Improving Web Application Security: Threats and - CGISecurity

388 Part III: Building Secure Web ApplicationsStore Password Hashes with SaltIf you need to implement a user store that contains user names and passwords, donot store the passwords either in clear text or in encrypted format. Instead of storingpasswords, store non-reversible hash values with added salt to mitigate the risk ofdictionary attacks.Note A salt value is a cryptographically strong random number.Creating a Salt ValueThe following code shows how to generate a salt value by using random numbergeneration functionality provided by the RNGCryptoServiceProvider class withinthe System.Security.Cryptography namespace.public static string CreateSalt(int size){RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();byte[] buff = new byte[size];rng.GetBytes(buff);return Convert.ToBase64String(buff);}Creating a Hash Value (with Salt)The following code fragment shows how to generate a hash value from a suppliedpassword and salt value.public static string CreatePasswordHash(string pwd, string salt){string saltAndPwd = string.Concat(pwd, salt);string hashedPwd =FormsAuthentication.HashPasswordForStoringInConfigFile(saltAndPwd, "SHA1");return hashedPwd;}More InformationFor more information about implementing a user store that stores password hasheswith salt, see “How To: Use Forms Authentication with SQL Server 2000” in the“How To” section of “Microsoft patterns & practices Volume I, Building SecureASP.NET Applications: Authentication, Authorization, and Secure Communication”at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.