验证C＃应用程序在php中加密的密码

Question

On my website there is a page where clients can store a password for use in applications they buy (usually one password for all apps for their convinience). Password is hashed with bcrypt using PHP code:

if ( $app_pass != '' ){
  $mysalt= mcrypt_create_iv(22, MCRYPT_DEV_URANDOM);
  $options = [ 'cost' => 10, 'salt' => $mysalt,];
  $app_pass = password_hash( $app_pass, PASSWORD_BCRYPT, $options );
}

• where $app_pass in if statement is plain text
• later becomes bcrypted hash
• and that hash is then stored in MySQL database

When clients start bought application on his PC, enters login and password, application connects to MySQL database, retrieves hashFromDb and try to verify entered password with BCryptHelper class:

BCryptHelper.CheckPassword(passwordbox.Password, hashFromDb)

Yet it returns error code:

An unhandled exception of type 'System.ArgumentException' occurred in DevOne.Security.Cryptography.BCrypt.dll

Additional information: Invalid salt revision

Is it the right approach to verify user entered password in WPF application against PHP encrypted password hash?

Answer 1

From the BCrypt source code , the System.ArgumentException is thrown by this logic:

  if (salt[1] != '$') {
        minor = salt[2];
        if (minor != 'a' || salt[3] != '$') {
            throw new ArgumentException("Invalid salt revision");
        }

It appears, therefore, that the exception is thrown because the hash is not of a format that BCrypt supports.

From the PHP docs , password_hash with the PASSWORD_BCRYPT argument returns a hash that starts with $2y$ , while the BCrypt implementation used by C# expects one that starts with $2a$ .

I would recommend using a different method to generate the hash.

EDIT: this Github thread has some good info on why this is happening

Answer 2

extends method

static class ExtentionMetsodString
{
    public static string ReplaceAt(this string str,int startIdx , string replaceStr)
    {
        StringBuilder strBuilder = new StringBuilder(str);
        int length = replaceStr.Length;

        strBuilder.Remove(startIdx, length);
        strBuilder.Insert(startIdx, replaceStr);
        return strBuilder.ToString();
    }
}

usage

string test = "0123456";
string output = test.ReplaceAt(2, "ab"); // ouput : 01ab456

cool