4 ms·
Glad you asked this. That is just a pre-launch page so it does not go into detail in length. Nothing built in-house – it uses Salted password hashing with PBKDF
by varunkho 13y ago
Glad you asked this. That is just a pre-launch page so it does not go into detail in length. Nothing built in-house – it uses Salted password hashing with PBKDF2-SHA1 and key stretching as mentioned on [0]. Password hashing is too delicate to write a custom algorithm.
[0] http://crackstation.net/hashing-security.htm http://crackstation.net/hashing-security.htm
"Salt ensures that attackers can't use specialized attacks like lookup tables and rainbow tables to crack large collections of hashes quickly, but it doesn't prevent them from running dictionary or brute-force attacks on each hash individually. High-end graphics cards (GPUs) and custom hardware can compute billions of hashes per second, so these attacks are still very effective. To make these attacks less effective, we can use a technique known as key stretching. The idea is to make the hash function very slow, so that even with a fast GPU or custom hardware, dictionary and brute-force attacks are too slow to be worthwhile. The goal is to make the hash function slow enough to impede attacks, but still fast enough to not cause a noticeable delay for the user."
- SideburnsOfDoom 13y agoGood answer, thanks. I intentionally gave you some good options (PBKDF2, bcrypt) and some really bad ones (MD5, in house) to chose from. I assume that you are using a tested and trusted library to implement PBKDF2? But isn't the work factor - the "number or iterations" in PBKDF2 is doing the same thing as key stretching, i.e. "make the hash function very slow". There is also a similar parameter in bcrypt. So you don't need to add anything else special to the crypto, and indeed shouldn't.
- varunkho 13y agoNo third party library. It uses standard algorithms like Rfc2898DeriveBytes (for pbkdf2), RNGCryptoServiceProvider ETC defined in System.Security.Cryptography (bundled into the .NET framework)
- NicoJuicy 13y agoI'd advice bcrypt for it's slow hashing though. I'd makes bruto forcing harder - longer :-)
- varunkho 13y agoNo Problem – the power of ASP Security Kit hlies in its flexibility and extensibility. You can provide your own implementation for most things including hashing routines if you don't find existing implementation suited for your particular needs. Till now, it is either not possible (in some cases) or difficult (in other cases) in the default ASP.NET implementation for membership management.
- NicoJuicy 13y agoI'll check it out soon. My i ask, what do you use asp.net mvc for? Myself (@Belgium): ASP.Net MVC mostly for: - Ecommerce - Invoicing application (SMB development) - DDD application