Following up to my earlier post about improving the security of the ASP.NET SqlMembershipProvider, and to Troy Hunt's excellently thorough article Our Password Hashing Has No Clothes and further discussions with @thorsheim, @blowdart, and @klingsen (all of whom I recommend following), I took a second look at how to use the algorithms in the Zetetic.Security package without mucking about with machine.config and the .NET Global Assembly Cache, which really complicate the deployment picture.
The bad news is that the .NET base class libraries only read "name-to-algorithm" mappings from machine.config. I was pretty surprised to see this, but it's plain as day in System.Security.Cryptography.CryptoConfig.OpenCryptoConfig().
The good news is that adding to the HashAlgorithms an application can use is super, super easy. Start by grabbing the Zetetic.Security package from NuGet; next, one line of code will do the trick (in Global.asax's Application_Start, for example):
Adjust the membership settings in Web.config as per usual:
<membership hashAlgorithmType="pbkdf2_local"><!-- other stuff --><membership>
Voila, your ASP.NET application is now using a much, much stronger password hash algorithm than the (really rather embarrassing) defaults of SHA1 and SHA256.
Starting now until July 6th, STRIP Password Manager for Windows is on sale, just enter the discount code STRIPHAPPY4TH at check-out for 25% off. If you've been using STRIP on your iPhone and you want reliable backups, and a desktop editor, STRIP for Windows is for you.
This Thursday night, June 21st at 9pm EDT, Tempo and other web systems will be temporarily unavailable while we perform critical patch updates to ensure the stability of our services.
This maintenance outage will affect the Tempo API, the purchase site for Strip for Windows, the Connect website, and the site for Codebook.
Down time could last up to 1 hour (though we hope it will be completed more quickly). If you need to get in touch with us for any reason, please don’t hesitate.
As mobile development continues to grow at a rapid pace, the increased need for developers to take advantage of their existing expertise in programming languages grows with it. To this point, we've ported SQLCipher to run on both MonoTouch and Mono for Android. You can now develop .NET applications, secured by SQLCipher running on both iOS and Android platforms. We have prepared licensed binaries for sale here and have tutorials on integrating SQLCipher for MonoTouch as well as SQLCipher on Mono for Android. If you've been looking for a good way to secure your data on major mobile platforms running .NET with SQLCipher we now have the solution. Take a look!
We released version 2.0.5 of SQLCipher Core and SQLCipher for
Android. This release builds on the
many new changes we introduced in SQLCipher 2.0. Source for SQLCipher Core can be found here. SQLCipher for Android
is available as a binary package here and in source format here. Here
are some of the changes/additions highlighted in this release:
- Based on SQLite 126.96.36.199
PRAGMA cipher_version to identify the SQLCipher version
- Improved reporting of HMAC validation failure
- Enable secure delete (wipes deleted page contents)
- Detect and report errors if cipher context becomes corrupted
SQLCipher for Android:
- Everything listed above in SQLCipher Core
SQLiteDatabaseHook interface providing
postKey hooks into
- Adjustment to how RO/RW databases are handled in
- Restructure package from
- Removed the build step for OpenSSL, we dynamically link to it
SQLiteDatabase.upgradeDatabaseFormatFromVersion1To2 to automate
migrations from the 1.x to 2.0 database format
- Add overload to
SQLiteDatabase.loadLibs to specify an alternative directory for
unzipping the ICU dat file
Please take a look, we welcome feedback. Thanks!