Client-server authentication, Asp.Net identity hashed passwords: Compare with second hashed password
I am facing a dilema.
I am using Asp.Net identity on a client-server app to store user accounts, roles and passwords. Just to avoid boilerplate and don't reinvent the wheel.That works.
However, I want to validate a remote client. I don't want to transmit the password by the wire, so I want to encode/hash it too and retrieve an access token.
The hashing mechanism in Asp.Net uses a random salt, included in the "PasswordHash" field in AspNetUsers table, among with the encryption algorithm, salt, version and etc.
Are there any suggestions on how to securely validate the client password? Maybe to extract the salt on the server to send/reencode the password on the client or something alike?
Server: Saved hash
Client: Password to hash/encrypt and send to server
Need to: Validate password securely
asp.net identity
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
add a comment |
I am facing a dilema.
I am using Asp.Net identity on a client-server app to store user accounts, roles and passwords. Just to avoid boilerplate and don't reinvent the wheel.That works.
However, I want to validate a remote client. I don't want to transmit the password by the wire, so I want to encode/hash it too and retrieve an access token.
The hashing mechanism in Asp.Net uses a random salt, included in the "PasswordHash" field in AspNetUsers table, among with the encryption algorithm, salt, version and etc.
Are there any suggestions on how to securely validate the client password? Maybe to extract the salt on the server to send/reencode the password on the client or something alike?
Server: Saved hash
Client: Password to hash/encrypt and send to server
Need to: Validate password securely
asp.net identity
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
add a comment |
I am facing a dilema.
I am using Asp.Net identity on a client-server app to store user accounts, roles and passwords. Just to avoid boilerplate and don't reinvent the wheel.That works.
However, I want to validate a remote client. I don't want to transmit the password by the wire, so I want to encode/hash it too and retrieve an access token.
The hashing mechanism in Asp.Net uses a random salt, included in the "PasswordHash" field in AspNetUsers table, among with the encryption algorithm, salt, version and etc.
Are there any suggestions on how to securely validate the client password? Maybe to extract the salt on the server to send/reencode the password on the client or something alike?
Server: Saved hash
Client: Password to hash/encrypt and send to server
Need to: Validate password securely
asp.net identity
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
I am facing a dilema.
I am using Asp.Net identity on a client-server app to store user accounts, roles and passwords. Just to avoid boilerplate and don't reinvent the wheel.That works.
However, I want to validate a remote client. I don't want to transmit the password by the wire, so I want to encode/hash it too and retrieve an access token.
The hashing mechanism in Asp.Net uses a random salt, included in the "PasswordHash" field in AspNetUsers table, among with the encryption algorithm, salt, version and etc.
Are there any suggestions on how to securely validate the client password? Maybe to extract the salt on the server to send/reencode the password on the client or something alike?
Server: Saved hash
Client: Password to hash/encrypt and send to server
Need to: Validate password securely
asp.net identity
asp.net identity
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
asked Dec 26 '18 at 23:58
Jorge RojasJorge Rojas
440310
440310
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
During Authentication, Validation of passwords should be done on server-side. Validate Generated Hash with Stored Hash.
To validate a password, I would try to do following steps on server.
1) Send the password from Client to Server over Https/SSL
2) Retrieve the User's Salt and Hash from the database.
3) Generate a Hash from User's Password and Stored Salt.
4) Compare the hash from database with generated Hash.
Reference: https://crackstation.net/hashing-security.htm
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53938363%2fclient-server-authentication-asp-net-identity-hashed-passwords-compare-with-se%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
During Authentication, Validation of passwords should be done on server-side. Validate Generated Hash with Stored Hash.
To validate a password, I would try to do following steps on server.
1) Send the password from Client to Server over Https/SSL
2) Retrieve the User's Salt and Hash from the database.
3) Generate a Hash from User's Password and Stored Salt.
4) Compare the hash from database with generated Hash.
Reference: https://crackstation.net/hashing-security.htm
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
add a comment |
During Authentication, Validation of passwords should be done on server-side. Validate Generated Hash with Stored Hash.
To validate a password, I would try to do following steps on server.
1) Send the password from Client to Server over Https/SSL
2) Retrieve the User's Salt and Hash from the database.
3) Generate a Hash from User's Password and Stored Salt.
4) Compare the hash from database with generated Hash.
Reference: https://crackstation.net/hashing-security.htm
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
add a comment |
During Authentication, Validation of passwords should be done on server-side. Validate Generated Hash with Stored Hash.
To validate a password, I would try to do following steps on server.
1) Send the password from Client to Server over Https/SSL
2) Retrieve the User's Salt and Hash from the database.
3) Generate a Hash from User's Password and Stored Salt.
4) Compare the hash from database with generated Hash.
Reference: https://crackstation.net/hashing-security.htm
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
During Authentication, Validation of passwords should be done on server-side. Validate Generated Hash with Stored Hash.
To validate a password, I would try to do following steps on server.
1) Send the password from Client to Server over Https/SSL
2) Retrieve the User's Salt and Hash from the database.
3) Generate a Hash from User's Password and Stored Salt.
4) Compare the hash from database with generated Hash.
Reference: https://crackstation.net/hashing-security.htm
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
edited Jan 24 at 12:00
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
answered Dec 27 '18 at 6:44
Rasik JainRasik Jain
80158
80158
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
add a comment |
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
Thank you. Is almost what I am doing, but also I don't want to send the user clean password by the net.
– Jorge Rojas
Jan 2 at 4:16
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53938363%2fclient-server-authentication-asp-net-identity-hashed-passwords-compare-with-se%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
