What algorithm does VerifyHashedPassword() use?

Question

In C#, there's a method called VerifyHashedPassword(). This does not take a hashing algorithm. In T-SQL, there's a method HashBytes(), which does require that you pass the hashing algorithm.

I am updating a program, and I need to verify the user's password. I have the table of hashed passwords, but I do not know what algorithm was used, only that the C# code uses VerifyHashedPassword, which does not take an algorithm parameter.

What algorithm can I pass to HashBytes() which will match what VerifyHashedPassword uses?

Edit: It is obvious that the suggested question does not answer my question. It is difficult to understand why anyone would have thought that it did.

it takes the one encoded in the hashed passwort, i would presume. at least if it's implemented correctly. — Franz Gleichmann
– Franz Gleichmann, Commented Nov 16, 2023 at 17:59
It's all in the source github.com/aspnet/AspNetIdentity/blob/main/src/… Looks like PBKDF2 with HMAC-SHA 128-bit — Charlieface
– Charlieface, Commented Nov 16, 2023 at 18:19
Does this answer your question? Is there a SQL implementation of PBKDF2? — Charlieface
– Charlieface, Commented Nov 16, 2023 at 18:20
@Charlieface It depends. Is PBKDF2 the algorithm that VerifyHashedPassword( ) uses? — tharpa
– tharpa, Commented Nov 16, 2023 at 18:28

Joel Coehoorn · Accepted Answer · 2023-11-16 18:21:26Z

0

You will probably NOT be able to use the SQL HashBytes() method to replicate the process, because you don't know the salt. And if you did know the salt, the whole point of modern algorithms is they are tunable, and you don't know the tuning factor used. And even if you knew the tuning factor, the newer tunable algorithems are not yet supported by HashBytes().

But the info you want is it uses the Rfc2898DerivedBytes type, which includes this in the documentation:

Implements password-based key derivation functionality, PBKDF2, by using a pseudo-random number generator based on HMACSHA1.

The output of a password hashed this way will also include a random salt as part of the result. The VerifyHashedPassword() then takes this value and separates the salt (and any other metadata, like the tuning factor) from this input value and uses it to duplicate the original hash process on the attempted password. Then it can compare the hashes to give a valid/invalid result.

I am updating a program, and I need to verify the user's password. I have the table of hashed passwords, but I do not know what algorithm was used, only that the C# code uses VerifyHashedPassword()

You should continue to use that process, if possible. Password validation is not typically done in the database itself.

edited Nov 16, 2023 at 18:21

answered Nov 16, 2023 at 17:59

Joel Coehoorn

418k114 gold badges582 silver badges820 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

tharpa Over a year ago

There's a method which takes a salt, and one which does not require a salt.

Joel Coehoorn Over a year ago

If you mean the "HashPassword()" function in the same class, that generates a random salt and then includes it as part of the result. The "Verify" method then splits them apart again to use the same salt with the attempted password.

Charlieface Over a year ago

"Password validation is not typically done in the database itself." isn't quite correct. The password should be hashed on the client side, and then passed to the server to compare the hashes.

Collectives™ on Stack Overflow

What algorithm does VerifyHashedPassword() use?

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related