Does ASP.NET Identity use PBKDF2?

Question

User399763608 posted

Hi,

What does ASP.NET Identity use for hashing/salting? I've noticed that when I create an user it has a hash in the database but where can I see what it uses and can I possibly change it to use PBKDF2 with HMAC-SHA1? 

Answer 1

User1564875471 posted

Not sure what is used by default, but you can write your custom password hasher by implementing IPassowrdHasher interface. Here are some related discussion about this :

http://stackoverflow.com/questions/19957176/asp-net-identity-password-hashing

http://stackoverflow.com/questions/20621950/asp-net-identity-default-password-hasher-how-does-it-work-and-is-it-secure

Answer 2

User1779161005 posted

I have a NuGet package called IdentityReboot that implements the password hasher and uses PBKDF2. It's easy, as all you need to do is configure the password hashing iteration count:

http://brockallen.com/2014/02/11/introducing-identityreboot/