8

I am developing a website which requires users to register to it in order to use it's functions and I was wondering if SHA-256 + salt (random salt provided by RNGCryptoServiceProvider in C#) is secure and good enough to use in 2017?

Improve this question
4
  • How is this a duplicate? The first post is from 2011 and the second one is from 2015. Security information changes.
    – Itay080
    Jun 29, 2017 at 8:43
  • 20
    It wasn't good in 2011, it hasn't magically become good since then.
    – Gilles 'SO- stop being evil'
    Jun 29, 2017 at 9:07
  • Use PBKDF2, scrypt, or bcrypt. Anything else (including salted single-iteration SHA256) is unacceptable. End of story.
    – marcelm
    Jun 29, 2017 at 11:22
  • This is wrong. Argon2 is presumably the best answer now, but not the conservative one.
    – Bruno Rohée
    Jul 19, 2017 at 9:09

2 Answers 2

Reset to default
17

For password storage, salted SHA256 hashes are not recommended. This is because the general purpose SHA256 is designed to be fast. Fast is exactly what you do not want for a password hashing algorithm, because it makes brute force and dictionary attacks far more efficient.

Password storage hashes are designed to require a certain workload and in some instances, a minimum memory requirement. Good password storage scheme are designed to be hard to serialize and/or optimize.

The recommended password storage scheme in 2017 is BCrypt hash, with PBKDF2 as alternative, but slightly less regarded, option.

For a more complete answer, please read the sec.se 'standard answer' on password hashing by Thomas Pornin.

Improve this answer
3
  • While I agree with the answer in general, that there is no real way to protect bad passwords in your DB against a dictionary attack.
    – Eiver
    Jun 29, 2017 at 11:17
  • 4
    @Eiver You can't protect against the absolute worst passwords; but the difference between 10k tries/second/box and 10b tries/sec/box is enough to protect the average user who has a marginally strong password against non-targetted attacks.
    – Dan Is Fiddling By Firelight
    Jun 29, 2017 at 12:27
  • Bitcoin is based on SHA-256. If a Bitcoin secret is so easy to be brute-forced because of the speed of SHA-256, it wouldn't have been chosen. Now, is a password more important than a Bitcoin secret to call for a slower algorithm to delay the brute-force? I don't think so.
    – Ascendant
    Mar 3, 2021 at 23:52
1

It could be - if it meets your risk assessment for the potential threats you feel it faces.

But I would recommend you look at using a Password Based Derivation Function. These are hashed based style functions ideal for password storage.

Look into PBKF#2 for your C# application. There is also the widely used Bcrypt (although I use the former with C# as it's native)

This maybe of help: https://lockmedown.com/hash-right-implementing-pbkdf2-net/

But I recommend you check the MSDN documentation for up to date information.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .