Hash and salt passwords in C# -

i going through 1 of davidhayden's articles on hashing user passwords.

really can't trying achieve.

here code:

private static string createsalt(int size) {     //generate cryptographic random number.     rngcryptoserviceprovider rng = new rngcryptoserviceprovider();     byte[] buff = new byte[size];     rng.getbytes(buff);      // return base64 string representation of random number.     return convert.tobase64string(buff); }  private static string createpasswordhash(string pwd, string salt) {     string saltandpwd = string.concat(pwd, salt);     string hashedpwd =         formsauthentication.hashpasswordforstoringinconfigfile(         saltandpwd, "sha1");     return hashedpwd; } 

is there other c# method hashing passwords , adding salt it?

actually kind of strange, string conversions - membership provider put them config files. hashes , salts binary blobs, don't need convert them strings unless want put them text files.

in book, beginning asp.net security, (oh finally, excuse pimp book) following

static byte[] generatesaltedhash(byte[] plaintext, byte[] salt) {   hashalgorithm algorithm = new sha256managed();    byte[] plaintextwithsaltbytes =      new byte[plaintext.length + salt.length];    (int = 0; < plaintext.length; i++)   {     plaintextwithsaltbytes[i] = plaintext[i];   }   (int = 0; < salt.length; i++)   {     plaintextwithsaltbytes[plaintext.length + i] = salt[i];   }    return algorithm.computehash(plaintextwithsaltbytes);             } 

the salt generation example in question. can convert text byte arrays using encoding.utf8.getbytes(string). if must convert hash string representation can use convert.tobase64string , convert.frombase64string convert back.

you should note cannot use equality operator on byte arrays, checks references , should loop through both arrays checking each byte thus

public static bool comparebytearrays(byte[] array1, byte[] array2) {   if (array1.length != array2.length)   {     return false;   }    (int = 0; < array1.length; i++)   {     if (array1[i] != array2[i])     {       return false;     }   }    return true; } 

always use new salt per password. salts not have kept secret , can stored alongside hash itself.