pbkdf2_sha256 C# implementation

Question

I've got a database where passwords are stored as pbkdf2_sha256. I want to create a tool (in C#) which should create new passwords.

My problem is: How can I encrypt the password in C#? I found a Java-Class which works for me, but I can not use this sample in C#. Is there a smilar way?

I tried also other classes but they do not seem to work.

EDIT: I found this class for C#. But when I call the ValidatePassword-Method it returns false. (Password and Hash are correct).

EDIT2: I found also this C# class but it doesn't seem to work. What did I wrong?

Here is the code which I use:

var salt = "FbSnXHPo12gb";
var password = "geheim";
var interactions = 12000;


using (var hmac = new HMACSHA256())
{
    var df = new Pbkdf2(hmac, password, salt, interactions);
    Console.WriteLine(BitConverter.ToString(df.GetBytes(32)));
    Console.WriteLine(String.ByteArrayToString(df.GetBytes(32)));
    Console.WriteLine(UTF8Encoding.UTF8.GetString(df.GetBytes(32)));
    Console.WriteLine(Convert.ToBase64String(df.GetBytes(32)));
}

//hash I should get: 
//pbkdf2_sha256$12000$FbSnXHPo12gb$LEpQrzPJXMI0m3tQuIE5mknqCv1GWgT5X2rWyLHN0Xk=

//hash I get:
//Rc8oMeSrbWyIJ+aXvGegFowKcIlwk8eIRyxXUf/a+t0=

The first one uses SHA1.

CodesInChaos
– CodesInChaos

2014-11-18 16:19:07 +00:00
Commented Nov 18, 2014 at 16:19 — CodesInChaos
– CodesInChaos, Commented Nov 18, 2014 at 16:19

Josip Medved · Accepted Answer · 2014-11-18 15:55:47Z

3

Do not convert hexadecimal output to base-64 string but convert bytes to it directly. And also notice that you will get new bytes on each df.GetBytes call. Equivalent example would be:

var salt = "FbSnXHPo12gb";
var password = "geheim";
var interactions = 12000;


using (var hmac = new HMACSHA256())
{
    var df = new Pbkdf2(hmac, password, salt, interactions);
    Console.WriteLine(Convert.ToBase64String(df.GetBytes(32)));
}

//hash I should get: 
//pbkdf2_sha256$12000$FbSnXHPo12gb$LEpQrzPJXMI0m3tQuIE5mknqCv1GWgT5X2rWyLHN0Xk=

//hash I get:
//LEpQrzPJXMI0m3tQuIE5mknqCv1GWgT5X2rWyLHN0Xk=

Notice that Java class has a header ("pbkdf2_sha256$12000$FbSnXHPo12gb$") while C# class only returns hash.

answered Nov 18, 2014 at 15:55

Josip Medved

3,7111 gold badge31 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Anti-weakpasswords · Accepted Answer · 2015-01-17 04:28:41Z

0

I have a fork of Jither's PBKDF2 C# DeriveBytes code at my Github repository, including a PBKDF2-HMAC-SHA-256 variant, a large set of test vectors, and an interface that both generates hashes and can check the results, if that example helps you.

answered Jan 17, 2015 at 4:28

Anti-weakpasswords

2,74223 silver badges28 bronze badges

Collectives™ on Stack Overflow

pbkdf2_sha256 C# implementation

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related