ASP.NET Membership C# - How to compare existing password/hash
- by Steve
I have been on this problem for a while. I need to compare a paasword that the user enters to a password that is in the membership DB. The password is hashed and has a salt.
Because of the lack of documentation I do not know if the salt is append to the password and then hashed how how it is created.
I am unable to get this to match. The hash returned from the function never matches the hash in the DB and I know for fact it is the same password. Microsoft seems to hash the password in a different way then I am.
I hope someone has some insights please.
Here is my code:
protected void Button1_Click(object sender, EventArgs e)
{
//HERE IS THE PASSWORD I USE, SAME ONE IS HASHED IN THE DB
string pwd = "Letmein44";
//HERE IS THE SALT FROM THE DB
string saltVar = "SuY4cf8wJXJAVEr3xjz4Dg==";
//HERE IS THE PASSWORD THE WAY IT STORED IN THE DB AS HASH
string bdPwd = "mPrDArrWt1+tybrjA0OZuEG1P5w=";
// FOR COMPARISON I DISPLAY IT
TextBox1.Text = bdPwd;
// HERE IS WHERE I DISPLAY THE return from THE FUNCTION, IT SHOULD MATCH THE PASSWORD FROM THE DB.
TextBox2.Text = getHashedPassUsingUserIdAsSalt(pwd, saltVar);
}
private string getHashedPassUsingUserIdAsSalt(string vPass, string vSalt)
{
string vSourceText = vPass + vSalt;
System.Text.UnicodeEncoding vUe = new System.Text.UnicodeEncoding();
byte[] vSourceBytes = vUe.GetBytes(vSourceText);
System.Security.Cryptography.SHA1CryptoServiceProvider vSHA = new System.Security.Cryptography.SHA1CryptoServiceProvider();
byte[] vHashBytes = vSHA.ComputeHash(vSourceBytes);
return Convert.ToBase64String(vHashBytes);
}
