从用户的密码和现时值中散列密码

Question

I'm working with some third party library (written in C#, it's documentation is a bit poor...) Thing is, for one of it's " Login " authentication functions I need to provide it with a hashed password .

I'm still a bit inexperienced on all this hashing thing, so maybe someone here can help me out?

Library documentation says: " generate the password hash, from the user's provided password and the Nonce value " This "nonce" value looks something like this: "Xi8SCdy7FarblZe61qP9ijginknhPe15" (32bit hash?)

But I have no clue about what kind of hashing algorithm should be used

Does anyone have any suggestions or examples how this could be done in C# or C++/CLI? Thanks.

Answer 1

A nonce is a number that is used only once, in this case, for authentication. Say, if an attacker got the hashed password during authentication, he would still not need the original password, he could just use the hash and it would have the same effect, server-side. With a nonce, the hash is made using a value that generally would not be replicated for a different hash. You can find more info here: http://tyleregeto.com/article/a-guide-to-nonce

Generally, the server sends a nonce to the client, the client combines that nonce with the password and runs that through a hashing algorithm. Then the client sends the result to the server, who runs the same algorithm with the same nonce onthe password it has stored and compares the results.

Answer 2

There are two questions I think: what to do with the nonce, and how to hash. The second one is the most important one, because I don't think anyone can answer it, apart from digging to the library.

The first part has several variations which are (at least I think) not all equally probably

1. concatenate password and hash, and hash te result
2. hash the password, hash the nonce, concatenate those
3. hash te password, concatenate with nonce

I don't think that sending the password unhashed is a valid option. The 3rd options feels strange as well, because why not ask for them as separate entities? So I'd say option one and option two are the most likely, with number 1 the most likely because of the wording:

generate the password hash from .....

I admit that this won't help you much if the hash algorith isn't known.