Many articles and approaches claims that it doesn't matter what is the application security level, or what is the security level of the environment the application is stored in (like working under SSL using https protocol etc...), you should always save all passwords and secret data encrypted. That because there is always a chance, even little one, that someone could steal your confidential data.
There are many hashing functions and alogorithms, several are MD5, SHA1 and more... but, these algorithms are too old (compare to our modern days), there generates 'only' a 128 bits value, so the space of posible resulting values is 2128 in size, which by creating a crack script, like the passcracking project the hash could be broken.
Because of these limitaions and cracking possibilities it is not recommended to use this type of hasing functions. Better solution you wiil see later... (hold on :) ).
One way Hash Functions
The following definitions are taken from the Bruce Schneier's Book: Applied Cryptography Second Edition:
A one-way hash function, H(M), operates on an arbitrary-length pre-image message, M. It returns a fixed-length hash value, h.
- h = H(M), where h is of length m
Many functions can take an arbitrary-length input and return an output of fixed length, but one-way hash functions have additional characteristics that make them one-way [1065]:
- Given M, it is easy to compute h.
- Given h, it is hard to compute M such that H(M)= h.
- Given M, it is hard to find another message, M’, such that H(M) = H(M’).
In some applications, one-wayness is insufficient; we need an additional requirement called collision-resistance.
It is hard to find two random messages, M and M’, such that H(M) = H(M’).
Now, by getting the main idea of the basic hashing algorithm by the Bruce Schneier's Book definitions, I want to show you better alternatives that comes to replace and enrich the old ones.
WHIRPOOL generates a 512 bits output, RIPEMD, uses 160, 128 or 320 bits output, but I want to focus in the SHA-2, function that generates 256, 512 bits ouputs, because there is available API in Microsoft.NET framework.
The main classes that implements this cryptografic algorithms are:
- System.Security.Cryptography.SHA256Managed
- System.Security.Cryptography.SHA384Managed
-
System.Security.Cryptography.
SHA512Managed
Now to the implementations. The following code below shows you an example how to use this function in porpuse to encrypt a password or just confidential data that you want to store hashed:
byte[] data, encryptedBytes;
string hashedPassword = string.Empty;
data = Encoding.Default.GetBytes(plainPassword);
System.Security.Cryptography.SHA256 sha2 = new System.Security.Cryptography.SHA256Managed();
encryptedBytes = sha2.TransformFinalBlock(data, 0, data.Length);
foreach (byte b in sha2.Hash)
hashedPassword += Convert.ToString(b, 16).ToUpper().PadLeft(2, '0');
sha2.Clear();
// hashedPassword holds the hashed string
This example above encript the plain pasword using SHA-2 algorithm.
The following example uses a salt which comes to help reduce the risk of dictionary attacks, the code appends random bytes (so-called "salt") to the original plain text before generating hashes. Please keep in mind that salt can only help against prebuilt dictionaries. If an intruder gets access to your system and uses a brute force attack, salt will not provide much value.
string hashedPassword = string.Empty;
//generate a random salt value by using the following code
byte[] salt = new byte[32];
System.Security.Cryptography.RNGCryptoServiceProvider.Create().GetBytes(salt);
byte[] salt = Encoding.Default.GetBytes(userName);
//Convert the plain string password into bytes
byte[] plainPasswordBytes = System.Text.UnicodeEncoding.Unicode.GetBytes(plainPassword);
// Append salt to password before hashing
byte[] combinedBytes = new byte[plainPasswordBytes.Length + salt.Length];
System.Buffer.BlockCopy(plainPasswordBytes, 0, combinedBytes, 0, plainPasswordBytes.Length);
System.Buffer.BlockCopy(salt, 0, combinedBytes, plainPasswordBytes.Length, salt.Length);
//Create hash for the password + salt
System.Security.Cryptography.HashAlgorithm hashAlgo = new System.Security.Cryptography.SHA256Managed();
byte[] hash = hashAlgo.ComputeHash(combinedBytes);
//Append the salt to the hash
byte[] hashPlusSalt = new byte[hash.Length + salt.Length];
System.Buffer.BlockCopy(hash, 0, hashPlusSalt, 0, hash.Length);
System.Buffer.BlockCopy(salt, 0, hashPlusSalt, hash.Length, salt.Length);
foreach (byte b in hashPlusSalt)
hashedPassword += Convert.ToString(b, 16).ToUpper().PadLeft(2, '0');
// hashedPassword holds the hashed string
That's it, now use it properly and try to avoid as much as you can from brut attacking...