This question already has an answer here:
- How to securely hash passwords? 13 answers
I am doing a custom login for practice purposes, and i am wondering what would be the logical way to save the hashed password and the salts.
- Salt/Hash operations are using Rfc2898DeriveBytes class.
As for now, it is like this:
- The user registers, the password is encrypted with a random salt (which is saved to the database) and hashed with a hard-coded salt with 10000 iterations.
As the iterations can be raised in time due to computational improvements, i am saving the Hash iterations (the Encryption iterations are hard-coded) them on the database.
I would like opinions on how safe is a hard-coded hash salt, or if i should make it random and add the hash salt to the database too.