dfaiv-dev

How Should I Be Hashing Passwords in C#/dotnet core?

Mon, 07 Dec 2020 00:00:00 GMT

I wanted to add authorization to a SPA web api backend (using asp.net core). The build in solutions seem to either be IdentityServer4 ~~(which will only be supported unitl Nov 2022?)~~ (wait, maybe they’ll have a Community Edition for companies with less that $1M revenue?) or Microsoft.AspNetCore.Identity which seems to want to work more with MVC/Razor and SPAs (though I’m sure it could be hacked?).

Seems like it shouldn’t be the end of the world to create a user table and store passwords with some sort of best practice. The first part of that would be how to hash the password. Unsurprisingly there seem to be a few opinions around the inter-webs. This is what I ended up with.

public static class Pbkdf2PasswordHasher
{
    const int PasswordHashSize = 512 / 8;
    const int SaltSize = 256 / 8;
    static readonly HashAlgorithmName HashAlgorithm = 
        HashAlgorithmName.SHA512;

    public static string Generate(
        string password, 
        int iterations = 175_000)
    {
        //generate a random salt for hashing
        var salt = new byte[SaltSize];
        new RNGCryptoServiceProvider().GetBytes(salt);

        //hash password given salt and iterations
        //iterations provide difficulty when cracking
        var pbkdf2 = 
            new Rfc2898DeriveBytes(
                password, salt, iterations, HashAlgorithm);
        var hash = pbkdf2.GetBytes(PasswordHashSize);

        //return delimited string with salt | #iterations | hash
        return Convert.ToBase64String(salt) + "|" 
                + iterations + "|" 
                + Convert.ToBase64String(hash);
    }

    public static bool IsValid(string password, string encodedHash)
    {
        //extract original values from delimited hash text
        var parts = encodedHash.Split('|');
        var salt = Convert.FromBase64String(parts[0]);
        var iterations = int.Parse(parts[1]);
        var hash = parts[2];

        //generate hash from test password 
        //  and original salt and iterations
        var pbkdf2 = new Rfc2898DeriveBytes(
                        password, salt, iterations, HashAlgorithm);
        var testHash = pbkdf2.GetBytes(PasswordHashSize);

        //if hash values match then return success
        if (Convert.ToBase64String(testHash) == hash)
            return true;

        //no match return false
        return false;
    }
}

Notes

interationCount was used by running a perf test on my local machine to find hashing that took ~100ms

[Fact(Skip = "not really a unit test, should probably move to some other mechanism.")]
public void Perf()
{
const int maxRuntimeMs = 200;
var iterations = 10_000;
var lastRuntime = 0L;
while (lastRuntime < maxRuntimeMs)
{
    var timer = Stopwatch.StartNew();
    var hashResult =
        Pbkdf2PasswordHasher.Generate(
            PasswordPlainTextDefault,
            iterations);
    timer.Stop();
    var runTime = timer.ElapsedMilliseconds;
    _testOutputHelper.WriteLine($"hash with iterations: {iterations}, ms: {runTime}, result: {hashResult}");

    lastRuntime = runTime;
    iterations += 5000;
}
}

I used HashAlgorithmName.SHA512 instead of SHA256 because larger is better?

bcrypt

There is a dotnet bcrypt implementation which seems to more widely respected on the internet (as it is slower to calculate, and slower is better?). But PBKDF2 still seems to be “officially” recommended, and it’s built into dotnet which seemed a little safer than OSS.

Resources:

Angular - Can You Use an Async Variable in a Pipe?

Fri, 20 Nov 2020 00:00:00 GMT

When I Googled for this, I got a bunch of results that just explain the async pipe; but I wanted to know if I could use an async variable into the pipe:

<div>Currency {{ 100 | currency:(currencySymbol$ | async)}}</div>

Looks like you can. See this Stack Blitz

Powershell - Write-Host from Background Script Block

Mon, 23 Jul 2018 00:00:00 GMT

I have a Powershell deploy script that runs multiple background tasks in parallel using a script block. The block was using Write-Host but I wasn’t getting any output. Turns out I needed to use Receive-Job to capture any output.

# helper to log results
function _handleJobResults {
    Write-Host "listing all jobs"
    Get-Job

    Write-Host "resetting jobs"
    Get-Job | Remove-Job
}

function _waitForJobs {
    # should really check that jobs have finished, maybe in another post.
    Write-Host "waiting for jobs to finish"
    Start-Sleep -Seconds 2
}

$jobCount = 3

# function block to be invoked in background job.
$_deployBlock01 = {
    param($_i)
    Write-Host "script block output: $_i"
}

# invoke background jobs
# no Write-Host output from $_deployBlock01
foreach ($i in 1..$jobCount) {
    Start-Job -ScriptBlock $_deployBlock01 -Name "test-job-$i" -ArgumentList $i
}

_waitForJobs
_handleJobResults
Write-Host "no output from script block should have been logged."

Write-Host "re-run jobs, capture output"
# invoke background jobs, capture outputs
foreach ($i in 1..$jobCount) {
    Start-Job -ScriptBlock $_deployBlock01 -Name "test-job-$i" -ArgumentList $i
}

_waitForJobs

Write-Host "Get Job output"
#Recieve-Job will get the Write-Host output.
Get-Job | Receive-Job

_handleJobResults

git - Rewrite authors

Sat, 17 Mar 2018 00:00:00 GMT

On my computer, my default git user is for my work account. I was working on a personal project, pushed it to GitHub, and didn’t realize until after that I had been commiting with my work username/email. Some Googling turned up that you can rewrite history from one email/username to another:

git filter-branch --env-filter '
OLD_EMAIL="your-old-email@example.com"
CORRECT_NAME="Your Correct Name"
CORRECT_EMAIL="your-correct-email@example.com"
if [ "$GIT_COMMITTER_EMAIL" = "$OLD_EMAIL" ]
then
    export GIT_COMMITTER_NAME="$CORRECT_NAME"
    export GIT_COMMITTER_EMAIL="$CORRECT_EMAIL"
fi
if [ "$GIT_AUTHOR_EMAIL" = "$OLD_EMAIL" ]
then
    export GIT_AUTHOR_NAME="$CORRECT_NAME"
    export GIT_AUTHOR_EMAIL="$CORRECT_EMAIL"
fi
' --tag-name-filter cat -- --branches --tags

I got a nasty warning, but after a few seconds it proceeded with the rewrite and the world didn’t seem to end. I guess I could have tried the suggested alternative, but I only had a few commits and the rewrite seemed mostly innocuous.

WARNING: git-filter-branch has a glut of gotchas generating mangled history
         rewrites.  Hit Ctrl-C before proceeding to abort, then use an
         alternative filtering tool such as 'git filter-repo'
         (https://github.com/newren/git-filter-repo/) instead.  See the
         filter-branch manual page for more details; to squelch this warning,
         set FILTER_BRANCH_SQUELCH_WARNING=1.

A git push --force and my repo commits were updated with my personal email.

TMUX, WSL, Copy & Paste with Mouse

Tue, 02 Jan 2018 00:00:00 GMT

I wanted to use tmux and still be able to highlight text with my mouse and have it copied to the system clipboard. tmux captures mouse commands though, so the copy/paste wasn’t making it out.

Turns out, using the default WSL Bash on Windows shell, you just hold the shift key along with your mouse actions.

There are some more complex options out there, but this was all I needed.

Details: https://github.com/Microsoft/WSL/issues/1586#issuecomment-272235493