Cleaned up the hashing code.

SecureCore/Controllers/EmployeeController.cs

@@ -38,8 +38,10 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Login(LoginInfo info)
         {
-            var hash = Auth.HashPassword(info.Password, out string salt);
-            return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash}{Environment.NewLine}Salt: {salt}{Environment.NewLine}");
+            var hash = Auth.HashPassword(info.Password);
+            var h2 = Auth.HashPassword("Nonesense", "vRWp9TP1nQDLGtDZrd2yuw==");
+
+            return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash.Hash}{Environment.NewLine}Salt: {hash.Salt}{Environment.NewLine}{h2 == "+IGLf8scewY2LOObXqfF5IkIbhcEuPrMFc12d78jH6ZyBEMQI+Z9zixWgkQANeV3VYvURBEXIVI0/TPZrnML3w=="}");
         }
     }
 
@@ -51,41 +53,46 @@ namespace SecureCore.Controllers
 
     public static class Auth
     {
+        private static int Iterations { get; set; } = 100000;
+        private static KeyDerivationPrf KeyType { get; } = KeyDerivationPrf.HMACSHA512;
+        private static int KeySize { get; } = 512 / 8;
+        private static int SaltSize { get; } = 128 / 8; //128 bit salt
+        private static int SessionKeySize { get; } = 32; //32 bytes
+
         public static string CreateSessionId()
         {
-            var sessionId = new byte[32];
+            var sessionId = new byte[SessionKeySize];
 
             GetRandomBytes(ref sessionId);
 
-            return ConvertToHex(sessionId);
+            return Convert.ToBase64String(sessionId);
         }
 
-        public static string HashPassword(string password, out string saltString)
+        public static (string Hash, string Salt) HashPassword(string password)
         {
-            //Generate a 128 bit salt
-            var salt = new byte[128 / 8];
+            var salt = new byte[SaltSize];
 
             GetRandomBytes(ref salt);
 
-            saltString = ConvertToHex(salt);
-
-            return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyDerivationPrf.HMACSHA512, 50000, 512 / 8));
+            return (GetPasswordHash(password, salt), Convert.ToBase64String(salt));
         }
 
-        private static string ConvertToHex(byte[] bytes)
+        public static string HashPassword(string password, string hash)
         {
-            var stringBuilder = new StringBuilder();
+            var salt = Convert.FromBase64String(hash);
 
-            foreach (var b in bytes)
-                stringBuilder.AppendFormat("{0:x2}", b);
+            return GetPasswordHash(password, salt);
+        }
 
-            return stringBuilder.ToString();
+        private static string GetPasswordHash(string password, byte[] salt)
+        {
+            return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyType, Iterations, KeySize));
         }
 
         private static void GetRandomBytes(ref byte[] bytes)
         {
-            using(var rng = RandomNumberGenerator.Create())
-                rng.GetBytes(bytes);
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
         }
     }
 }

