Using Bcrypt with ServiceStack

Question

I am looking to use ServiceStack for an upcoming project, but I want to use bcrypt for hashing passwords. Currently the builtin repositories use SHA256 hashing. Is there any way for me to leverage the existing authentication code and use bcrypt instead?

Answer 1

To clarify here the password hashing in ServiceStack's Auth Provider is only used in Auth Providers that store a UserName / Password, i.e. the Credentials / Basic / Digest Auth providers.

Unfortunately the hashing provider is not easily swappable since its used in a few places in each of the different UserAuthRepo providers, see SaltedHash() in the OrmLiteAuthRepository and the RedisAuthRepository:

If you can come up with a shared interface that works with both the SHA256 SaltedHash that ServiceStack currently uses and something that also works with bcrypt I can re-factor it to make the Hashing provider overridable. i.e. Can a bcrypt hashing provider be made to work with this interface?

public interface IHashProvider {
    void GetHashAndSalt(byte[] Data, out byte[] Hash, out byte[] Salt);
    void GetHashAndSaltString(string Data, out string Hash, out string Salt);
    bool VerifyHash(byte[] Data, byte[] Hash, byte[] Salt);
    bool VerifyHashString(string Data, string Hash, string Salt);
}

Otherwise is there one that will work for both?