recreating pythons werkzeug.security generate_password_hash in C#

Question

Seems simple enough, and there are plenty of examples but I just can't seem to get hashes that verify with werkzeug.security's check_password_hash in python.

    private string Generate_Passwd_Hash()
    {
        string _password = "Password";
        string _salt = "cXoZSGKkuGWIbVdr";
        SHA256 MyHash = SHA256.Create();
        byte[] hashable = System.Text.Encoding.UTF8.GetBytes(_salt + _password);
        byte[] resulthash = MyHash.ComputeHash(hashable);

        return "sha256$" + _salt + "$" + BitConverter.ToString(resulthash).Replace("-", "").ToLower();
    }

this should generate;
sha256$cXoZSGKkuGWIbVdr$7f5d63e849f0a2c0c5c2bd6ae4e45ead2ac730c853a1ed3460e227c06c567f49
but doesn't.

EDIT
Reading through the python code for generate_password_hash and it has a default number of iterations of 260000. Which is probably what I'm missing.

Lei Yang · Accepted Answer · 2022-03-14T07:31:42.087

I never used werkzeug but I tried to reproduce your probelem. I had read the docs of werkzeug.security.generate_password_hash and realized it is used in password validation only, and not meant to be a universal hashing algorithm.

The document clearly says

Hash a password with the given method and salt with a string of the given length. The format of the string returned includes the method that was used so that check_password_hash() can check the hash.

hashlib.pbkdf2_hmac is the hashing algorithm werkzeug uses internally(from now on we call it underlying algorithm). and you don't need install it because it is in standard library.

The source code of check_password_hash shows it generates a random salt before calling underlying algorithm. The salt is to protect from attacks. And it is remembered by the werkzeug framework so that check_password_hash can use to validate later.

So to summarize: werkzeug.security.generate_password_hash only guarantee that generated hash can be validated by check_password_hash, and no more. You simply cannot(or not supposed to) try to generate same hash by other libraries or languages.

If you really want to compare the hashing algorithm in python and C#, please post another question(or update this question) that compares underlying algorithm(hashlib.pbkdf2_hmac which allow specifying salt as parameter) with C# version. Note seems in C# there's no built in algorithm for pbkdf2, see Hash Password in C#? Bcrypt/PBKDF2.

I will have to call some python from C# to generate the password. Thanks for your time. — Richard, Mar 17 '22 at 02:16

recreating pythons werkzeug.security generate_password_hash in C#

1 Answers1