all groups > dotnet web services enhancements > march 2005 >
You're in the

dotnet web services enhancements

group:

PasswordDigest, VerifyHashedPassword and Hashing???


PasswordDigest, VerifyHashedPassword and Hashing??? AndiRudi
3/26/2005 6:17:11 AM
dotnet web services enhancements: I just tried to get my VerifyHashePassword method to work, but it didn't. I
need some help!!

In de OASIS Documentation and some other Blogs I found the line

Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )

but i cannot convert it to c#?

I tried something like this, but it does not work. Can you help me?

protected override void VerifyHashedPassword(UsernameToken token, string
authenticatedPassword)
{
// in authenticatedPassword steht quasi das was bei AuthenticateToken
zurück gegeben wird
string known = token.Password;

System.Security.Cryptography.SHA1Managed s = new
System.Security.Cryptography.SHA1Managed();
string all = Encoding.UTF8.GetString(token.Nonce) +
Encoding.UTF8.GetString(token.Created) + authenticatedPassword;
byte [] hash = s.ComputeHash(Encoding.UTF8.GetBytes(all));
string newone = Convert.ToBase64String(hash);

throw new Exception("known:" + known);
}

Re: PasswordDigest, VerifyHashedPassword and Hashing??? Luca Valenzise via DotNetMonster.com
3/29/2005 11:59:03 AM
My VB.NET code works fine:

Dim clearPsw As String = "xxx" ' Clear Psw from dataBase

Dim XMLTime As String = XmlConvert.ToString
(userName.Created.ToUniversalTime(),
Microsoft.Web.Services2.Security.Utility.WSUtility.TimeFormat)
Dim ByteTime As Byte() = System.Text.Encoding.UTF8.GetBytes
(XMLTime)
Dim ByteClearPsw As Byte() =
System.Text.Encoding.UTF8.GetBytes(ClearPsw)

Dim dest((userName.Nonce.Length + ByteTime.Length +
System.Text.Encoding.UTF8.GetBytes(ClearPsw).Length) - 1) As Byte
userName.Nonce.CopyTo(dest, 0)
ByteTime.CopyTo(dest, userName.Nonce.Length)
ByteClearPsw.CopyTo(dest, userName.Nonce.Length +
ByteTime.Length)

Dim Sha As New System.Security.Cryptography.SHA1Managed
Dim has As Byte() = Sha.ComputeHash(dest)
Dim myPsw As String = System.Convert.ToBase64String(has)
Dim ClientPsw As String = System.Convert.ToBase64String
(userName.PasswordDigest)

If myPsw = ClientPsw Then Return clearPsw Else Return
"ERROR"

--
AddThis Social Bookmark Button