I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the White House Twitter page (in other words it will be public).
Would I be better off using a massive number of SHA-256 iterations (as a replacement for my 100,000 PBKDF2 iterations)? Are there any attacks that can reverse PBKD2?
This is the code I'm using:
string salt = Utility.RandString(32); // convert to byte and store in both forms this.Salt = salt; this.BSalt = Utility.ToByteArray(salt); // generate the password hash Rfc2898DeriveBytes preHash = new Rfc2898DeriveBytes(this.Password, this.BSalt, 100000); byte byteHash = preHash.GetBytes(32); this.Hash = Convert.ToBase64String(byteHash);