我在我的网站上使用SHA1来记录密码.我正在尝试迁移到ASP.NET身份.我发现如何验证旧密码(ASP.NET Identity默认密码Hasher,它是如何工作的并且是否安全?):
public class CustomPasswordHasher : IPasswordHasher { //.... public static bool VerifyHashedPassword(string hashedPassword, string password) { byte[] buffer4; if (hashedPassword == null) { return false; } if (password == null) { throw new ArgumentNullException("password"); } // Old hash verification using (SHA1Managed sha1 = new SHA1Managed()) { var hash = sha1.ComputeHash(Encoding.UTF8.GetBytes(password)); var sb = new StringBuilder(hash.Length * 2); foreach (byte b in hash) { sb.Append(b.ToString("x2")); } if(hashedPassword == sb.ToString()) return true; else return false; } // Identity hash verification byte[] src = Convert.FromBase64String(hashedPassword); if ((src.Length != 0x31) || (src[0] != 0)) { return false; } byte[] dst = new byte[0x10]; Buffer.BlockCopy(src, 1, dst, 0, 0x10); byte[] buffer3 = new byte[0x20]; Buffer.BlockCopy(src, 0x11, buffer3, 0, 0x20); using (Rfc2898DeriveBytes bytes = new Rfc2898DeriveBytes(password, dst, 0x3e8)) { buffer4 = bytes.GetBytes(0x20); } return ByteArraysEqual(buffer3, buffer4); } //.... }
在我的自定义ApplicationUserManager中,我设置了PasswordHasher属性:
//.... manager.PasswordHasher = new CustomPasswordHasher(); //....
现在,我想删除旧的哈希(sha1)并保存新的哈希.我怎么能这样做?
提前致谢!