Re:ASP.NET MVC security and user management done the right way
by varunkho on Thursday June 27, 2013 @05:39AM
(#5951384)
No third party library. It uses standard algorithms like Rfc2898DeriveBytes (for pbkdf2), RNGCryptoServiceProvider ETC defined in System.Security.Cryptography (bundled into the .NET framework)
Re:ASP.NET MVC security and user management done the right way
by NicoJuicy on Thursday June 27, 2013 @07:04AM
(#5951636)
I'd advice bcrypt for it's slow hashing though.
I'd makes bruto forcing harder - longer :-)
Re:ASP.NET MVC security and user management done the right way
by varunkho on Thursday June 27, 2013 @08:38AM
(#5951971)
No Problem – the power of ASP Security Kit hlies in its flexibility and extensibility. You can provide your own implementation for most things including hashing routines if you don't find existing implementation suited for your particular needs. Till now, it is either not possible (in some cases) or difficult (in other cases) in the default ASP.NET implementation for membership management.
Re:ASP.NET MVC security and user management done the right way
by NicoJuicy on Wednesday July 03, 2013 @05:08AM
(#5983300)
I'll check it out soon.
My i ask, what do you use asp.net mvc for?
Myself (@Belgium):
ASP.Net MVC mostly for: - Ecommerce - Invoicing application (SMB development) - DDD application
I intentionally gave you some good options (PBKDF2, bcrypt) and some really bad ones (MD5, in house) to chose from. I assume that you are using a tested and trusted library to implement PBKDF2?
But isn't the work factor - the "number or iterations" in PBKDF2 is doing the same thing as key stretching, i.e. "make the hash function very slow". There is also a similar parameter in bcrypt. So you don't need to add anything else special to the crypto, and indeed shouldn't.