New answers tagged

1

With OAuth (including OAuth2 or OpenID for that matter) you would still have a local user entity. Where you store information about this user is up to you. In the case of your example, you would create a user table in your database, just as you normally would. What is different is that you do not store authentication information (such as passwords1) in your ...


3

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier versions). SHA-1, SHA-256 and SHA-512 are all FIPS Approved secure hash algorithms and the HMAC function based on them are thus FIPS Approved HMAC functions. ...


6

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there are some strong reasons to believe that the implementation is correct and secure and fulfils a number of security properties. Since we don't really know how to ...


2

No, as you have seen, the salt is part of the resulting hash value (the 22 characters after the cost factor). The BCrypt.Verify() function will extract the salt from the stored hash, so it is pointless to store it separately. You can call the function with only one parameter, the library will then generate a salt and the cost factor on its own: string ...



Top 50 recent answers are included