Someone told me about it and showed me the characteristics of version 3:

ASP.NET Core Identity Version 3: PBKDF2 with HMAC-SHA256, 128-bit salt, 256-bit subkey, 10000 iterations

Which was from Andrew Lock's website.

Assuming it is implemented correctly, if an attacker was to get access to one's database, would any kind of attack even be feasible to find the same matching hash?


"How Secure is X" is a subjective question unless you are talking about something which is provably secure (like a randomly generated one time pad) or undeniably secure by today's standards (like AES-256). Unfortunately, this is not one of those cases. For most uses I think it would be fair to say that Identity version 3 is "secure enough", but there are those that still advocate taking it a step further by increasing the iteration count or using a different hashing algorithm.

  • Oh yes, excuse me for asking my question in a generalised manner, I just did not know how to phrase it correctly. Thank you for your response, but I'm still unsure as to what situations this would be deemed unsecure, especially with the addition of the 128-bit salt and 256-bit subkey. – Azxdreuwa Mar 26 '18 at 18:34
  • 1
    @Azxdreuwa - In general, there are very few situations where this would be considered insecure. The salt and subkey are large enough such that brute force is the only attack. Again this is completely subjective because if it takes a normal hacker 25 years to brute force one password, is that secure? What about a wealthy hacker that takes 6 months to brute force a single password? – TTT Mar 26 '18 at 20:28
  • Ah yes true. However, isn't a brute-force attack against this kind of method practically useless with today's hardware, even with supercomputers? Wouldn't there just be way too many permutations to scan across over such a large range of values? – Azxdreuwa Mar 26 '18 at 20:37
  • @Azxdreuwa - the point of salted hashing algorithms is that the only method of attack is by brute force. Once that is established the only way to compare the algorithms is "How long does it take to try 1 password, and what is the probability of a collision?" Most algorithms these days will discover the real password before finding a collision, and therefore the question is reduced to speed to try one password. This is why more iterations matter. Brute force is not impossible even with slow algorithms if the password is short, say less than 12 characters. – TTT Mar 26 '18 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.