Someone told me about it and showed me the characteristics of version 3:

ASP.NET Core Identity Version 3: PBKDF2 with HMAC-SHA256, 128-bit salt, 256-bit subkey, 10000 iterations

Which was from Andrew Lock's website.

Assuming it is implemented correctly, if an attacker was to get access to one's database, would any kind of attack even be feasible to find the same matching hash?


"How Secure is X" is a subjective question unless you are talking about something which is provably secure (like a randomly generated one time pad) or undeniably secure by today's standards (like AES-256). Unfortunately, this is not one of those cases. For most uses I think it would be fair to say that Identity version 3 is "secure enough", but there are those that still advocate taking it a step further by increasing the iteration count or using a different hashing algorithm.

  • 1
    @Azxdreuwa - In general, there are very few situations where this would be considered insecure. The salt and subkey are large enough such that brute force is the only attack. Again this is completely subjective because if it takes a normal hacker 25 years to brute force one password, is that secure? What about a wealthy hacker that takes 6 months to brute force a single password? – TTT Mar 26 '18 at 20:28
  • @Azxdreuwa - the point of salted hashing algorithms is that the only method of attack is by brute force. Once that is established the only way to compare the algorithms is "How long does it take to try 1 password, and what is the probability of a collision?" Most algorithms these days will discover the real password before finding a collision, and therefore the question is reduced to speed to try one password. This is why more iterations matter. Brute force is not impossible even with slow algorithms if the password is short, say less than 12 characters. – TTT Mar 26 '18 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy