Re: Can I create a password salt?

Freakish_05 — Sun, 08 Jun 2008 08:55:10 GMT

Hi bbaxter,

The following method will create a random salt for you. Assuming you wanted the salt to be one-time per user, this is a very useful method.

public static string CreateSalt()
        {
            RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
            byte[] buff = new byte[32];
            rng.GetBytes(buff);
            return Convert.ToBase64String(buff);
        }

I also encrypt my passwords using the following method.

public static string Enc(string d2e)
        {
            UnicodeEncoding uEncode = new UnicodeEncoding();
            byte[] bytD2e = uEncode.GetBytes(d2e);
            SHA256Managed sha = new SHA256Managed();
            byte[] hash = sha.ComputeHash(bytD2e);
            return Convert.ToBase64String(hash);
        }

Notice that I am using SHA256. You can use SHA1 if you want but there are apparrently some vulnerabilities with it. There's also SHA384, SHA512 and SHA786 IIRC but as you increase the number, you also increase the time and processor load which will result in performance issues if you have high traffic.

SHA256 is a good comprimise for me since it's relatively quick and it cannot be decrypted. So even if some lucky person managed to gain access to your database, the data would be no good to them anyway Which has just reminded me! Since you cannot decrypt SHA256, you'll have to encrypt the submitted password and salt retrieved from the database and compare that to the encryped password in the database when authenticating users.

Hope that helps,

Jason

Re: Can I create a password salt?

haoest — Fri, 06 Jun 2008 21:26:41 GMT

If you are using MD5 or or something similar, simply changing mypass to mypass2 yields a totally different result. Given that, you can concatenate any constant (e.g. a $ sign), or some variable that is fixed for each account (e.g. username) to the password before calling md5 hash function.

Can I create a password salt?

bbaxter — Fri, 06 Jun 2008 19:47:01 GMT

ok, Here's my situation: I have a users' password, but I need to hash it and create a salt to insert into the aspnet_membership table. Can I do this manually? If there was a way to do it in SQL that'd be awesome, but thats probably asking too much.

Security

Re: Can I create a password salt?

Re: Can I create a password salt?

Can I create a password salt?