...
...
Say hello to PBKDF2
Let me run each app up and create a single registration with the password “password” (please people, this is an example only!):
| Salt | Password | |
| 2010 | SkFaUVXansqPe7lm9oHiQA== | UEWkR0OVsY6sNQuxFgyXCkpUvrY= |
| 2012 | z1h310KsaE/FmxxXNHUiXg== | saRtN7Aju+vqYfX25c1QpnxESIHsy1s6UiR5z7UwixM= |
Ok, what’s going on here? Why has the hash in the 2012 template blown out? Hashing algorithms always create the same cipher length regardless of the input string; it must mean that something different is going on. And there is – what you’re seeing here is the result of the universal membership provider which is now calling directly into the Crypto.HashPassword method that we’ve had in System.Web.Helpers for a little while now.
One of the great things about significant portions of ASP.NET now being open sourced is that it’s easier than ever to take a look under the covers. For those that want to see what’s going on, the entire crypto implementation is over on CodePlex. Most importantly for this post, the comments make it very easy to understand what’s happening:
/* =======================
* HASHED PASSWORD FORMATS
* =======================
*
* Version 0:
* PBKDF2 with HMAC-SHA1, 128-bit salt, 256-bit subkey, 1000 iterations.
* (See also: SDL crypto guidelines v5.1, Part III)
* Format: { 0x00, salt, subkey }
*/
And there it is – the membership provider is implementing 1,000 iterations of SHA1 so from a brute force perspective, this imposes a significant workload increase over the default implementation in the old SQL membership provider.
In that previous hashing weakness post I wrote, it took 44 mins and 56 seconds to crack 63% of common passwords in a sample size of nearly 40,000. Had that sample used the new universal membership provider, that time would have blown out to more than a month – 31.2 days, to be exact. Where I previously used the paradigm of sitting through a couple of episodes of The Family Guy, this is like watching The Phantom Menace back to back 330 times. Clearly this makes for a painful experience that will deter many a determined hacker.
Read more: Troy Hunt's Blog
QR: 