Re: Hash MD5, Sha1 and Length
- From: rossum <rossum48@xxxxxxxxxxxx>
- Date: Sun, 13 Sep 2009 19:29:12 +0100
On Sun, 13 Sep 2009 08:42:14 -0700 (PDT), shapper <mdmoura@xxxxxxxxx>
wrote:
So for saving user passwords on a database I should use Sha256For saving passwords on a database you need to use SHA-256,
correct?
cryptographic salt (http://en.wikipedia.org/wiki/Salt_(cryptography))
and stretching (http://en.wikipedia.org/wiki/Key_strengthening).
These are standard cryptographic methods for protecting bulk passwords
in a database or similar. See PKCS#5
(ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-5v2/pkcs5v2-0.pdf), sections
4 and 5 for more detail.
If you are doing security then it is critical to get it right.
I was using MD5 or Sha1 because those were the options on the ASP.NETThis is insufficient. Use something more like:
Membership providers.
But now I creating my own custom Membership system based only on
FormsAuthentication.
I did a little search and I found a few more options and updated my
code with your suggestions:
public static String Hash(this String value, HashType hashType) {
HashAlgorithm algorithm;
switch (hashType) {
case HashType.MD5:
algorithm = new MD5CryptoServiceProvider();
break;
case HashType.SHA1:
algorithm = new SHA1CryptoServiceProvider();
break;
case HashType.SHA256:
algorithm = new SHA256CryptoServiceProvider();
break;
case HashType.SHA384:
algorithm = new SHA384CryptoServiceProvider();
break;
case HashType.SHA512:
algorithm = new SHA512CryptoServiceProvider();
break;
default:
throw new ArgumentException("Invalid hash type", "type");
}
UTF8Encoding encoder = new UTF8Encoding();
Byte[] hash = algorithm.ComputeHash(encoder.GetBytes(value));
Byte[] hash = ComputeHash( password | salt ); // | = concatenate
for (int 1 = 0; i < 10000; ++i)
hash = ComputeHash( hash | salt ); // | = concatenate
The salt prevents two people using the same password having the same
hash and also stops an attacker pre-calculating hashes for commonly
used passwords. The repeats (10,000 or whatever) increase the
workload for any attacker trying to guess passwords. Aim to set the
number of repeats so that it takes about 0.25 seconds to calculate a
hash. That way the attacker can only try guessing four possible
passwords per second per PC, while users only get a minor delay when
signing on.
You will need to store the salts alongside the hashes as they are all
different. The repeat count is a single variable. It theory it
should be reviewed every few years and increased in line with
computing power. You should also review the hash function used to see
if it has become obsolete. NIST is currently running a competition to
find a new hash algorithm to replace the SHA2 series, which includes
SHA-256. Google "SHA 3 competition" if you are interested.
rossum
return BitConverter.ToString(hash).Replace("-", String.Empty);
} // Hash
If you notice something wrong, please, let me know.
Thank You,
Miguel
.
- Follow-Ups:
- Re: Hash MD5, Sha1 and Length
- From: shapper
- Re: Hash MD5, Sha1 and Length
- References:
- Hash MD5, Sha1 and Length
- From: shapper
- Re: Hash MD5, Sha1 and Length
- From: Tom Spink
- Re: Hash MD5, Sha1 and Length
- From: shapper
- Hash MD5, Sha1 and Length
- Prev by Date: Re: Hash MD5, Sha1 and Length
- Next by Date: Re: Hash MD5, Sha1 and Length
- Previous by thread: Re: Hash MD5, Sha1 and Length
- Next by thread: Re: Hash MD5, Sha1 and Length
- Index(es):
Relevant Pages
|
