jacksoncode.github.io/tutorials/python/75.html at master · jacksoncode/jacksoncode.github.io

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

<!DOCTYPE html>

<head>

<title>16.7. hmac - CodeClub</title>

<style>

.tutorial-container { max-width: 960px; margin: 70px auto 40px; padding: 0 20px; }

.tutorial-sidebar { position: fixed; top: 70px; left: 20px; width: 260px; max-height: calc(100vh - 90px); overflow-y: auto; background: var(--bg-secondary, #fff); border-radius: 8px; padding: 16px; box-shadow: 0 2px 8px rgba(0,0,0,0.08); }

.tutorial-sidebar h3 { font-size: 16px; margin-bottom: 12px; color: var(--text-primary, #1a1a2e); }

.tutorial-sidebar a { display: block; padding: 6px 10px; color: var(--text-secondary, #666); text-decoration: none; font-size: 14px; border-radius: 4px; }

.tutorial-sidebar a:hover, .tutorial-sidebar a.active { background: var(--primary, #3b82f6); color: #fff; }

.tutorial-sidebar .sub-link { padding-left: 24px; font-size: 13px; }

.tutorial-content { margin-left: 300px; background: var(--bg-secondary, #fff); border-radius: 8px; padding: 32px; box-shadow: 0 2px 8px rgba(0,0,0,0.08); }

.tutorial-content h1 { font-size: 28px; margin-bottom: 20px; color: var(--text-primary, #1a1a2e); border-bottom: 2px solid var(--primary, #3b82f6); padding-bottom: 12px; }

.tutorial-content h2 { font-size: 22px; margin: 24px 0 16px; color: var(--text-primary, #1a1a2e); }

.tutorial-content h3 { font-size: 18px; margin: 20px 0 12px; }

.tutorial-content p { line-height: 1.8; margin: 12px 0; color: var(--text-secondary, #333); }

.tutorial-content pre { background: #1e1e2e; color: #cdd6f4; padding: 16px; border-radius: 8px; overflow-x: auto; margin: 16px 0; }

.tutorial-content code { font-family: 'Fira Code', 'Cascadia Code', monospace; font-size: 14px; }

.tutorial-content p code { background: #f1f5f9; padding: 2px 6px; border-radius: 4px; color: #e83e8c; }

.tutorial-content blockquote { border-left: 4px solid var(--primary, #3b82f6); padding: 12px 20px; margin: 16px 0; background: #f8fafc; border-radius: 0 8px 8px 0; }

.tutorial-content ul, .tutorial-content ol { padding-left: 24px; margin: 12px 0; }

.tutorial-content li { margin: 6px 0; line-height: 1.7; }

.tutorial-content img { max-width: 100%; border-radius: 8px; margin: 16px 0; }

.tutorial-nav { display: flex; justify-content: space-between; margin-top: 32px; padding-top: 20px; border-top: 1px solid var(--border, #e5e7eb); }

.tutorial-nav a { color: var(--primary, #3b82f6); text-decoration: none; font-weight: 500; }

.tutorial-nav a:hover { text-decoration: underline; }

.tutorial-index { max-width: 960px; margin: 70px auto 40px; padding: 0 20px; }

.tutorial-card { background: var(--bg-secondary, #fff); border-radius: 12px; padding: 24px; margin: 16px 0; box-shadow: 0 2px 8px rgba(0,0,0,0.08); transition: transform 0.2s; }

.tutorial-card:hover { transform: translateY(-2px); }

.tutorial-card h3 { margin: 0 0 8px; color: var(--text-primary, #1a1a2e); }

.tutorial-card p { color: var(--text-secondary, #666); margin: 0 0 12px; }

.tutorial-card .badge { display: inline-block; padding: 4px 10px; border-radius: 20px; font-size: 12px; font-weight: 600; margin-right: 8px; }

