3

Having me know little about cryptography, I am trying to find the best approach to hash a user password in some vb.net winform application; then store it in online mysql db. I found lots of posts about the topic but can't figure out which one is the best approach.

I reach this MSDN post but still can't be sure if I can use it.

I can't where to enter some random key, it is generated automatically by the function.

So my question is , is this a solid function for password hash? Any alternatives?

Thank you

The code:

Imports System
Imports System.IO
Imports System.Security.Cryptography



Class AesExample

    Public Shared Sub Main()
        Try

            Dim original As String = "Here is some data to encrypt!"

            ' Create a new instance of the Aes
            ' class.  This generates a new key and initialization 
            ' vector (IV).
            Using myAes As Aes = Aes.Create()

                ' Encrypt the string to an array of bytes.
                Dim encrypted As Byte() = EncryptStringToBytes_Aes(original, myAes.Key, myAes.IV)

                ' Decrypt the bytes to a string.
                Dim roundtrip As String = DecryptStringFromBytes_Aes(encrypted, myAes.Key, myAes.IV)

                'Display the original data and the decrypted data.
                Console.WriteLine("Original:   {0}", original)
                Console.WriteLine("Round Trip: {0}", roundtrip)
            End Using
        Catch e As Exception
            Console.WriteLine("Error: {0}", e.Message)
        End Try

    End Sub 'Main

    Shared Function EncryptStringToBytes_Aes(ByVal plainText As String, ByVal Key() As Byte, ByVal IV() As Byte) As Byte()
        ' Check arguments.
        If plainText Is Nothing OrElse plainText.Length 

1 Answer 1

2

Do not encrypt passwords, when the attacker gets the DB he will also get the encryption key. Just using a hash function is not sufficient and just adding a salt does little to improve the security. Iterate over an HMAC with a random salt for about a 100ms duration and save the salt with the hash. Use a function such as ehash, PBKDF2, Bcrypt, passlib.hash or similar functions. The point is to make the attacker spend a lot of time finding passwords by brute force.

NIST currently recommends PBKDF2 for a password verifier.

See:

Sign up to request clarification or add additional context in comments.

2 Comments

Thank you so much @zaph, If you can kindly post a link to implementation in vb.net that would be great. Thanks
.NET Rfc2898DeriveBytes, is PBKDF2 it's just that MS likes to add confusion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.