How to store salted hashed password in the database

Question

I'm trying to figure out a way to store a salted hashed password to my database. It's my first time doing so, so I'm kind of unsure of how the process should go about.

My ASP.NET C# Web Application first requires a user to register for an account. I have a data layer, business layer to call the method in the data layer, and a presentation layer to display the form controls. At the moment I'm using plain text to store the password in the database. Let's call that method createAccount() in the data layer. Username, password and other attributes are passed into the createAccount() method to invoke the SQL Query to create an Account record. Username and password is specified by the user in the registration page. I found a web site that provided me a method to generate my password with hash as follow:

        public static string GenerateHashWithSalt(string password, string salt)
    {
        // merge password and salt together
        string sHashWithSalt = password + salt;
        // convert this merged value to a byte array
        byte[] saltedHashBytes = Encoding.UTF8.GetBytes(sHashWithSalt);
        // use hash algorithm to compute the hash
        System.Security.Cryptography.HashAlgorithm algorithm = new System.Security.Cryptography.SHA256Managed();
        // convert merged bytes to a hash as byte array
        byte[] hash = algorithm.ComputeHash(saltedHashBytes);
        // return the has as a base 64 encoded string
        return Convert.ToBase64String(hash);
    }

Where should I put this, in the registration page, in the code-behind ( .cs ) page, or in the data layer? And then, how would you all suggest I placed this hashed password in my database along with my other attributes? Should I directly store it as hashed, or store it in plaintext first, then update it to the hashed value. Thanks!

Answer 1

I would recommend using an existing implementation, instead of rolling your own here.

The asp.net membership database is perfect for this, and uses salting and hashing out of the box .