As a follow-up to the original Zetetic.Security library that adds PBKDF2 and BCrypt-based HashAlgorithms to .NET, we're pleased to announce the release of Zetetic.Security 1.1.0.0, which provides options for greater work factors when generating password hashes.
The original hash implementations use 5,000 rounds of PBKDF2, and a BCrypt work factor of 10^10. The 1.1 release adds support for 64,000, 128,000, and 256,000 rounds of PBKDF2, and BCrypt work factors from 10^11 to 10^16. As before, the best way to use these hash algorithms is by installing Zetetic.Security to the Global Assembly Cache, and updating machine.config to register the new classes. (Hint: you can find the path to the effective machine.config file in System.Runtime.InteropServices.RuntimeEnvironment.SystemConfigurationFile).
Once installed and registered, the new HashAlgorithms can be used in code as per the following sample (I wrote this one in LinqPad for simplicity's sake):
Of course, bear in mind two important caveats before updating your applications to use any new password hashing strategies:
1. .NET MembershipProviders don't have any way to know what HashAlgorithm generated any particular user's hashed password in storage. Therefore, changing the hash algorithm will cause your users' logins to fail until they reset their passwords.
2. A stronger hashing algorithm is likely to eat up significantly more CPU cycles. Plan accordingly so that applying 10^16 rounds of BCrypt doesn't open the door to a denial-of-service attack (or blow your AWS or Azure budget!).
blog comments powered by Disqus