WebMatrix WebSecurity PasswordSalt

Question

I am using WebMatrix and have built a website based on the \"StarterSite\". In this starter site you get a nice basic layout - including registration, login, forgot password

Answer 1

As of the RTM release of WebMatrix/ASP.NET Web Pages, the salt feature/column is unused.

If you open up the Web Pages source, you'll see the db classes littered with references like

INSERT INTO [" + MembershipTableName + "] (UserId, [Password], PasswordSalt

...

VALUES (uid, hashedPassword,String.Empty /* salt column is unused */

shortened for emphasis

There are definately ways to override and implement this behavior, first being:

• override System.WebData.SimpleMembershipProvider.CreateAccount()

or

• extend with System.WebData.SimpleMembershipProvider.CreateAccountWithPasswordSalt()

not going to go into detail there though unless you request, as your usage of WebMatrix and a template suggests you probably don't wanna mess with rewriting a ton of your own C#/ASP code for this project.

Answer 2

The above answer gives the impression that there is no salting applied when using WebSecurity SimpleMembershipProvider.

That is not true. Indeed the database salt field is not used, however this does not indicate that there is no salt generated when hashing the password.

In WebSecuritys SimpleMembershipProvider the PBKDF2 algo is used, the random salt is generated by the StaticRandomNumberGenerator and stored in the password field with the hash:

byte[] outputBytes = new byte[1 + SALT_SIZE + PBKDF2_SUBKEY_LENGTH];
Buffer.BlockCopy(salt, 0, outputBytes, 1, SALT_SIZE); 
Buffer.BlockCopy(subkey, 0, outputBytes, 1 + SALT_SIZE, PBKDF2_SUBKEY_LENGTH);
return Convert.ToBase64String(outputBytes);