN $2y$10$..Sa BBD!FYBNQMFDPN $2y$10$..VO 6TFS IBTIQBTTXPSE@IBTI QBTTXPSE 1"44803%@%&'"6-5 ZL%F268#7Q+QY7RU4RZFUV61Y+BQ$"QJ-CN7 O$0.W.;9I70 ZL%F268#7Q+QY7RU4RZFUV61Y+BQ$"QJ-CN7O$0.W.;9I70 ΞϧΰϦζϜ Φϓγϣϯ ιϧτ ϋογϡԽ͞Εͨύεϫʔυ ·ͱΊͯ%#ʹొ࿥͢Δʢಉ͡ͱ͜Ζʹஔ͘ʣ

Slide 27

Slide 27 text

JE FNBJM QBTTXPSE BBB!FYBNQMFDPN $2y$10$..De BBC!FYBNQMFDPN $2y$10$..Sa BBD!FYBNQMFDPN $2y$10$..VO 6TFS ύεϫʔυೝূͷྲྀΕʢ✅QBTTXPSE@IBTIʣ BBD!FYBNQMFDPN ϝʔϧΞυϨε ύεϫʔυ ϩάΠϯ QBTTXPSE@WFSJGZ QBTTXPSE Z70 USVFͩͬͨΒɺೝূ੒ޭ

Slide 28

Slide 28 text

QBTTXPSE@IBTI QBTTXPSE@IBTI QBTTXPSE 1"44803%@#$3:15 $2y$10$.kDeQU9WBVpJpxVqtS4qyetuUPxJapCApiLbmVnCO6MvMZ6X14hVO w ZΞϧΰϦζϜ͕CDSZQU w ίετ͕ ճϋογϡԽ͢Δ w ιϧτ͸L%F268#7Q+QY7RU4RZF ຖճҧ͏݁Ռ͕ग़Δͷ͸ɺιϧτ͕ϥϯμϜ͔ͩΒ ιϧτͱΦϓγϣϯ͕ಉ͡ͳΒಉ͡ϋογϡ͕ಘΒΕΔ

Slide 29

Slide 29 text

QBTTXPSE@WFSJGZ IBTIQBTTXPSE@IBTI QBTTXPSE 1"44803%@#$3:15 $2y$10$.kDeQU9WBVpJpxVqtS4qyetuUPxJapCApiLbmVnCO6MvMZ6X14hVO SFTVMUQBTTXPSE@WFSJGZ QBTTXPSE IBTI IBTIʹιϧτؚ͕·Ε͍ͯΔͷͰɺ QBTTXPSEʹ͍ͭͯ΋ಉ͡ιϧτͰϋογϡΛܭࢉ͢Δ͜ͱͰݕূ͕Մೳ

Slide 30

Slide 30 text

ιϧτΛ͚ͭΔ͜ͱͷޮՌ w ιϧτΛ͚ͭΔ͜ͱͰϨΠϯϘʔςʔϒϧʹΑΔ߈ܸ͕ࠔ೉ʹͳΔ w ιϧτΛ෇Ճͨ͠ύεϫʔυʹର͢ΔϋογϡΛ͋Β͔͡Ί͓࣋ͬͯ͘ඞཁ ͕͋Δ w ௕͍ϝοηʔδʹର͢ΔϨΠϯϘʔςʔϒϧPSιϧτͷछྨ෼ͷϨΠϯϘʔ ςʔϒϧΛ༻ҙ͢Δඞཁ͕͋Γɺݱ࣮తͰͳ͍

Slide 31

Slide 31 text

ͳͥɺϋογϡͱಉ͡৔ॴʹஔ͍ͯྑ͍ͷ͔ w ϥϯμϜͳιϧτΛ͚ͭͯੜ੒ͨ͠ϋογϡʹରͯ͠ݩͷϝοηʔδΛಘΔͨ Ίʹ͸ɺιϧτͷ਺෼ςʔϒϧΛ༻ҙ͢Δඞཁ͕͋Δ w ιϧτ͕ϥϯμϜͰ͋ΔҎ্ɺܾΊ͏ͪͰςʔϒϧΛ࡞ΔΘ͚ʹ͍͔ͳ͍ w ߈ܸऀʹιϧτ͕෼͔ͬͨͱͯ͠΋ݩͷϝοηʔδΛݟ͚ͭΔͷ͕ࠔ೉ͳͷ Ͱɺผͷͱ͜Ζʹஔ͘ඞཁ͕ͳ͍ w Ή͠ΖศརͳͷͰɺಉ͡ͱ͜Ζʹஔ͘͜ͱ͕ਪ঑͞Ε͍ͯΔ<> <>IUUQTXXXQIQOFUNBOVBMKBGBRQBTTXPSETQIQGBRQBTTXPSETUPSJOHTBMUT

