Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography.

It seems to be just SHA1. Am I missing something? I was hoping to use PBKDF2-SHA256.

share|improve this question
1  
Why do you prefer PBKDF2-SHA256? The technical benefits are rather small, even PBKDF2-MD5 isn't broken yet. The main benefit I see is PR. – CodesInChaos Sep 6 '12 at 14:31
4  
Why do you consider it broken? I wouldn't recommend using it, but I'm not aware of any faster than brute-force attack on it. MD5's pre-image resistance is still pretty strong, certainly much stronger that almost all passwords. – CodesInChaos Sep 6 '12 at 15:37
1  
MD5 is considered insecure due to collision attacks and extension attacks. – Foo Party Sep 6 '12 at 15:47
3  
Extension attacks apply equally to SHA-2. But neither length extensions, nor collisions are relevant to password hashing. For password hashing only first pre-images are relevant, and MD5 is still quite strong in that regard. There is no practical attack faster than simply guessing the password against PBKDF-2-MD5. – CodesInChaos Sep 6 '12 at 15:51
1  
@FooParty SHA1 and SHA2 are about as cheap. It's the PBKDF2 part that makes it computationally expensive. You need a preimage-resistant hash in PBKDF2, and MD5 is ok for that. – Gilles Sep 6 '12 at 16:36
show 5 more comments

1 Answer

up vote 1 down vote

Have a look at this blog post: the author has apparently observed the same lack of SHA-256 support in the Rfc2898DeriveBytes class of .NET, and set out to write his own code. (I have not looked at that code and cannot vouch for its quality.)

Otherwise, it would not be too hard to reimplement PBKDF2 with HMAC/SHA-256, following the description of RFC 2898, section 5.2. .NET includes an implementation of HMAC/SHA-256.

share|improve this answer
3  
I know better than to roll my own crypto. – Foo Party Sep 6 '12 at 15:20
@FooParty but you could implement a specification and in/out test it against other implementations. – Jeff Ferland♦ Sep 6 '12 at 17:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.