CODEWITHSUNDEEP
c#authenticationhashpasswords
divx
divx

Reputation: 87

Rfc2898DeriveBytes password matches with string and not with byte[]

I am trying to create an authentication server with login and password credentials and I used this tutorial that gave me the following PasswordHash class. This works great when I use the Verify method with a string but I do not want to send the password unencrypted through UDP for security reasons but when I test the hashes directly by feeding it the byte array it returns false (as shown below the class).

public sealed class PasswordHash
{
    const int SaltSize = 16, HashSize = 20, HashIter = 10000;
    readonly byte[] _salt, _hash;

    private PasswordHash() { }

    public PasswordHash(string password)
    {
        new RNGCryptoServiceProvider().GetBytes(_salt = new byte[SaltSize]);
        _hash = new Rfc2898DeriveBytes(password, _salt, HashIter).GetBytes(HashSize);
    }
    public PasswordHash(byte[] hashBytes)
    {
        Array.Copy(hashBytes, 0, _salt = new byte[SaltSize], 0, SaltSize);
        Array.Copy(hashBytes, SaltSize, _hash = new byte[HashSize], 0, HashSize);
    }
    public PasswordHash(byte[] salt, byte[] hash)
    {
        Array.Copy(salt, 0, _salt = new byte[SaltSize], 0, SaltSize);
        Array.Copy(hash, 0, _hash = new byte[HashSize], 0, HashSize);
    }
    public byte[] ToArray()
    {
        byte[] hashBytes = new byte[SaltSize + HashSize];
        Array.Copy(_salt, 0, hashBytes, 0, SaltSize);
        Array.Copy(_hash, 0, hashBytes, SaltSize, HashSize);
        return hashBytes;
    }
    public byte[] Salt { get { return (byte[])_salt.Clone(); } }
    public byte[] Hash { get { return (byte[])_hash.Clone(); } }
    public bool Verify(string password)
    {
        byte[] test = new Rfc2898DeriveBytes(password, _salt, HashIter).GetBytes(HashSize);
        for (int i = 0; i < HashSize; i++)
            if (test[i] != _hash[i])
                return false;
        return true;
    }

    public bool Verify(byte[] passwordHash) 
    {
        for (int i = 0; i < HashSize; i++)
            if (passwordHash[i] != _hash[i])
                return false;
        return true;
    }
}

I tested it by using:

bool test = new PasswordHash("test123").Verify("test123"); //TRUE
bool test2 = new PasswordHash("test123").Verify(newPasswordHash("test123").ToArray()); //FALSE

So as Nissim pointed out, they don't match because the salt is randomly generated every time I call new PasswordHash(). Is there anyway to bypass the salt that's added to the byte[]?

Upvotes: 0

Views: 1085

Answers (1)

Nissim
Nissim

Reputation: 6553

Each time you call the PasswordHash's constructor it creates a new salt, hence in the following example:

byte[] pass1 = new HashPassword("abc").ToArray();
byte[] pass2 = new HashPassword("abc").ToArray();

pass1 is different than pass2

Upvotes: 3

Related Questions