MD5CryptoServiceProvider tied to machine?

1 Jun 2009 10:48 AM

BillAtWork

Hi,
I'm using a routine like the one below to hash user passwords during a login
process and compare them to the hashed version stored in our DB.

private void HashPassword()
{
System.Text.UTF8Encoding encoder = new System.Text.UTF8Encoding();
MD5CryptoServiceProvider md5hasher = new MD5CryptoServiceProvider();
_encryptedPassword = md5hasher.ComputeHash(encoder.GetBytes(_saltValue +
_password));
}

Is this hash tied to the machine on which it is performed? i.e. if I move
the application to a new environment, will the hash matches stop working? My
concern is if we have a server crash and have to rebuild.

Could I "extract" the current keys used to do this hash and store them in
case we ever have to move environments? Is that possible or should I be using
my own explicit key for this?

Thanks!

1 Jun 2009 2:29 PM

Joe Kaplan

MD5 is just a hash algorithm. The same input produces the same output
wherever you use it. There are no "keys" associated with it. You should
have no problems with portability, even to other platforms.

You might want to consider using something a bit stronger like SHA1 at least
though. It is also better to generate a new random salt for each hash.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net

Show quoteHide quote

"BillAtWork" <BillAtWork@nospam.nospam> wrote in message
news:985F70F5-F029-47A4-8B0F-3D2745720C75@microsoft.com...
> Hi,
> I'm using a routine like the one below to hash user passwords during a
> login
> process and compare them to the hashed version stored in our DB.
>
> private void HashPassword()
> {
> System.Text.UTF8Encoding encoder = new System.Text.UTF8Encoding();
> MD5CryptoServiceProvider md5hasher = new MD5CryptoServiceProvider();
> _encryptedPassword = md5hasher.ComputeHash(encoder.GetBytes(_saltValue +
> _password));
> }
>
> Is this hash tied to the machine on which it is performed? i.e. if I move
> the application to a new environment, will the hash matches stop working?
> My
> concern is if we have a server crash and have to rebuild.
>
> Could I "extract" the current keys used to do this hash and store them in
> case we ever have to move environments? Is that possible or should I be
> using
> my own explicit key for this?
>
> Thanks!