Secure Password Hashing

Question

I need to store a hash of a single password in a .Net WinForms application.

What\'s the most secure way to do this?

In particular:

• Salt, HMAC,

Answer 1

For a server-side implementation with a large number of passwords, you should definitely use a tunable iterated approach like bcrypt. This well-known article on the topic is still (mostly) relevant:

http://www.securityfocus.com/blogs/262

For a single password in a stand-alone application, where the storage location is probably already secured by the system's own authentication system, I think it's much less important. A single strong hash is likely good enough, and adding salt is easy enough that there's no reason not to do so.