英文:
Which hashing algorithm to use for API key?
问题
You can use Argon2 for hashing API keys in your database, but instead of using a random salt, you can use a fixed, secret salt for all API keys. This way, you can reproduce the same hash when you need to look up a user by their API key. Using a fixed salt, known as a "pepper," in addition to Argon2 is a common practice for API key hashing to maintain consistency.
英文:
My web application issues API keys to clients and I want to hash the API key in my database. However, it seems that if I follow best practices, whereby every hash has a different salt, then I cannot look up a user by their API key in my DB.
So my question is, which hashing algorithm is the "state of the art" in 2023 for this?
Example:
Suppose my user has been issued an api key, my-api-key. If I used argon2id for storing that password in the database, I have the following hash:
argon2id$19$8192$1$1$7eMA1uCGC2U$aIqS05xbn0DXdXNUKbDG1A
When the user makes an API call, it might look like this (in practice it would not be passed as a query param):
GET https://www.example.com?api_key=my-api-key
I want to be able to say (pseudocode):
hashed_api_key = hash("my-api-key")
SELECT * FROM users WHERE api_key = hashed_api_key
However, each time I call hash(), a random salt is used, and thus I have a different output:
argon2id$19$8192$1$1$vrDlrC4Qkmo$1lEogx/KgrJyPVS40Xgd+Q
argon2id$19$8192$1$1$D/8tzjThXNo$OsX5f4HjdJM5h5aENFk4DQ
What is the best practice for using hashed API keys for database lookups? Shall I use argon2 without a random salt? Or is there a different best practice?
答案1
得分: 1
如果您在每个颁发的API密钥前面添加一个唯一且未经哈希处理的前缀，那将提供一个用于查找盐的关键。这还允许用户在密钥管理界面中区分密钥（如此处建议的）。
{前缀}.{API密钥}
然而，这可能不值得增加复杂性，因为与密码不同，您可以确保API密钥具有足够的熵，从而无需盐。
英文:
If you prepend a unique and unhashed prefix to each issued api key, that provides a key to look up the salt. This also allows users to distinguish between keys in a key management ui (as suggested here).
{prefix}.{api key}
However, it may not be worth the added complexity, because, unlike passwords, you can ensure api keys have sufficient entropy, obviating the need for a salt.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论