Geek Answers Handbook

Is SHA512Managed the best one-way hash available in .NET 3.5 for security?

Three SHA512 Managed Questions:

  • Is SHA512Managed considered the best one-way hash available in .NET 3.5 for security?
  • What size of salt should be used with SHA512Managed? The application is designed for strong passwords with a length of at least 8 characters.
  • Is 512 overkill compared to 256 for small strings?
+4
source share
3 answers

  • Sha512Managed does not depend on system calls and has the largest hash size of built-in hashes. If you do not optimize for anything else, this will be considered the most secure.

  • For the purpose of breaking the password, salt significantly increases the size of the password. Although “the more the better”, everything that exceeds the number of bits of the password itself is largely lost. So, for the min 8 ASCII character symbol, you can go for 64-bit salt.

  • Yes and no. It overwhelms modern technology; row size does not matter. If you need your passwords for security over the next 100 years, well, go for 512.

Link: http://www.codeproject.com/KB/security/Cryptography_NET.aspx

+3
source

Ben's answer is incorrect, you should not use SHA * functions for hash passwords. You must use a hash function specifically designed for hashing passwords such as PBKDF2, BCrypt, or SCrypt. Minimal answer and comments are correct.

Since you want to use the standard .NET library, I suggest Rfc2898DeriveBytes, which is an implementation of PBKDF2.

http://msdn.microsoft.com/en-us/library/system.security.cryptography.rfc2898derivebytes.aspx

+16
source

If you are looking for brute force attack prevention, get the booty in bcrypt or scrypt. They are designed algorithmically slowly. Thus, even if the attacker gained access to the password database, the calculation of everything will last forever.

http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password-hashing-for-dotnet-and-mono.ashx

http://www.tarsnap.com/scrypt.html

+6
source

More articles:


All Articles