.badge-python { background: #3b82f6; color: #fff; }

.badge-git { background: #f97316; color: #fff; }

.badge-ai { background: #8b5cf6; color: #fff; }

@media (max-width: 768px) {

.tutorial-sidebar { display: none; }

.tutorial-content { margin-left: 0; }

}

</style>

</head>

<body>

<span>CodeClub</span>

</a>

</button>

</ul>

</div>

</nav>

<div class="tutorial-container" style="max-width: 960px; margin: 80px auto 40px; padding: 0 20px;"><div class="tutorial-sidebar"><h3>目录</h3><a href="0.html">1. 简介</a><a href="1.html">2. Python历史</a><a href="2.html">3. 安装Python</a><a href="3.html">3.1. Python解释器</a><a href="4.html">4. 第一个Python程序</a><a href="5.html">4.1. 使用文本编辑器</a><a href="6.html">4.2. 输入和输出</a><a href="7.html">5. Python基础</a><a href="8.html">5.1. 数据类型和变量</a><a href="9.html">5.2. 字符串和编码</a><a href="10.html">5.3. 使用list和tuple</a><a href="11.html">5.4. 条件判断</a><a href="12.html">5.5. 模式匹配</a><a href="13.html">5.6. 循环</a><a href="14.html">5.7. 使用dict和set</a><a href="15.html">6. 函数</a><a href="16.html">6.1. 调用函数</a><a href="17.html">6.2. 定义函数</a><a href="18.html">6.3. 函数的参数</a><a href="19.html">6.4. 递归函数</a><a href="20.html">7. 高级特性</a><a href="21.html">7.1. 切片</a><a href="22.html">7.2. 迭代</a><a href="23.html">7.3. 列表生成式</a><a href="24.html">7.4. 生成器</a><a href="25.html">7.5. 迭代器</a><a href="26.html">8. 函数式编程</a><a href="27.html">8.1. 高阶函数</a><a href="28.html">8.1.1. map/reduce</a><a href="29.html">8.1.2. filter</a><a href="30.html">8.1.3. sorted</a><a href="31.html">8.2. 返回函数</a><a href="32.html">8.3. 匿名函数</a><a href="33.html">8.4. 装饰器</a><a href="34.html">8.5. 偏函数</a><a href="35.html">9. 模块</a><a href="36.html">9.1. 使用模块</a><a href="37.html">9.2. 安装第三方模块</a><a href="38.html">10. 面向对象编程</a><a href="39.html">10.1. 类和实例</a><a href="40.html">10.2. 访问限制</a><a href="41.html">10.3. 继承和多态</a><a href="42.html">10.4. 获取对象信息</a><a href="43.html">10.5. 实例属性和类属性</a><a href="44.html">11. 面向对象高级编程</a><a href="45.html">11.1. 使用__slots__</a><a href="46.html">11.2. 使用@property</a><a href="47.html">11.3. 多重继承</a><a href="48.html">11.4. 定制类</a><a href="49.html">11.5. 使用枚举类</a><a href="50.html">11.6. 使用元类</a><a href="51.html">12. 错误、调试和测试</a><a href="52.html">12.1. 错误处理</a><a href="53.html">12.2. 调试</a><a href="54.html">12.3. 单元测试</a><a href="55.html">12.4. 文档测试</a><a href="56.html">13. IO编程</a><a href="57.html">13.1. 文件读写</a><a href="58.html">13.2. StringIO和BytesIO</a><a href="59.html">13.3. 操作文件和目录</a><a href="60.html">13.4. 序列化</a><a href="61.html">14. 进程和线程</a><a href="62.html">14.1. 多进程</a><a href="63.html">14.2. 多线程</a><a href="64.html">14.3. ThreadLocal</a><a href="65.html">14.4. 进程 vs. 线程</a><a href="66.html">14.5. 分布式进程</a><a href="67.html">15. 正则表达式</a><a href="68.html">16. 常用内建模块</a><a href="69.html">16.1. datetime</a><a href="70.html">16.2. collections</a><a href="71.html">16.3. argparse</a><a href="72.html">16.4. base64</a><a href="73.html">16.5. struct</a><a href="74.html">16.6. hashlib</a><a href="75.html">16.7. hmac</a><a href="76.html">16.8. itertools</a><a href="77.html">16.9. contextlib</a><a href="78.html">16.10. urllib</a><a href="79.html">16.11. XML</a><a href="80.html">16.12. HTMLParser</a><a href="81.html">16.13. venv</a><a href="82.html">17. 常用第三方模块</a><a href="83.html">17.1. Pillow</a><a href="84.html">17.2. requests</a><a href="85.html">17.3. chardet</a><a href="86.html">17.4. psutil</a><a href="87.html">18. 图形界面</a><a href="88.html">18.1. 海龟绘图</a><a href="89.html">19. 网络编程</a><a href="90.html">19.1. TCP/IP简介</a><a href="91.html">19.2. TCP编程</a><a href="92.html">19.3. UDP编程</a><a href="93.html">20. 电子邮件</a><a href="94.html">20.1. SMTP发送邮件</a><a href="95.html">20.2. POP3收取邮件</a><a href="96.html">21. 访问数据库</a><a href="97.html">21.1. 使用SQLite</a><a href="98.html">21.2. 使用MySQL</a><a href="99.html">21.3. 使用SQLAlchemy</a><a href="100.html">22. Web开发</a><a href="101.html">22.1. HTTP协议简介</a><a href="102.html">22.2. HTML简介</a><a href="103.html">22.3. WSGI接口</a><a href="104.html">22.4. 使用Web框架</a><a href="105.html">22.5. 使用模板</a><a href="106.html">23. 异步IO</a><a href="107.html">23.1. 协程</a><a href="108.html">23.2. 使用asyncio</a><a href="109.html">23.3. 使用aiohttp</a><a href="110.html">24. FAQ</a><a href="111.html">25. 期末总结</a></div><div class="tutorial-content"><h1>16.7. hmac</h1><div class="tutorial-body"><p>为了防止黑客通过彩虹表根据哈希值反推原始口令，在计算哈希的时候，不能仅针对原始输入计算，需要增加一个salt来使得相同的输入也能得到不同的哈希，这样，大大增加了黑客破解的难度。</p>

