I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects.
First I create a random salt based on a 32 byte array :
RNGCryptoServiceProvider provider = new RNGCryptoServiceProvider();
byte randomNumber = new byte;
string salt = System.Text.Encoding.UTF8.GetString(randomNumber);
I would then store that salt in the user's database row.
To hash the password, I would use :
// Create a new instance of the RijndaelManaged
// class. This generates a new key and initialization
// vector (IV).
using (RijndaelManaged myRijndael = new RijndaelManaged())
// Encrypt the string to an array of bytes.
byte encrypted = EncryptStringToBytes(salt + password, myRijndael.Key, myRijndael.IV);
string encryptedPassword = System.Text.Encoding.UTF8.GetString(encrypted);
The EncryptStringToBytes and DecryptStringFromBytes methods can be seen here : http://msdn.microsoft.com/en-us/library/system.security.cryptography.rijndaelmanaged.aspx
If anyone could look this over and let me know of any vulnerabilities or places where I could strengthen it, I would greatly appreciate it! Thanks!
I've implemented a version of BCrypt here :
string myPassword = "password"; string mySalt = BCrypt.GenerateSalt(); string myHash = BCrypt.HashPassword(myPassword, mySalt);