CAJ | 학술논문

对目前广泛应用的 PhpBB 网络论坛的安全性进行了研究，详细分析了该类论坛程序中有关用户密码安全机制的全部过程，包括注册时密码检测，密码加密函数及后台数据库存储格式，用户登录验证等。研究发现，该类论坛的早期版本的安全性较弱，而后期3.0版本之后虽然提供了强度较高的密码加密算法，但实际中为了保证兼容性给论坛留下了潜在的安全隐患。针对这些弱点，设计了相应的攻击方法，同时也提出了应对这些攻击的保护措施。
대목전엄범응용적 PhpBB 망락론단적안전성진행료연구，상세분석료해류론단정서중유관용호밀마안전궤제적전부과정，포괄주책시밀마검측，밀마가밀함수급후태수거고존저격식，용호등록험증등。연구발현，해류론단적조기판본적안전성교약，이후기3.0판본지후수연제공료강도교고적밀마가밀산법，단실제중위료보증겸용성급론단류하료잠재적안전은환。침대저사약점，설계료상응적공격방법，동시야제출료응대저사공격적보호조시。
The security of PhpBB forum is discussed, the whole process of security scheme related to the user’s password in this kind of forum analyzed, including password checking in registration, storage of password in database and the user’s logging in. The study indicates that the earlier version is weak in security, and the subsequent 3.0 version could provide more secure cryptographic algorithm. However, for ensuring the compatibility in practice, the potential security threat is also left to the forum. Aiming at this vulnerability, the countermeasures in dealing with these corresponding attacks are proposed in this paper.