{"componentChunkName":"component---src-templates-blog-post-js","path":"/20201207-security--hashing-pwd-cs","result":{"data":{"site":{"siteMetadata":{"title":"dfaiv-dev","siteUrl":"https://blog.dfaiv.dev"}},"markdownRemark":{"id":"0ce2fda4-2096-517a-969f-ff968303e983","excerpt":"I wanted to add authorization to a SPA web api backend (using asp.net core). The build in solutions seem to either be IdentityServer4 (which will only be…","html":"

I wanted to add authorization to a SPA web api backend (using asp.net core). The build in solutions seem to either be IdentityServer4 (which will only be supported unitl Nov 2022?) (wait, maybe they’ll have a Community Edition for companies with less that $1M revenue?) or Microsoft.AspNetCore.Identity which seems to want to work more with MVC/Razor and SPAs (though I’m sure it could be hacked?).

\n

Seems like it shouldn’t be the end of the world to create a user table and store passwords with some sort of best practice. The first part of that would be how to hash the password. Unsurprisingly there seem to be a few opinions around the inter-webs. This is what I ended up with.

\n
public static class Pbkdf2PasswordHasher\n{\n    const int PasswordHashSize = 512 / 8;\n    const int SaltSize = 256 / 8;\n    static readonly HashAlgorithmName HashAlgorithm = \n        HashAlgorithmName.SHA512;\n\n    public static string Generate(\n        string password, \n        int iterations = 175_000)\n    {\n        //generate a random salt for hashing\n        var salt = new byte[SaltSize];\n        new RNGCryptoServiceProvider().GetBytes(salt);\n\n        //hash password given salt and iterations\n        //iterations provide difficulty when cracking\n        var pbkdf2 = \n            new Rfc2898DeriveBytes(\n                password, salt, iterations, HashAlgorithm);\n        var hash = pbkdf2.GetBytes(PasswordHashSize);\n\n        //return delimited string with salt | #iterations | hash\n        return Convert.ToBase64String(salt) + \"|\" \n                + iterations + \"|\" \n                + Convert.ToBase64String(hash);\n    }\n\n    public static bool IsValid(string password, string encodedHash)\n    {\n        //extract original values from delimited hash text\n        var parts = encodedHash.Split('|');\n        var salt = Convert.FromBase64String(parts[0]);\n        var iterations = int.Parse(parts[1]);\n        var hash = parts[2];\n\n        //generate hash from test password \n        //  and original salt and iterations\n        var pbkdf2 = new Rfc2898DeriveBytes(\n                        password, salt, iterations, HashAlgorithm);\n        var testHash = pbkdf2.GetBytes(PasswordHashSize);\n\n        //if hash values match then return success\n        if (Convert.ToBase64String(testHash) == hash)\n            return true;\n\n        //no match return false\n        return false;\n    }\n}
\n

Notes

\n\n

bcrypt

\n

There is a dotnet bcrypt implementation which seems to more widely respected on the internet (as it is slower to calculate, and slower is better?). But PBKDF2 still seems to be “officially” recommended, and it’s built into dotnet which seemed a little safer than OSS.

\n

Resources:

\n","frontmatter":{"title":"How Should I Be Hashing Passwords in C#/dotnet core?","date":"December 07, 2020","description":"","slug":"/20201207-security--hashing-pwd-cs"}},"previous":{"frontmatter":{"title":"Angular - Can You Use an Async Variable in a Pipe?","slug":"/20201120-ng-async-var-in-a-pipe"}},"next":null},"pageContext":{"id":"0ce2fda4-2096-517a-969f-ff968303e983","previousPostId":"b6aa9cb7-7afa-53a8-b6af-f59897fec00a","nextPostId":null}},"staticQueryHashes":["2841359383","3825813668"]}