How can i manually hash password just like asp.net identity does

Question

We have a legacy desktop application that stores plain text passwords in a users table. I have created web version of the same on asp.net mvc 4.5.

I am using asp.net identity 2.0, and have virtually linked aspnetusers table to users table. I do this by running a script that inserts all users from users table into aspnetusers table and the ids remain same in both tables. [I cannot even add a single column into the existing table to make it work with asp.net identity.]

Our requirement is that passwords will be same for both web and desktop applications.

Now my problem is how do i create a hash of all those passwords and put them into password hash of aspnetusers table. How does asp.net identity do it? Can i replicate that same mechanism in sql so whenever a password change happens in users table, i can run a trigger and recalculate the hash for my aspnetusers table?

yes i found it here: https://stackoverflow.com/questions/20621950/asp-net-identity-default-password-hasher-how-does-it-work-and-is-it-secure — Samra, Nov 12 '17 at 23:04

score 9 · Accepted Answer · answered Nov 12 '17 at 23:06

I found the answer here

public static string HashPassword(string password)
{
  byte[] salt;
  byte[] buffer2;
  if (password == null)
  {
      throw new ArgumentNullException("password");
  }
  using (Rfc2898DeriveBytes bytes = new Rfc2898DeriveBytes(password, 0x10, 0x3e8))
  {
    salt = bytes.Salt;
    buffer2 = bytes.GetBytes(0x20);
  }
  byte[] dst = new byte[0x31];
  Buffer.BlockCopy(salt, 0, dst, 1, 0x10);
  Buffer.BlockCopy(buffer2, 0, dst, 0x11, 0x20);
  return Convert.ToBase64String(dst);
}

Using ASP.NET Core Identity 2.2 this code results in a different Hash than Identity saves for same password — Matias Masso, May 29 '22 at 17:07

score 0 · Answer 2 · answered Jun 01 '22 at 07:44

0

based on .net6 latest version: https://github.com/mammadkoma/webapi/blob/master/WebApi/Utilities/PasswordHasher.cs

use: https://github.com/mammadkoma/webapi/blob/master/WebApi/Controllers/UserController/UserController.cs

answered Jun 01 '22 at 07:44

M Komaei

7,006
2
28
34

How can i manually hash password just like asp.net identity does

2 Answers2