Hashing method used in ASP.NET Identity

Question

I'm creating a Login Form in Xamarin.Forms Portable application. I have a WebFormsProject, wherein I created an API controller that compares the username and password key in by the User versus the username and password saved on my Database.

The password saved on my database is Hashed using ASP.NET Identity. While the password that will be typed by the User is hashed using Crypto.HashPassword (don't know if this class is an ASP.NET Identity thing).

I test it to input my username and password using this :

[Route("api/Login/Search/{username}/{password}")]

When I used breakpoint to try what will be the Hashed value for my key in Password I got this :

AL6kLGQYs3xeCtNkpJuAem43HOEvSpwzSfy5zCK0MviBGuS67Sp+ct0lNfJTd602Uw==

While the password in my database have this Hashed value :

AMlco7zkLpj5alL2MP1VEXQlRbcD2sdTdKB3JvTLzYMMwSUC5vSfhI4MloLLw70Erg==

I don't know why they have different Hashed value even if I've entered the SAME PASSWORD.

If the two password matched, it should return 'true' otherwise false. I'm on a confusing stage right now. Hope you can help me. And I want to know what hashing method does ASP.NET Identity use? Thanks.

Here are some of my codes.

using System;
using System.Collections.Generic;
using System.Data;
using System.Data.Entity;
using System.Data.Entity.Infrastructure;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
using System.Web.Http.Description;
using WebFormsDemo;
using WebFormsDemo.ViewModel;
using System.Security.Cryptography;
using System.Web.Helpers;
using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Microsoft.Owin.Security;
using Microsoft.AspNet.Identity.EntityFramework;


namespace WebFormsDemo.Controllers
{
    public class LoginController : ApiController
    {
        private EBMSEntities db = new EBMSEntities();


        [Route("api/Login/Search/{username}/{password}")]
        [ResponseType(typeof(List<AspNetUser>))]



        public bool getUserPassword(string username, string password)

        {

            var hashedPassword = "";
            hashedPassword = Crypto.HashPassword(password);


            var user = (from u in db.AspNetUsers
                        where u.UserName.Equals(username)
                        && u.PasswordHash.Equals(hashedPassword)
                        select u).ToList();


            if (user.Count() != 0)
            {
                return true;
            }

            return false;


        }

    }
}

Answer 1

Crypto.HashPassword uses RFC 2898 and takes care of creating a salt for you

The password hash is generated with the RFC 2898 algorithm using a 128-bit salt, a 256-bit subkey, and 1000 iterations. The format of the generated hash bytestream is {0x00, salt, subkey}, which is base-64 encoded before it is returned.

You have to use Crypto.VerifyHashedPassword to compare the passwords

public static bool VerifyHashedPassword(
     string hashedPassword,
     string password
)