dotnet security: Preferred method of hashing salted password -- dotnet security

Preferred method of hashing salted password

Jono
8/18/2006 8:39:49 AM

dotnet security:

Hi,
I just discovered the Rfc2898DeriveBytes class, thanks to the MSDN
nugget on storing passwords [1]. The thing is, it left me hanging at
the end. Should I be using this new class or should I be using SHA256
to hash a concatenation of a user's password with a salt generated by
means of an RNGCryptoServiceProvider. Also, if I choose the second
method, is there tangible benefit to creating a random length salt, as
observed here [2]? If anyone has the answers to these questions and
wouldn't mind sharing them, I'd really appreciate it.
Many thanks,
Jono

[1] http://www.microsoft.com/uk/msdn/events/nuggets.aspx
[2] http://www.obviex.com/samples/hash.aspx

RE: Preferred method of hashing salted password

serge calderara
8/18/2006 9:31:03 AM

use the keyed hash classes

[quoted text, click to view]

Re: Preferred method of hashing salted password

Dominick Baier
8/19/2006 12:00:00 AM

Hi,

well - i am a little biased :))

But you should use the Rfc2898 class which gives you the additional benefit
of iterations. 16 bytes lengths are enough.

dominick
www.leastprivilege.com

[quoted text, click to view]

Re: Preferred method of hashing salted password

Jono
8/21/2006 6:31:58 AM

I appreciate your response Dominick.
I'll give the Rfc2898 class a try next time I'm given the task of
storing user passwords. I'll admit, I had my doubts about the length of
the hash, but if you reckon 16 bytes is enough (sounds like Gates'
infamous quote) then I'll go along with it.
Cheers,
Jono

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.