473,803 Members | 3,943 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Password Hashing and Salting - Recommended Reading

Looking for recommendations for *credible* information on implementing
password hashing and salting. I did my own search and came up with a bunch
of somewhat contradictory often "shooting-from-the-hip" and
advertisement-laden pages... looking for something more academic with an
objective treatment of the topic.

Thanks!
Nov 18 '05 #1
4 1393
Keith Brown has a brief explanation here:
http://msdn.microsoft.com/msdnmag/is...ecurityBriefs/

HTH,

--
Scott
http://www.OdeToCode.com

On Sat, 11 Sep 2004 14:33:09 -0700, "Guadala Harry" <GM**@NoSpam.co m>
wrote:
Looking for recommendations for *credible* information on implementing
password hashing and salting. I did my own search and came up with a bunch
of somewhat contradictory often "shooting-from-the-hip" and
advertisemen t-laden pages... looking for something more academic with an
objective treatment of the topic.

Thanks!


Nov 18 '05 #2
http://www.dotnetjunkies.com/Tutoria...28327FF14.dcik

Greg

"Guadala Harry" <GM**@NoSpam.co m> wrote in message
news:ez******** *****@TK2MSFTNG P09.phx.gbl...
Looking for recommendations for *credible* information on implementing
password hashing and salting. I did my own search and came up with a bunch
of somewhat contradictory often "shooting-from-the-hip" and
advertisement-laden pages... looking for something more academic with an
objective treatment of the topic.

Thanks!

Nov 18 '05 #3
Building Secure ASP .NET Applications
http://www.microsoft.com/downloads/d...C-BF9C6593F25E

Eliyahu

"Guadala Harry" <GM**@NoSpam.co m> wrote in message
news:ez******** *****@TK2MSFTNG P09.phx.gbl...
Looking for recommendations for *credible* information on implementing
password hashing and salting. I did my own search and came up with a bunch
of somewhat contradictory often "shooting-from-the-hip" and
advertisement-laden pages... looking for something more academic with an
objective treatment of the topic.

Thanks!

Nov 18 '05 #4
Here's a couple good articles on hashing:
http://www.aspnetpro.com/NewsletterA...200304so_l.asp
http://aspnet.4guysfromrolla.com/articles/103002-1.aspx

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net

"Guadala Harry" <GM**@NoSpam.co m> wrote in message
news:ez******** *****@TK2MSFTNG P09.phx.gbl...
Looking for recommendations for *credible* information on implementing
password hashing and salting. I did my own search and came up with a bunch
of somewhat contradictory often "shooting-from-the-hip" and
advertisement-laden pages... looking for something more academic with an
objective treatment of the topic.

Thanks!

Nov 18 '05 #5

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
6079
by: Lobang Trader | last post by:
Hi all, I am trying to create a username and a password class. I would like to know what are the RECOMMENDED minimum and maximum length for both fields? These fields will be something like this: private static final int DEFAULT_MINIMUM_LENGTH = ??????
3
14523
by: arktikturtle | last post by:
Hi! I'm looking for a way to validate a password within PL/SQL. I want to write CREATE PROCEDURE change_password(old_password IN VARCHAR2) IS BEGIN -- check if old_password is correct... but how? I can get the hashed value of the password from DBA_USERS, of course, but is there a way to hash old_password to see if it matches? (I wouldn't be
4
2698
by: chuy | last post by:
Is there a way to recover a lost password in Mysql 4.1. I have seen many articles and howto's on how to kill the Mysql process and then restart using skip grant tables option. I am not trying to reset the password but rather recover it. Resetting the password to something else would cause a problem some of the underlying programs that rely on MySQL. I don't feel like changing code for every application that is using MySQL in my site. ...
26
5524
by: David Garamond | last post by:
I read that the password hash in pg_shadow is salted with username. Is this still the case? If so, since probably 99% of all PostgreSQL has "postgres" as the superuser name, wouldn't it be better to use standard Unix/Apache MD5 hash instead? -- dave ---------------------------(end of broadcast)---------------------------
21
2954
by: solomon_13000 | last post by:
I am using ms access database and asp 3.0 as my front end. In my database there is a table called account and a field called password. How do I protect the password stored in the database.
9
2837
by: neokosmos | last post by:
This may only be tangentially related to Python, but since I am coding a password authentication system in Python, I thought I would ask here. In Linux (and presumably other *NIX systems that support it), when shadow passwords are enabled, the actual password is not stored. Instead an encrypted version is stored. Then, to authenticate the password, the system re-encrypts the user's input to see if it matches the stored, encrypted...
5
3302
by: John | last post by:
Hi I am trying to set a new password using the following code; Dim u As MembershipUser = Membership.GetUser(UserName) Dim OldPassword As String OldPassword = u.GetPassword If u.ChangePassword(OldPassword, Password) Then ChangePassword = True
11
15624
by: cooltoriz | last post by:
Hello there, I just found that the compiled code won't hide the string variables so that I can see them by opening the execuable using Notepad. I have couple applications that have password hardcoded and I've been thinking that the string varialbes are hidden in compiled code. I knew that the VS.NET doesn't compile the source code into machine code. But I didn't know that it will expose string variables in the compiled code. Here is my...
5
1918
by: =?Utf-8?B?Sm9l?= | last post by:
I need to store a password for use later in my web app and I would like to use FormsAuthentication.HashPasswordForStoringInConfigFile. The question is, once it's hashed and stored, do I need to unhash it to pass to windows for authentication? Or can I set something in Web.Config that will do that? I haven't found any documentation that points me to what to do next.
0
9564
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10548
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10069
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9125
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
1
7604
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
6842
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5629
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4275
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
3798
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.