SecureCore/bin/Debug/netcoreapp3.1/SecureCore.deps.json

@@ -24,6 +24,7 @@
     ".NETCoreApp,Version=v3.1": {
       "SecureCore/1.0.0": {
         "dependencies": {
+          "Microsoft.AspNetCore.Cryptography.KeyDerivation": "5.0.1",
           "Microsoft.AspNetCore.Antiforgery": "3.1.0.0",
           "Microsoft.AspNetCore.Authentication.Abstractions": "3.1.0.0",
           "Microsoft.AspNetCore.Authentication.Cookies": "3.1.0.0",
@@ -40,8 +41,6 @@
           "Microsoft.AspNetCore.Connections.Abstractions": "3.1.0.0",
           "Microsoft.AspNetCore.CookiePolicy": "3.1.0.0",
           "Microsoft.AspNetCore.Cors": "3.1.0.0",
-          "Microsoft.AspNetCore.Cryptography.Internal": "3.1.0.0",
-          "Microsoft.AspNetCore.Cryptography.KeyDerivation": "3.1.0.0",
           "Microsoft.AspNetCore.DataProtection.Abstractions": "3.1.0.0",
           "Microsoft.AspNetCore.DataProtection": "3.1.0.0",
           "Microsoft.AspNetCore.DataProtection.Extensions": "3.1.0.0",
@@ -314,6 +313,31 @@
           "SecureCore.dll": {}
         }
       },
+      "Microsoft.AspNetCore.Cryptography.Internal/5.0.1": {
+        "runtime": {
+          "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.Internal.dll": {
+            "assemblyVersion": "5.0.0.0",
+            "fileVersion": "5.0.120.60107"
+          }
+        },
+        "compile": {
+          "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.Internal.dll": {}
+        }
+      },
+      "Microsoft.AspNetCore.Cryptography.KeyDerivation/5.0.1": {
+        "dependencies": {
+          "Microsoft.AspNetCore.Cryptography.Internal": "5.0.1"
+        },
+        "runtime": {
+          "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": {
+            "assemblyVersion": "5.0.0.0",
+            "fileVersion": "5.0.120.60107"
+          }
+        },
+        "compile": {
+          "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": {}
+        }
+      },
       "Microsoft.AspNetCore.Antiforgery/3.1.0.0": {
         "compile": {
           "Microsoft.AspNetCore.Antiforgery.dll": {}
@@ -410,18 +434,6 @@
         },
         "compileOnly": true
       },
-      "Microsoft.AspNetCore.Cryptography.Internal/3.1.0.0": {
-        "compile": {
-          "Microsoft.AspNetCore.Cryptography.Internal.dll": {}
-        },
-        "compileOnly": true
-      },
-      "Microsoft.AspNetCore.Cryptography.KeyDerivation/3.1.0.0": {
-        "compile": {
-          "Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": {}
-        },
-        "compileOnly": true
-      },
       "Microsoft.AspNetCore.DataProtection.Abstractions/3.1.0.0": {
         "compile": {
           "Microsoft.AspNetCore.DataProtection.Abstractions.dll": {}
@@ -2014,6 +2026,20 @@
       "serviceable": false,
       "sha512": ""
     },
+    "Microsoft.AspNetCore.Cryptography.Internal/5.0.1": {
+      "type": "package",
+      "serviceable": true,
+      "sha512": "sha512-VGfj77RBkyWpPxvX6oSghE3DPObvg171HRdwr/t3aJQ9Y5cgaZE8BUNLhHZ0yBFa218r7e9Qou+DLGfRtve4CQ==",
+      "path": "microsoft.aspnetcore.cryptography.internal/5.0.1",
+      "hashPath": "microsoft.aspnetcore.cryptography.internal.5.0.1.nupkg.sha512"
+    },
+    "Microsoft.AspNetCore.Cryptography.KeyDerivation/5.0.1": {
+      "type": "package",
+      "serviceable": true,
+      "sha512": "sha512-kYiQ5AZMKVIB+28+ImC6GihJTSh2Sr6iofiYtsOOnCbgCmNBljH4n+r8Qfocxv78xeeby5lwZorq05OvriDbOQ==",
+      "path": "microsoft.aspnetcore.cryptography.keyderivation/5.0.1",
+      "hashPath": "microsoft.aspnetcore.cryptography.keyderivation.5.0.1.nupkg.sha512"
+    },
     "Microsoft.AspNetCore.Antiforgery/3.1.0.0": {
       "type": "referenceassembly",
       "serviceable": false,
@@ -2094,16 +2120,6 @@
       "serviceable": false,
       "sha512": ""
     },
-    "Microsoft.AspNetCore.Cryptography.Internal/3.1.0.0": {
-      "type": "referenceassembly",
-      "serviceable": false,
-      "sha512": ""
-    },
-    "Microsoft.AspNetCore.Cryptography.KeyDerivation/3.1.0.0": {
-      "type": "referenceassembly",
-      "serviceable": false,
-      "sha512": ""
-    },
     "Microsoft.AspNetCore.DataProtection.Abstractions/3.1.0.0": {
       "type": "referenceassembly",
       "serviceable": false,

SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache

@@ -1 +1 @@
-25f50bd832f636a416eb773cc8db7fa1c945bb2c
+7632b3c3dac860a5ca892b30d9c2c673c6b08242

SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.FileListAbsolute.txt

@@ -18,3 +18,6 @@ C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\Secure
 C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.dll
 C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.pdb
 C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.genruntimeconfig.cache
+C:\Users\admin\source\repos\SecureCore\SecureCore\bin\Debug\netcoreapp3.1\Microsoft.AspNetCore.Cryptography.Internal.dll
+C:\Users\admin\source\repos\SecureCore\SecureCore\bin\Debug\netcoreapp3.1\Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
+C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.csproj.CopyComplete