Python PBKDF2密钥派生函数详解 - 安全密码存储完整指南

import hashlib

key = hashlib.pbkdf2_hmac(
    hash_name='sha256',
    password=b'password',
    salt=b'salt',
    iterations=100000,
    dklen=None
)

import hashlib
import os

password = b'MySecurePassword'
salt = os.urandom(16)  # 生成16字节的随机盐值

# 派生密钥
key = hashlib.pbkdf2_hmac('sha256', password, salt, iterations=100000)
print(f"密码: {password}")
print(f"盐值: {salt.hex()}")
print(f"派生密钥: {key.hex()}")
print(f"密钥长度: {len(key)} 字节")

密码: b'MySecurePassword'
盐值: 0102030405060708090a0b0c0d0e0f10
派生密钥: a1b2c3d4e5f6789012345678abcdef0123456789abcdef0123456789abcdef01
密钥长度: 32 字节

import hashlib
import os

def hash_password_pbkdf2(password: str) -> str:
    """使用PBKDF2哈希密码，返回存储字符串"""
    salt = os.urandom(16)
    key = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 200000)
    return f"pbkdf2:sha256:200000:{salt.hex()}:{key.hex()}"

def verify_password_pbkdf2(password: str, stored: str) -> bool:
    """验证密码"""
    parts = stored.split(':')
    _, algo, iterations, salt_hex, key_hex = parts
    salt = bytes.fromhex(salt_hex)
    computed = hashlib.pbkdf2_hmac(
        algo, password.encode('utf-8'), salt, int(iterations)
    )
    return hmac.compare_digest(computed.hex(), key_hex)

# 注册
stored_hash = hash_password_pbkdf2("MyPassword123")
print(f"存储哈希: {stored_hash[:50]}...")

# 验证
print(f"\n正确密码: {verify_password_pbkdf2('MyPassword123', stored_hash)}")
print(f"错误密码: {verify_password_pbkdf2('WrongPassword', stored_hash)}")

存储哈希: pbkdf2:sha256:200000:0102030405060708090a0b0c0d...

正确密码: True
错误密码: False

import hashlib
import os
import time

password = b'test_password'
salt = os.urandom(16)

print("迭代次数与计算时间:")
for iterations in [1000, 10000, 100000, 200000]:
    start = time.perf_counter()
    key = hashlib.pbkdf2_hmac('sha256', password, salt, iterations)
    elapsed = time.perf_counter() - start
    print(f"  {iterations:>7d} 次: {elapsed*1000:.1f} ms")

print(f"\n推荐: 生产环境至少 100,000 次迭代")

迭代次数与计算时间:
     1000 次: 1.2 ms
    10000 次: 12.5 ms
   100000 次: 125.0 ms
   200000 次: 250.0 ms

推荐: 生产环境至少 100,000 次迭代