Giter VIP home page Giter VIP logo

Comments (6)

bricelam avatar bricelam commented on July 19, 2024

FYI, I was able to re-implement the password hasher using the Windows.Security.Cryptography namespace.

public static string HashPassword(string password)
{
    var salt = CryptographicBuffer.GenerateRandom(SaltSize);
    var passwordBytes = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8);
    var deriver = KeyDerivationAlgorithmProvider.OpenAlgorithm(KeyDerivationAlgorithmNames.Pbkdf2Sha1);
    var passwordKey = deriver.CreateKey(passwordBytes);
    var parameters = KeyDerivationParameters.BuildForPbkdf2(salt, Pbkdf2IterCount);
    var subkey = CryptographicEngine.DeriveKeyMaterial(passwordKey, parameters, Pbkdf2SubkeyLength);

    var outputBytes = new byte[1 + SaltSize + Pbkdf2SubkeyLength];
    Buffer.BlockCopy(salt.ToArray(), 0, outputBytes, 1, SaltSize);
    Buffer.BlockCopy(subkey.ToArray(), 0, outputBytes, 1 + SaltSize, Pbkdf2SubkeyLength);

    return Convert.ToBase64String(outputBytes);
}

public static bool VerifyHashedPassword(string hashedPassword, string password)
{
    var hashedPasswordBytes = Convert.FromBase64String(hashedPassword);

    if (hashedPasswordBytes.Length != 1 + SaltSize + Pbkdf2SubkeyLength || hashedPasswordBytes[0] != 0)
        return false;

    var salt = new byte[SaltSize];
    Buffer.BlockCopy(hashedPasswordBytes, 1, salt, 0, SaltSize);
    var storedSubkey = new byte[Pbkdf2SubkeyLength];
    Buffer.BlockCopy(hashedPasswordBytes, 1 + SaltSize, storedSubkey, 0, Pbkdf2SubkeyLength);
    var passwordBytes = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8);
    var deriver = KeyDerivationAlgorithmProvider.OpenAlgorithm(KeyDerivationAlgorithmNames.Pbkdf2Sha1);
    var passwordKey = deriver.CreateKey(passwordBytes);
    var parameters = KeyDerivationParameters.BuildForPbkdf2(salt.AsBuffer(), Pbkdf2IterCount);
    var generatedSubkey = CryptographicEngine.DeriveKeyMaterial(passwordKey, parameters, Pbkdf2SubkeyLength);

    return CryptographicBuffer.Compare(storedSubkey.AsBuffer(), generatedSubkey);
}

from identity.

davidfowl avatar davidfowl commented on July 19, 2024

Which components in particular? Do we need another repository split out from this out from this one?

from identity.

bricelam avatar bricelam commented on July 19, 2024

@davidfowl I talked to @divega and @rustd about the scenarios I'm hoping for. I think the plan is to have some building-block components that are portable (like UserManager) that the OWIN-specific parts would build on top of (and tie together into nicer APIs).

from identity.

rustd avatar rustd commented on July 19, 2024

AccountLockout and TwoFactorAuth checks are defined in SignInManager which pulls in OWIN as well. Users should able to do AccountLockOut in Desktop/ Store and PhoneApps so we should split this

from identity.

divega avatar divega commented on July 19, 2024

As we talked about yesterday afternoon with @HaoK, we need to move the definition of the abstraction of the SignInManager to Core, then we make the "web security" implementation of it rely on OWIN. This should not only give us what Brice wanted but also nice DI registration extension methods.

from identity.

HaoK avatar HaoK commented on July 19, 2024

Tracking with #120

from identity.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.