<p>如果salt是我们自己随机生成的，通常我们计算MD5时采用<code>md5(message + salt)</code>。但实际上，把salt看做一个“口令”，加salt的哈希就是：计算一段message的哈希时，根据不同口令计算出不同的哈希。要验证哈希值，必须同时提供正确的口令。</p>

<p>这实际上就是Hmac算法：Keyed-Hashing for Message Authentication。它通过一个标准算法，在计算哈希的过程中，把key混入计算过程中。</p>

<p>和我们自定义的加salt算法不同，Hmac算法针对所有哈希算法都通用，无论是MD5还是SHA-1。采用Hmac替代我们自己的salt算法，可以使程序算法更标准化，也更安全。</p>

<p>Python自带的hmac模块实现了标准的Hmac算法。我们来看看如何使用hmac实现带key的哈希。</p>

<p>我们首先需要准备待计算的原始消息message，随机key，哈希算法，这里采用MD5，使用hmac的代码如下：</p>

<pre class="hljs"><code class="language-plain">>>> import hmac

>>> message = b'Hello, world!'

>>> key = b'secret'

>>> h = hmac.new(key, message, digestmod='MD5')

>>> # 如果消息很长，可以多次调用h.update(msg)

>>> h.hexdigest()

'fa4ee7d173f2d97ee79022d1a7355bcf'

</code></pre>

<p>可见使用<code>hmac</code>和普通hash算法非常类似。<code>hmac</code>输出的长度和原始哈希算法的长度一致。需要注意传入的key和message都是<code>bytes</code>类型，<code>str</code>类型需要首先编码为<code>bytes</code>。</p>

<p>将上一节的salt改为标准的hmac算法，验证用户口令：</p>

<pre class="hljs"><code class="language-python"><span class="hljs-keyword">import</span> hmac, random

<span class="hljs-keyword">def</span> <span class="hljs-title function_">hmac_md5</span>(<span class="hljs-params">key, s</span>):

<span class="hljs-keyword">return</span> hmac.new(key.encode(<span class="hljs-string">'utf-8'</span>), s.encode(<span class="hljs-string">'utf-8'</span>), <span class="hljs-string">'MD5'</span>).hexdigest()

<span class="hljs-keyword">class</span> <span class="hljs-title class_">User</span>(<span class="hljs-title class_ inherited__">object</span>):

<span class="hljs-keyword">def</span> <span class="hljs-title function_">__init__</span>(<span class="hljs-params">self, username, password</span>):

