How Can We Securely Hash and Salt Passwords in C#?

The password hash in the c#and add salt

In the field of password security, hash and salt are the key technologies to protect user credentials. The hash is a one -way function that converts the bright -text password to the value of a fixed length and cannot be easily reversed. Adding salt can increase the additional security layer by adding random values ​​to the password before hash, making it more difficult for an attacker to guess or crack the password in violence.

David Hayden's method

David Hayden's method includes using the CreateSalt method to generate random numbers and convert it to Base64 string. The CreatePasswordhash method connects the password to salt, and uses the SHA1 algorithm to use the SHA1 algorithm to use the SHA1 algorithm to use the FormsAuthentication.hashpasswordForentoringInfigFile method.

Although Hayden's code is valid, it involves some unnecessary string conversion. Instead, we can directly use the byte array to treat salt and hash.

C#alternative method

Michael Howard provided a alternative method in the book "Beginning Asp.net Security". Generatesaltedhash method uses bright -text passwords and salt byte array as input. It creates a new byte array, which is equal to the sum of the length of the password and salt byte array. The password and salt bytes are then copied to the new byte array. SHA256MANAGED algorithm is used to calculate hash values. To convert the text into byte array, you can use Encoding.utf8.getBytes (String). To convert the hash to its string representation, you can use Convert.tobase64string.

It is important to remember that we cannot use the equal number operator directly on the byte array. Instead, we need to traverse two arrays and use the Comparebytearrays method to manually compare each byte.

Best practice

It is usually recommended to always use new salt for each password. Salt does not need to be confidential, so it can be stored with hash.

The above is the detailed content of How Can We Securely Hash and Salt Passwords in C#?. For more information, please follow other related articles on the PHP Chinese website!