什么是盐值（salt），为什么密码存储要用它？
What is a salt and why use it for password storage?
盐值是拼接在密码前的随机值，使相同密码也得到不同哈希，抵御彩虹表与批量破解，并防止从哈希反查常用口令；应每个用户独立随机生成。
A salt is random data prepended to a password so identical passwords hash differently, defeating rainbow tables and bulk cracking and preventing reverse lookup of common passwords; it should be unique per user.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#密码学 #哈希
哈希函数的碰撞是什么，为什么有害？
What is a hash collision and why is it harmful?
碰撞指两个不同的输入得到相同的哈希值；对数字签名和证书而言，能构造碰撞就意味着可伪造合法哈希的对象，因此安全哈希（如 SHA-256）需让碰撞在计算上不可行。
A collision is two distinct inputs with the same hash; for signatures and certificates, forging a collision lets an attacker fake a valid-hash object, so secure hashes (e.g. SHA-256) must make collisions infeasible.
难度 专业 · 适合 幼儿(3-6)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#密码学 #哈希
为什么要“提前”部署后量子密码（PQC）？
Why deploy post-quantum cryptography (PQC) ahead of time?
即使现在还没有能破解 RSA 的量子计算机，攻击者也可以先把截获的加密数据囤起来，等将来量子机成熟再解密（所谓“现在收割、日后解密”）。因此需要在威胁到来前就把算法换成对量子攻击安全的格密码等方案。
Even without a cryptographically relevant quantum computer now, attackers can harvest encrypted data today and decrypt it later ('harvest now, decrypt later'). So we must switch to lattice-based schemes secure against quantum attacks before the threat arrives.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#后量子 #迁移
椭圆曲线密码（ECC）为什么密钥比 RSA 短却能同样安全？
Why are ECC keys shorter than RSA's yet equally secure?
RSA 的安全靠大整数分解，密钥需几千位才够难；ECC 的安全靠椭圆曲线离散对数问题，目前没有亚指数算法，所以 256 位的 ECC 就能达到 RSA 2048 位的强度，更省存储与算力。
RSA relies on integer factoring and needs thousands of bits; ECC relies on the elliptic-curve discrete log problem, for which no sub-exponential attack is known, so a 256-bit ECC key matches RSA-2048 strength—saving size and compute.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#ECC #椭圆曲线
对消息哈希直接做模幂运算的教科书式 RSA 签名,为何经不起选择消息攻击?PSS 这类填充方案补上了什么?
Why does textbook RSA signing — a bare modular exponentiation over the message hash — collapse under chosen-message attacks, and what does a padding scheme like PSS restore?
模乘的同态性让攻击者可以把若干已知签名相乘,得到乘积消息的有效签名,从而伪造从未请签的新消息。PSS 在签名前把消息编码进带随机盐、与 RSA 群域分离的填充结构,消除了这种代数可组合性,使安全性能在随机预言模型下归约到 RSA 困难假设。
The multiplicativity of modular exponentiation lets an attacker multiply known signatures to obtain a valid signature on the product message, forging signatures that were never requested. PSS encodes the message into a salted, domain-separated padded structure before exponentiation, eliminating that algebraic composability so security reduces to the RSA assumption in the random oracle model.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：著录含书名，但缺版次 / 出版社 / 年份中的一部分，需编辑补全后才能做独立比对。
D. Boneh,《RSA 密码系统二十年攻击》,Notices of the AMS 46(2), 1999;Bellare 与 Rogaway 的 PSS 方案,EUROCRYPT 1996
D. Boneh, Twenty Years of Attacks on the RSA Cryptosystem, Notices of the AMS 46(2), 1999; Bellare and Rogaway, PSS, EUROCRYPT 1996
#密码学 #数字签名
AES-GCM 在同一密钥下重用一次随机数,后果为什么远不止泄露两条明文的异或?
