What is the equivalent of Python pbkdf2 usage in C# for migrating password hashes -
we investigating options/scenarios credentials of 2 seperate sources (pyhton django application , asp.net application) can migrated single credential store. there many ways migrate, , 1 of them following: copy password hashes single store , based on property, choose validation method.
so i'm trying validate password hash generated in python django in c# console application.
i've found resources like: https://docs.djangoproject.com/en/1.10/_modules/django/contrib/auth/hashers/
and
https://docs.djangoproject.com/en/1.10/_modules/django/contrib/auth/hashers/pbkdf2
but have difficulties translating logic c#. think because cryptography skills aren't sufficient.
i hope can point me right direction on this.
update 1:
i'm testing following python django password hash:
pbkdf2_sha256$20000$t4fxlmzy8zre$x0hjgqggyaombqsfoobf/8nmlzgsk6stt8ke3meg6bm= public bool verifypassword(string password, string hashedpassword, string salt) { // password: <test phrase> // hashedpassword: x0hjgqggyaombqsfoobf/8nmlzgsk6stt8ke3meg6bm= // salt: t4fxlmzy8zre int iterationcount = 20000; byte[] src = convert.frombase64string(hashedpassword); byte[] inputpwhash; using (var bytes = new rfc2898derivebytes(password, salt, iterationcount)) { inputpwhash = bytes.getbytes(32); } var result = slowequals(src, inputpwhash); return result; }
what i've tried creating custom pbkdf2 implementation hmacsha256 digest.
public class rfc2898derivebytes : derivebytes, idisposable { public rfc2898derivebytes(byte[] password, byte[] salt, int32 iterations) { _hmacsha256obj = new hmacsha256(password); hlen = _hmacsha256obj.hashsize / 8; _passwordbytes = password; _saltbytes = salt; _iterationcount = iterations; } }
and i'll match hashresult following way:
public bool verifypassword(string password, string hashedpassword, string salt) { int iterationcount = 20000; byte[] src = convert.frombase64string(hashedpassword); byte[] inputpwhash; using (var bytes = new rfc2898derivebytes(password, salt, iterationcount)) { inputpwhash = bytes.getbytes(32); } var result = slowequals(src, inputpwhash); return result; }
but hash results not same. need text encoding?
i've found solution problemen here: https://stackoverflow.com/a/18649357/167196
credits original author.
Comments
Post a Comment