CODEWITHSUNDEEP
asp.netsecurityhashpasswords
amateur
amateur

Reputation: 44605

mechanism for hashing passwords

I have a .net application that stores hashed passwords in a sql server database.

The passwords are hashed using a salt that gets stored in the database with the hashed passwords.

As an extra layer of security, I hash the hashed password with another sitewide secret key that is not stored on the database server for security reasons. As the system is load balanced, where should I store the sitewide secret key? Store a copy of it in the config of each of my .net applications (same value on all servers).

Second question is, what is the recommended hashing mechanism for storing passwords?

Upvotes: 1

Views: 126

Answers (1)

scottheckel
scottheckel

Reputation: 9244

I tend to use bcrypt storing passwords. The .NET implementation of it is BCrypt.NET as it doesn't come in the .NET framework at this point. You do not want to use a general purpose hash function like MD5. Another common algorithm is PBKDF2, but I have not personally used it in .NET.

Upvotes: 2

Related Questions