如何在C＃windows窗体应用程序中轻松加密密码？

Question

How can I easily salt a password from a Textbox.Text?

Are there some built in wizardry in the .NET framework?

Answer 1

We had a great discussion a while ago about best practices when salting a password, you might find some great ideas there:

Salting Your Password: Best Practices?

I've found that one of the easiest, while still being fairly secure, is to use a GUID as your salt. It's random and sufficiently long. It works best if you include the string formatting of the GUID (the '{' and '-' characters), but you don't have to.

Remember that the salt has to be unique per item salted and that to be most secure, you should use a cryptographically secure random number generator. Remember also that you have to store your salt along with the password, or you won't be able to check the plaintext version against the hashed version! You can store the salt un-encrypted if you like; I typically put it in a field on the same table as the password. The purpose of the salt isn't to remain hidden, it's to make rainbow tables difficult (hopefully impossible) to compute in a timely manner.

Here's a quick snippet that will work in C#:

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buffer = new byte[1024];

rng.GetBytes(buffer);
string salt = BitConverter.ToString(buffer);
var saltedPassword = password + salt;

or...

var salt = Guid.NewGuid().ToString();
var saltedPassword = password + salt;

Answer 2

I suppose you are asking for a username along with the password?

In some systems username is used as a salt. (And I think it is OK to do that.) Otherwise you'll need to have your salt stored somewhere and retrieve it before hashing (in case of random-created salt) or have an algorithm which will return the same salt for the same user (and it is not better that just using a plain username).

Personally use the following code:

byte[] GetSaltedPasswordHash(string username, string password)
{
    byte[] pwdBytes = Encoding.UTF8.GetBytes(password);
    // byte[] salt = BitConverter.GetBytes(userId);
    byte[] salt = Encoding.UTF8.GetBytes(username);
    byte[] saltedPassword = new byte[pwdBytes.Length + salt.Length];

    Buffer.BlockCopy(pwdBytes, 0, saltedPassword, 0, pwdBytes.Length);
    Buffer.BlockCopy(salt, 0, saltedPassword, pwdBytes.Length, salt.Length);

    SHA1 sha = SHA1.Create();

    return sha.ComputeHash(saltedPassword);
}

Answer 3

这是一篇很好的文章和另一篇 （更适合ASP.NET应用程序）。

Answer 4

没有魔法，盐只是一些随机文字附加到密码来打败字典攻击 - 弥补你自己的乱码。

Answer 5

Have a look at the hmac functions like hmacdm5 , hmacsha1 or hmacsha256 .
Look at the System.Security.Cryptography namespace, too.