<span class="hljs-variable language_">self</span>.username = username

<span class="hljs-variable language_">self</span>.key = <span class="hljs-string">''</span>.join([<span class="hljs-built_in">chr</span>(random.randint(<span class="hljs-number">48</span>, <span class="hljs-number">122</span>)) <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">20</span>)])

<span class="hljs-variable language_">self</span>.password = hmac_md5(<span class="hljs-variable language_">self</span>.key, password)

db = {

<span class="hljs-string">'michael'</span>: User(<span class="hljs-string">'michael'</span>, <span class="hljs-string">'123456'</span>),

<span class="hljs-string">'bob'</span>: User(<span class="hljs-string">'bob'</span>, <span class="hljs-string">'abc999'</span>),

<span class="hljs-string">'alice'</span>: User(<span class="hljs-string">'alice'</span>, <span class="hljs-string">'alice2008'</span>)

}

<span class="hljs-keyword">def</span> <span class="hljs-title function_">login</span>(<span class="hljs-params">username, password</span>):

user = db[username]

<span class="hljs-keyword">return</span> user.password == hmac_md5(user.key, password)

<span class="hljs-keyword">assert</span> login(<span class="hljs-string">'michael'</span>, <span class="hljs-string">'123456'</span>)

<span class="hljs-keyword">assert</span> login(<span class="hljs-string">'bob'</span>, <span class="hljs-string">'abc999'</span>)

<span class="hljs-keyword">assert</span> login(<span class="hljs-string">'alice'</span>, <span class="hljs-string">'alice2008'</span>)

<span class="hljs-keyword">assert</span> <span class="hljs-keyword">not</span> login(<span class="hljs-string">'michael'</span>, <span class="hljs-string">'1234567'</span>)

<span class="hljs-keyword">assert</span> <span class="hljs-keyword">not</span> login(<span class="hljs-string">'bob'</span>, <span class="hljs-string">'123456'</span>)

<span class="hljs-keyword">assert</span> <span class="hljs-keyword">not</span> login(<span class="hljs-string">'alice'</span>, <span class="hljs-string">'Alice2008'</span>)

<span class="hljs-built_in">print</span>(<span class="hljs-string">'ok'</span>)

</code></pre>

<p>Python内置的hmac模块实现了标准的Hmac算法，它利用一个key对message计算“杂凑”后的hash，使用hmac算法比标准hash算法更安全，因为针对相同的message，不同的key会产生不同的hash。</p>

</div>

<a href="/books/python/built-in-modules/hashlib/index.html"

onclick="gs_load_chapter('/books/python/built-in-modules/hashlib/index.html',true);return false;"

class="inline-block my-2">

stroke="currentColor">

<path stroke-linecap="round" stroke-linejoin="round"

d="M18.75 19.5l-7.5-7.5 7.5-7.5m-6 15L5.25 12l7.5-7.5" />

</svg>

hashlib

</a>

</div>

<a href="/books/python/built-in-modules/itertools/index.html"

onclick="gs_load_chapter('/books/python/built-in-modules/itertools/index.html',true);return false;"

class="inline-block my-2">

itertools

stroke="currentColor">

<path stroke-linecap="round" stroke-linejoin="round"

d="M11.25 4.5l7.5 7.5-7.5 7.5m-6-15l7.5 7.5-7.5 7.5" />

</svg>

</a></div><div style="display: flex; justify-content: space-between; margin-top: 32px; padding-top: 20px; border-top: 1px solid var(--border, #e5e7eb);"><a href="74.html" style="color: var(--primary, #3b82f6); text-decoration: none; font-weight: 500;">← 16.6. hashlib</a><a href="76.html" style="color: var(--primary, #3b82f6); text-decoration: none; font-weight: 500;">16.8. itertools →</a></div><p style="margin-top: 16px; font-size: 13px; color: var(--text-secondary, #999);">原文：<a href="https://liaoxuefeng.com/books/python/built-in-modules/hmac/index.html" style="color: var(--primary, #3b82f6);">廖雪峰 - 16.7. hmac</a></p></div></div>

</div>

</footer>

</body>

</html>

FilesExpand file tree

75.html

Latest commit

History

75.html

File metadata and controls