Slide 32

Slide 32 text

ଞͷݴޠͱͷޓ׵ੑ w Zͷܗࣜͷύεϫʔυϋογϡ͸ଞͷݴޠͰ΋࢖͑Δ͜ͱ͕͋Δ w ͜ͷܗࣜΛ࢖͍ͬͯΕ͹ɺݴޠؒͷ৐Γ׵͑ͷ࣌ʹ໰୊ʹͳΓʹ͍͘ w ྫ͑͹HPMBOHͷCDSZQU(FOFSBUF'SPN1BTTXPSE w IUUQTHPEFWQMBZQCI7+ w IUUQTHPEFWQMBZQLKI)R)K0%4R w QBTTXPSE@IBTI Λ࢖͓͏ʂʢେࣄͳ͜ͱͳͷͰճʣ

Slide 33

Slide 33 text

͍͞͝ʹ w ηΩϡϦςΟରࡦΛߟ͑Δ࣌ʹ͸ɺʮԿ͔ΒकΔͨΊʹԿΛ͢Δͷ͔ʯΛ஌ ͓ͬͯ͘͜ͱ͕େ੾ w ෆਖ਼ΞΫηεˠϋογϡԽ w ݪ૾߈ܸˠιϧτͱετϨονϯά w ରࡦͷத਎Λ஌͓͚ͬͯ͹ɺͦͷରࡦͷݶք΋Θ͔Δ w ύεϫʔυΛϋογϡԽͯ͠΋ɺฏจύεϫʔυ͕ผͷܦ࿏ʢྫ͑͹ϑΟο γϯάʣͰ࿙ΕͨΒෆਖ਼ϩάΠϯΛڐͯ͠͠·͏ʂ

Slide 34

Slide 34 text

·ͱΊ

Slide 35

Slide 35 text

·ͱΊ w ύεϫʔυΛฏจͰอଘ͢Δͷ͸ةݥ w ϋογϡԽ͢Δ͚ͩͰ͸ϨΠϯϘʔςʔϒϧͰύεϫʔυΛݟ͚ͭΒΕͯ͠· ͏Մೳੑ͕͋Δ w 1)1ͰύεϫʔυೝূΛ͢Δ৔߹͸ɺQBTTXPSE@IBTIͱQBTTXPSE@WFSJGZΛ ༻͍Δͷ͕Α͍ w ηΩϡϦςΟରࡦΛߟ͑Δ࣌ʹ͸ɺͲΜͳ߈ܸ͕͋ͬͯɺͳͥͦͷରࡦ͕ޮ͘ ͷ͔஌͓ͬͯ͘͜ͱ͕େ੾

Slide 36

Slide 36 text

த਎Λ஌ͬͯɺ ҆શͳ։ൃϥΠϑΛʂ

Slide 37

Slide 37 text

͓͢͢Ίࢿྉ w 1)1ύεϫʔυͷϋογϡ.BOVBM w ϋογϡͱ҉߸͸ҧ͏ͧʂ1)1ΧϯϑΝϨϯεؔ੢)BTIPS &ODSZQUJPO w ମܥతʹֶͿ҆શͳ8FCΞϓϦέʔγϣϯͷ࡞Γํୈ൛੬ऑੑ͕ੜ·Ε Δݪཧͱରࡦͷ࣮ફ

Slide 38

Slide 38 text

͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ ϕετεϐʔΧʔ౤ථΑΖ͓͘͠ئ͍͠·͢🥺

Slide 39

Slide 39 text

͕࣌ؒ͋Ε͹༨ஊू

Slide 40

Slide 40 text

QBTTXPSE@IBTIͷσϑΥϧτΦϓγϣϯ w 1)1͔ΒɺίετͷσϑΥϧτ஋͕͔ΒʹมΘ͍ͬͯͨ w υΩϡϝϯτ͕ͷ··ͩͬͨͷͰ֬ೝ͢Δͱʜ

Slide 41

Slide 41 text

DSZQUʢιϧτΛࢦఆͯ͠ϋογϡΛܭࢉʣ $2y$10$.kDeQU9WBVpJpxVqtS4qyetuUPxJapCApiLbmVnCO6MvMZ6X14hVO DSZQU ZL%F268#7Q+QY7RU4RZF QBTTXPSE $2y$10$.kDeQU9WBVpJpxVqtS4qyetuUPxJapCApiLbmVnCO6MvMZ6X14hVO

Slide 42

Slide 42 text

Slide 43

Slide 43 text

DSZQUΛ࢖ͬͯϋογϡΛ࠶ݱ͢Δ %&.0͋Γ

Slide 44

Slide 44 text

1"44803%@%&'"6-5ͷਖ਼ମ w WBS@EVNQ 1"44803%@%&'"6-5 w TUSJOH Z w ZͷZ w ࣮͸Z͸1)1ʹ͔͠ͳ͍ w ͕CMPX fi TIΞϧΰϦζϜͰB C Y Zͷόʔδϣϯ͕͋Δ w YͱZ͸1)1ͷࣄ৘ʹΑͬͯ௥Ճ͞Εͨόʔδϣϯ w ଞݴޠͰ΋ݕূ͚ͩ͸ରԠ͍ͯ͠Δ৔߹΋͋Δ HPMBOHͷ#DSZQU