Why does reusing a GCM nonce once under the same key cause far more than a plaintext-XOR leak?
GCM 以 CTR 模式生成密钥流并附带认证标签,随机数重复首先让两条密文异或得到明文异或,这只是流密码的老问题。真正的灾难在于认证哈希子密钥 H=E_K(0^128) 仅随密钥变化,重复随机数使攻击者能解出关于 H 的低次多项式方程(Joux 所称 forbidden attack),进而伪造带合法标签的任意密文。NIST SP 800-38D 因此禁止同一密钥下任何随机数重复,TLS 1.3 也改为逐记录显式构造 nonce 以杜绝此类事故。
GCM derives a CTR keystream plus an authentication tag; repeating a nonce first yields the XOR of two plaintexts, the ordinary stream-cipher worry. The real damage comes from the hash subkey H = E_K(0^128), which depends only on the key: a nonce collision lets an attacker solve low-degree equations in H—Joux forbidden attack—and then forge arbitrary ciphertexts carrying valid tags. NIST SP 800-38D consequently forbids any repetition per key, and TLS 1.3 constructs per-record nonces explicitly to rule such accidents out.
难度 专业 · 适合 高中(15-18)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：著录含书名，但缺版次 / 出版社 / 年份中的一部分，需编辑补全后才能做独立比对。
Joux《Authentication Failures in NIST version of GCM》(2006 公开评论);NIST SP 800-38D
A. Joux, "Authentication Failures in NIST version of GCM", public comment, 2006; NIST SP 800-38D
#认证加密 #随机数重用
数字签名如何证明消息来源与完整性？
How does a digital signature prove origin and integrity?
发送方用私钥对消息哈希签名，接收方用其公钥验证：只有对应私钥能生成该签名，且任何篡改都会改变哈希导致验证失败，从而同时保证来源可信与内容未被改动。
The sender signs a hash of the message with their private key; the receiver verifies with the public key—only the matching private key could produce it, and any tampering changes the hash and fails verification, proving origin and integrity.
难度 进阶 · 适合 大众
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#密码学 #签名
HTTPS 是如何对通信加密的？
How does HTTPS encrypt communication?
HTTPS 在 TCP 之上使用 TLS：先用非对称加密（如 RSA/ECDHE）协商出对称会话密钥，之后海量数据用对称加密（如 AES）传输，并用 MAC 保证完整性。
HTTPS runs TLS over TCP: an asymmetric exchange (RSA or ECDHE) negotiates a symmetric session key, then bulk data is encrypted with a symmetric cipher (e.g. AES) and protected by a MAC for integrity.
难度 进阶 · 适合 大众
CC BY 4.0 · 已核验 · Verified 2026-08-23
来源 · Source
Kurose & Ross,《Computer Networking: A Top-Down Approach》第8版,Pearson,2021
J. F. Kurose and K. W. Ross, Computer Networking, 8th ed., Pearson, 2021
#加密 #TLS
什么是后量子密码学？
What is post-quantum cryptography?
后量子密码学研究能抵抗量子计算机（尤其是 Shor 算法）攻击的算法，多基于格、哈希或编码等难题，NIST 已标准化如 Kyber、Dilithium 等方案以应对未来威胁。
Post-quantum cryptography develops algorithms resistant to quantum attacks (notably Shor's), often based on lattices, hashes or codes; NIST has standardized schemes like Kyber and Dilithium for future-proofing.
难度 进阶 · 适合 小学高段(9-12)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#密码学 #量子
哈希函数的“抗碰撞性”是什么意思？
What does 'collision resistance' of a hash function mean?
抗碰撞性指：很难找到两个不同的输入，使它们算出完全相同的哈希值。如果碰撞容易被找到，攻击者就能用假文件冒充真文件，因此这是数字签名与完整性校验的安全基石。
Collision resistance means it's hard to find two different inputs with the same hash. If collisions were easy, an attacker could swap a fake file for a real one, so it underpins signatures and integrity checks.
