C# PasswordDeriveBytes：似乎 Salt 无关紧要

Question

我可能误解了什么。以下代码使用两个不同的salt通过CryptDeriveKey生成两个相等的密钥。

这就是控制台结果：

salt1:21 3e 18 a3 9a 8b 5f

-->密钥da 89 ea 3d 91 08 20 98 20 e9 dc 45 d5 97 10 7f 8f 4a 52 15 26 68 ef 83

salt2:9e db 4c 2b 49 b4 24

-->密钥da 89 ea 3d 91 08 20 98 20 e9 dc 45 d5 97 10 7f 8f 4a 52 15 26 68 ef 83

我犯了什么错？

using System;
using System.Security.Cryptography;
namespace PasswordDeriveBytes_SaltDoesntMatter
{
class Program
{
// for usage in CreateAndPrintKeyAndSalt
private static readonly string password = "secret123";
private static readonly TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider();
static void Main(string[] args)
{
byte[] salt1 = new byte[] { 33, 62, 24, 163, 154, 139, 95 };
byte[] salt2 = new byte[] { 158, 219, 76, 43, 73, 180, 36 };
// a TripleDESCryptoServiceProvider-instance for getting an IV
CreateAndPrintKeyAndSalt("salt1", salt1);
CreateAndPrintKeyAndSalt("salt2", salt2);
Console.ReadKey();
}
/// <summary>
/// print the salt and the CryptDeriveKey based on this salt
/// !! uses the const password and cryptoServiceProvider
/// </summary>
/// <param name="saltName">name of the used salt</param>
/// <param name="salt">the used salt</param>
/// <param name="cryptoServiceProvider"></param>
private static void CreateAndPrintKeyAndSalt(string saltName, byte[] salt)
{
PasswordDeriveBytes pdb = new PasswordDeriveBytes(password, salt);
byte[] aKey = pdb.CryptDeriveKey("TripleDES", "SHA1", 192, cryptoServiceProvider.IV);
Console.WriteLine($"{saltName}: {ByteArrayInHexText(salt)} --> Key {ByteArrayInHexText(aKey)}");
}    
/// <summary>
/// returns a Textstring of each byte in arr in hex-formatting separated by space
/// </summary>
/// <param name="arr">the array</param>
/// <returns>the formatted string</returns>
public static string ByteArrayInHexText(byte[] arr)
{
string s = "";
foreach (var item in arr)
{
s += $" {item:x2}";
}
return s.Substring(1);
}
}
}

Answer 1

根据MSDN博客：

调用CryptDeriveKey时，设置的salt和迭代计数在PasswordDeriveBytes对象上没有使用，因此即使具有不同的盐和迭代次数将产生相同的密钥其余的输入也是相同的。