时间戳

首页 > 解决方案 > Difference in hashing algorithms of .Net Identity and .Net Core Identity

.net - Difference in hashing algorithms of .Net Identity and .Net Core Identity

问题描述

I have two projects with .Net Framework and .Net Core, both use same database.

The database has user details for login and role management and that's done in .Net Identity and .Net Core Identity respectively.

When logging in, both application's UserManagers are fetching user with the entered email, but I get incorrect password on one application.

So I want to know whether is there any difference in choice of password hashing algorithm in .Net Identity and .Net Core Identity.

标签： .netasp.net-coreasp.net-identityidentityasp.net-core-identity

解决方案

检查this blog post，看起来默认算法确实不同

Identity 框架中的默认实现是 PasswordHasher 类（源代码）。这个类[原文如此] 旨在使用两种不同的散列格式：

  • ASP.NET Identity 版本 2：带有HMAC-SHA1 的PBKDF2，128位盐，256 位子密钥，1000 次迭代
  • ASP.NET Core Identity 版本 3：带有HMAC-SHA256 的 PBKDF2，128位 salt，256 位子密钥，10000 次迭代

强调我的

虽然它们都使用 PBKDF2 有一些细微的差别

推荐阅读