ASP.NET C # Membership - How to Compare Existing Password / Hash
I've been dealing with this issue for a while. I need to compare the paasword that the user enters into the password that is in the membership db. The password is hashed and has a salt. Due to lack of documentation, I don't know if the salt is added to the password and then hashed how it is generated.
I am unable to match this. The hash returned by the function never matches the hash in the DB and I know it is the same password. Microsoft seems to hash the password differently than I do.
I hope someone has some ideas.
Here is my code:
protected void Button1_Click(object sender, EventArgs e)
{
//HERE IS THE PASSWORD I USE, SAME ONE IS HASHED IN THE DB
string pwd = "Letmein44";
//HERE IS THE SALT FROM THE DB
string saltVar = "SuY4cf8wJXJAVEr3xjz4Dg==";
//HERE IS THE PASSWORD THE WAY IT STORED IN THE DB AS HASH
string bdPwd = "mPrDArrWt1+tybrjA0OZuEG1P5w=";
// FOR COMPARISON I DISPLAY IT
TextBox1.Text = bdPwd;
// HERE IS WHERE I DISPLAY THE return from THE FUNCTION, IT SHOULD MATCH THE PASSWORD FROM THE DB.
TextBox2.Text = getHashedPassUsingUserIdAsSalt(pwd, saltVar);
}
private string getHashedPassUsingUserIdAsSalt(string vPass, string vSalt)
{
string vSourceText = vPass + vSalt;
System.Text.UnicodeEncoding vUe = new System.Text.UnicodeEncoding();
byte[] vSourceBytes = vUe.GetBytes(vSourceText);
System.Security.Cryptography.SHA1CryptoServiceProvider vSHA = new System.Security.Cryptography.SHA1CryptoServiceProvider();
byte[] vHashBytes = vSHA.ComputeHash(vSourceBytes);
return Convert.ToBase64String(vHashBytes);
}
a source to share
Using a tool like Reflector you can see what the membership provider is doing. This is what has worked for me in the past (assumes password is Format 1, i.e. SHA1):
public static string GenerateHash(string pwd, string saltAsBase64)
{
byte[] p1 = Convert.FromBase64String(saltAsBase64);
return GenerateHash(pwd, p1);
}
public static string GenerateHash(string pwd, byte[] saltAsByteArray)
{
System.Security.Cryptography.SHA1 sha = new System.Security.Cryptography.SHA1CryptoServiceProvider();
byte[] p1 = saltAsByteArray;
byte[] p2 = System.Text.Encoding.Unicode.GetBytes(pwd);
byte[] data = new byte[p1.Length + p2.Length];
p1.CopyTo(data, 0);
p2.CopyTo(data, p1.Length);
byte[] result = sha.ComputeHash(data);
string res = Convert.ToBase64String(result);
return res;
}
Where: "saltAsBase64" is in the PasswordSalt column of the aspnet_Membership table.
EDIT:
Usage example:
string pwd = "Letmein44";
string saltAsBase64 = "SuY4cf8wJXJAVEr3xjz4Dg==";
string hash = GenerateHash(pwd, saltAsBase64);
// hash : "mPrDArrWt1+tybrjA0OZuEG1P5w="
a source to share