Hashing In ASP.NET Core 2.0

Problem

How to use hash data (e.g. passwords) in ASP.NET Core.

Solution

The new Data Protection API in .NET Core includes functionality to create hashes using PBKDF2algorithm. ASP.NET Core uses this behind the scenes functionality in PasswordHasher class, which is used in ASP.NET Core Identity.

Create a class library and add the following NuGet package -

Microsoft.AspNetCore.Cryptography.KeyDerivation

Add a class to encapsulate the hashing logic.

public class Hash
{
public static string Create(string value, string salt)
{
var valueBytes = KeyDerivation.Pbkdf2(
password: value,
salt: Encoding.UTF8.GetBytes(salt),
prf: KeyDerivationPrf.HMACSHA512,
iterationCount: 10000,
numBytesRequested: 256 / 8);
return Convert.ToBase64String(valueBytes);
}
public static bool Validate(string value, string salt, string hash)
=> Create(value, salt) == hash;
}

Add a class to encapsulate the logic for creating a random salt.

public class Salt
{
public static string Create()
{
byte[] randomBytes = new byte[128 / 8];
using (var generator = RandomNumberGenerator.Create())
{
generator.GetBytes(randomBytes);
return Convert.ToBase64String(randomBytes);
}
}
}

Add tests to verify the functionality, e.g,

[Fact(DisplayName = "Untampered_hash_matches_the_text")]
public void Untampered_hash_matches_the_text()
{
// Arrange
var message = "passw0rd";
var salt = Salt.Create();
var hash = Hash.Create(message, salt);
// Act
var match = Hash.Validate(message, salt, hash);
// Assert
Assert.True(match);
}
[Fact(DisplayName = "Tampered_hash_does_not_matche_the_text")]
public void Tampered_hash_does_not_matche_the_text()
{
// Arrange
var message = "passw0rd";
var salt = Salt.Create();
var hash = "blahblahblah";
// Act
var match = Hash.Validate(message, salt, hash);
// Assert
Assert.False(match);
}
[Fact(DisplayName = "Hash_of_two_different_messages_dont_match")]
public void Hash_of_two_different_messages_dont_match()
{
// Arrange
var message1 = "passw0rd";
var message2 = "password";
var salt = Salt.Create();
// Act
var hash1 = Hash.Create(message1, salt);
var hash2 = Hash.Create(message2, salt);
// Assert
Assert.True(hash1 != hash2);
}

Source Code

GitHub

3 Comments

Join the conversation! Your thoughts help the community grow.

VISHNU SURENDRAN6y ago
The salt need to store into the database for login verification?
Tridip Bhattacharjee8y ago
If we use random salt then it will hard to match two hash. suppose first time random salt will be used to generate hash and second time it will generate different hash....am i right?
- Vivek Bharos8y ago
  For verification logic to work you need to store the salt in the DB. On the basis of the stored salt you can verify the given password. Your points stands true in case you are not storing the hash along with the hashed password.