难度 进阶 · 适合 小学高段(9-12)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#哈希 #抗碰撞
RSA 直接对明文做 m^e mod n 为什么不安全,OAEP 填充补上了哪些缺口?
Why is applying RSA directly as c = m^e mod n insecure, and which gaps does OAEP padding close?
裸 RSA 是确定性运算,相同明文永远映射到相同密文,乘法同态还允许攻击者由已知密文构造出 E(m1·m2)。1998 年 Bleichenbacher 把 PKCS#1 v1.5 填充检查的差异变成选择密文预言机,仅凭服务器的报错响应就恢复了 TLS 会话密钥。OAEP 注入随机种子使加密成为概率过程,并在随机预言机模型下具备抗选择密文攻击的归约证明,RFC 8017 已将其定为 RSAES-OAEP 标准。
Raw RSA is deterministic—identical plaintexts map to identical ciphertexts—and its multiplicative homomorphism lets anyone derive E(m1·m2) from observed ciphertexts. In 1998 Bleichenbacher turned PKCS#1 v1.5 padding checks into a chosen-ciphertext oracle, recovering TLS session keys purely from server error responses. OAEP injects randomness to make encryption probabilistic and carries a reduction proof of CCA security in the random-oracle model; RFC 8017 standardizes it as RSAES-OAEP.
难度 进阶 · 适合 初中(12-15)
CC BY 4.0 · 已核验 · Verified 2026-11-05
来源 · Source
互联网工程任务组（IETF）,《PKCS #1: RSA Cryptography Specifications Version 2.2》,RFC 8017,2016 (DOI: 10.17487/rfc8017)
IETF, 'PKCS #1: RSA Cryptography Specifications Version 2.2', RFC 8017, 2016, DOI: 10.17487/rfc8017
独立核验依据 · Independent verification: 核验依据 1 Crossref DOI 10.17487/rfc8017; RFC 8017
#公钥加密 #填充方案
Diffie-Hellman 密钥交换如何在不安全信道上共享密钥？
How does Diffie-Hellman share a key over an insecure channel?
双方各自生成私钥并公开由离散对数难题保护的公钥，交换后各自用自己的私钥与对方公钥算出一个相同的共享密钥，窃听者仅知公钥无法在经典算力下算出该密钥。
Each side keeps a private key and publishes a public key protected by the discrete-log problem; after exchange both compute the same shared secret from their private and the other's public key, which an eavesdropper cannot derive classically.
难度 进阶 · 适合 小学高段(9-12)
CC BY 4.0 · 来源待核验 · Source pending review
来源 · Source
出处备注：此条未指向带版次的可引用著作（通识性内容、机构文件或未展开的英文书名），本库不提供独立书目出处；如需精确引用，需由编辑补全具体篇目与版次。
Diffie & Hellman 1976
Diffie & Hellman 1976
#密码学 #密钥
什么是公钥基础设施（PKI）？
What is a public key infrastructure (PKI)?
PKI 是一套由证书颁发机构（CA）、证书和吊销机制组成的体系，用来把“公钥”和“真实身份”可靠地绑定起来。浏览器正是靠它验证网站证书，才敢和你建立加密连接。
PKI is a system of certificate authorities (CAs), certificates and revocation that reliably binds a public key to a real identity. Browsers use it to verify a site's certificate before opening an encrypted connection.
难度 进阶 · 适合 小学高段(9-12)
CC BY 4.0 · 已核验 · Verified 2026-08-23 · 2 条独立证据
来源 · Source
Ferguson、Schneier、Kohno,《Cryptography Engineering》Wiley,2010
N. Ferguson, B. Schneier and T. Kohno, Cryptography Engineering, Wiley, 2010
独立核验依据 · Independent verification: 核验依据 2 OPENLIBRARY 标识 /works/OL16596906W：Cryptography engineeri
#PKI #证书