ASP.NET Password Hash Functions

Question

0.00/5 (No votes)

See more:

I use a 3rd party application for the bulk of our operation. This application allows me to create customer username/passwords for online access via a prebuilt website built by this 3rd party vendor. I want to build a new site for the customers to use because the site that was included with our application is terrible. However, I do not know how to hash the password to match the hash used in this application. I have been doing a lot of digging and I am pretty sure the vendor uses user defined functions to hash the passwords. However, there are multiple different functions that I believe are used in tandem with each other (Not positive, but they are all in the user defined functions in the database). Is there anyone familiar with the functions copyrighted by Gleb Ufimtsev, and called ugAddMod32, ugBitsSet, ugInverse, ugLeftShift, ugRightShift, ugRotateLeft, ugSha1part_ft, ugsha1part_kt, ugSha1part_WordofStr, ugSha1str.

I want to be able to hash the password from these functions and compare the asp hash to the hash stored in the database.

I tried to shorten this as much as possible. I am using vs2005, .aspx, with .vb file.

I can include the funtions if needed.

I tried using vs2005 built in functions to hash using sha1 and md5 but neither hash to the same output as what is in my database.

I have also tried many sites to match passwords and hash with well know hash functions, over 100 ways, and none match. This leads me to believe that this is a custom hash algorithm like the functions i have mentioned.

Thank You

Posted 25-Nov-09 4:59am

Matt Mcgill

Updated 25-Nov-09 5:04am

v2

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Matthew Dennis · Answer 1 · 2009-12-13T17:23:00

The ASP.NET Membership class will create and verify hashed passwords. Using salts is required to increase the security of the site as the same password (a lot of people will use 'password') will not have the same hash if it has a different salt value.
Hashes are created using a secure key using cryptographic algorithms such as SHA1 and md5. Each web-server ( or web farm ) will have a (hopefully) unique key, so unless you can get the old site's key and know which algorithm they use, you will not be able to create or verify the passwords stored on the old site.

If you must use compatible passwords, I suggest you create a better front-end and then pass the required information to the old site.

Christian Graus · Answer 2 · 2009-11-25T05:31:00

If I ever use a hash, I also salt the string, by adding a known string at the end before I hash it. This decreases the odds of someone working out what I am doing. Is the third party dll .NET ? If it is, use reflection to work out what it does. I bet it uses a built in algorithm and salts the hash.

ASP.NET Password Hash Functions

2 solutions

Solution 2

Solution 1

Add your solution here

Preview 0