In actual applications, we usually store encrypted passwords in the database. Assume that our database has been illegally downloaded. If we used a non-symmetric encryption algorithm (MD5, RSA ...), Therefore, attackers have to pay a certain price to crack the password, because the shortest and the most stupid way to decrypt the ciphertext of the (break) asymmetric encryption algorithm is to crack the brute-force )! If we use a symmetric encryption algorithm to encrypt the password, once an attacker obtains the encryption key, he can decrypt all the passwords stored in the database. Therefore, the best way is to store the one-way hash of the password (combine the hash of this password with a salt value ): Public static string generatesalt (INT size)
{
Rngcryptoserviceprovider crypto = new rngcryptoserviceprovider ();
Byte [] buff = new byte [size];
Crypto. getbytes (buff );
Return convert. tobase64string (buff );
}
Public static string generatepwdhash (string PWD, string salt)
{
String saltpwd = string. Concat (PWD, salt );
String Password = formsauthentication. hashpasswordforstoringinconfigfile (saltpwd, "sha1 ");
Return password;
}
My problem is that the random salt value generated every time the user password is verified is different, and then the password is encrypted differently from that in the database. Isn't it a failure for every verification?
