hash password in SQL Server (asp.net)

Question

Is this how hashed password stored in SQL Server should look like?

alt text http://img28.imageshack.us/img28/2545/88871034.gif

This is function I use to hash password (I found it in some tutorial)

public string EncryptPassword(string password)
{
    //we use codepage 1252 because that is what sql server uses
    byte[] pwdBytes = Encoding.GetEncoding(1252).GetBytes(password);
    byte[] hashBytes = System.Security.Cryptography.MD5.Create().ComputeHash(pwdBytes);
    return Encoding.GetEncoding(1252).GetString(hashBytes);
}

EDIT I tried to use sha-1 and now strings seem to look like as they are suppose to:

public string EncryptPassword(string password)
{
    return FormsAuthentication.HashPasswordForStoringInConfigFile(password, "sha1");
}

// example output: 39A43BDB7827112409EFED3473F804E9E01DB4A8

Result from the image above looks like broken string, but this sha-1 looks normal....

Will this be secure enough?

Dave Markle · Accepted Answer · 2010-05-13 10:10:19Z

3

Your're close, but not quite there.

For a secure hash, you will need a salt value in another column. Second, try to stay away from MD5 as a hashing provider. It's not as secure as SHA-1 or SHA-2. SHA-1 is included in .NET just like MD5 is.

answered May 13, 2010 at 10:10

Dave Markle

98.3k20 gold badges152 silver badges172 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ilija veselica Over a year ago

So, you're saying that this kind of entry looks ok?

Chris W Over a year ago

Your sha1 sample looks normal but you should do as Dave says and throw in a salt value as well.

Dave Markle Over a year ago

check out stackoverflow.com/questions/1300890/…

Collectives™ on Stack Overflow

hash password in SQL Server (asp.net)

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related