diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo index 6f4f02f..672d819 100644 Binary files a/.vs/SecureCore/v16/.suo and b/.vs/SecureCore/v16/.suo differ diff --git a/SecureCore/Controllers/EmployeeController.cs b/SecureCore/Controllers/EmployeeController.cs index 52396be..6fb0af4 100644 --- a/SecureCore/Controllers/EmployeeController.cs +++ b/SecureCore/Controllers/EmployeeController.cs @@ -38,8 +38,10 @@ namespace SecureCore.Controllers [AcceptVerbs("POST")] public IActionResult Login(LoginInfo info) { - var hash = Auth.HashPassword(info.Password, out string salt); - return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash}{Environment.NewLine}Salt: {salt}{Environment.NewLine}"); + var hash = Auth.HashPassword(info.Password); + var h2 = Auth.HashPassword("Nonesense", "vRWp9TP1nQDLGtDZrd2yuw=="); + + return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash.Hash}{Environment.NewLine}Salt: {hash.Salt}{Environment.NewLine}{h2 == "+IGLf8scewY2LOObXqfF5IkIbhcEuPrMFc12d78jH6ZyBEMQI+Z9zixWgkQANeV3VYvURBEXIVI0/TPZrnML3w=="}"); } } @@ -51,41 +53,46 @@ namespace SecureCore.Controllers public static class Auth { + private static int Iterations { get; set; } = 100000; + private static KeyDerivationPrf KeyType { get; } = KeyDerivationPrf.HMACSHA512; + private static int KeySize { get; } = 512 / 8; + private static int SaltSize { get; } = 128 / 8; //128 bit salt + private static int SessionKeySize { get; } = 32; //32 bytes + public static string CreateSessionId() { - var sessionId = new byte[32]; + var sessionId = new byte[SessionKeySize]; GetRandomBytes(ref sessionId); - return ConvertToHex(sessionId); + return Convert.ToBase64String(sessionId); } - public static string HashPassword(string password, out string saltString) + public static (string Hash, string Salt) HashPassword(string password) { - //Generate a 128 bit salt - var salt = new byte[128 / 8]; + var salt = new byte[SaltSize]; GetRandomBytes(ref salt); - saltString = ConvertToHex(salt); - - return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyDerivationPrf.HMACSHA512, 50000, 512 / 8)); + return (GetPasswordHash(password, salt), Convert.ToBase64String(salt)); } - private static string ConvertToHex(byte[] bytes) + public static string HashPassword(string password, string hash) { - var stringBuilder = new StringBuilder(); + var salt = Convert.FromBase64String(hash); - foreach (var b in bytes) - stringBuilder.AppendFormat("{0:x2}", b); + return GetPasswordHash(password, salt); + } - return stringBuilder.ToString(); + private static string GetPasswordHash(string password, byte[] salt) + { + return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyType, Iterations, KeySize)); } private static void GetRandomBytes(ref byte[] bytes) { - using(var rng = RandomNumberGenerator.Create()) - rng.GetBytes(bytes); + using var rng = RandomNumberGenerator.Create(); + rng.GetBytes(bytes); } } } diff --git a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.deps.json b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.deps.json index c6fd5aa..a332910 100644 --- a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.deps.json +++ b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.deps.json @@ -24,6 +24,7 @@ ".NETCoreApp,Version=v3.1": { "SecureCore/1.0.0": { "dependencies": { + "Microsoft.AspNetCore.Cryptography.KeyDerivation": "5.0.1", "Microsoft.AspNetCore.Antiforgery": "3.1.0.0", "Microsoft.AspNetCore.Authentication.Abstractions": "3.1.0.0", "Microsoft.AspNetCore.Authentication.Cookies": "3.1.0.0", @@ -40,8 +41,6 @@ "Microsoft.AspNetCore.Connections.Abstractions": "3.1.0.0", "Microsoft.AspNetCore.CookiePolicy": "3.1.0.0", "Microsoft.AspNetCore.Cors": "3.1.0.0", - "Microsoft.AspNetCore.Cryptography.Internal": "3.1.0.0", - "Microsoft.AspNetCore.Cryptography.KeyDerivation": "3.1.0.0", "Microsoft.AspNetCore.DataProtection.Abstractions": "3.1.0.0", "Microsoft.AspNetCore.DataProtection": "3.1.0.0", "Microsoft.AspNetCore.DataProtection.Extensions": "3.1.0.0", @@ -314,6 +313,31 @@ "SecureCore.dll": {} } }, + "Microsoft.AspNetCore.Cryptography.Internal/5.0.1": { + "runtime": { + "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.Internal.dll": { + "assemblyVersion": "5.0.0.0", + "fileVersion": "5.0.120.60107" + } + }, + "compile": { + "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.Internal.dll": {} + } + }, + "Microsoft.AspNetCore.Cryptography.KeyDerivation/5.0.1": { + "dependencies": { + "Microsoft.AspNetCore.Cryptography.Internal": "5.0.1" + }, + "runtime": { + "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": { + "assemblyVersion": "5.0.0.0", + "fileVersion": "5.0.120.60107" + } + }, + "compile": { + "lib/netstandard2.0/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": {} + } + }, "Microsoft.AspNetCore.Antiforgery/3.1.0.0": { "compile": { "Microsoft.AspNetCore.Antiforgery.dll": {} @@ -410,18 +434,6 @@ }, "compileOnly": true }, - "Microsoft.AspNetCore.Cryptography.Internal/3.1.0.0": { - "compile": { - "Microsoft.AspNetCore.Cryptography.Internal.dll": {} - }, - "compileOnly": true - }, - "Microsoft.AspNetCore.Cryptography.KeyDerivation/3.1.0.0": { - "compile": { - "Microsoft.AspNetCore.Cryptography.KeyDerivation.dll": {} - }, - "compileOnly": true - }, "Microsoft.AspNetCore.DataProtection.Abstractions/3.1.0.0": { "compile": { "Microsoft.AspNetCore.DataProtection.Abstractions.dll": {} @@ -2014,6 +2026,20 @@ "serviceable": false, "sha512": "" }, + "Microsoft.AspNetCore.Cryptography.Internal/5.0.1": { + "type": "package", + "serviceable": true, + "sha512": "sha512-VGfj77RBkyWpPxvX6oSghE3DPObvg171HRdwr/t3aJQ9Y5cgaZE8BUNLhHZ0yBFa218r7e9Qou+DLGfRtve4CQ==", + "path": "microsoft.aspnetcore.cryptography.internal/5.0.1", + "hashPath": "microsoft.aspnetcore.cryptography.internal.5.0.1.nupkg.sha512" + }, + "Microsoft.AspNetCore.Cryptography.KeyDerivation/5.0.1": { + "type": "package", + "serviceable": true, + "sha512": "sha512-kYiQ5AZMKVIB+28+ImC6GihJTSh2Sr6iofiYtsOOnCbgCmNBljH4n+r8Qfocxv78xeeby5lwZorq05OvriDbOQ==", + "path": "microsoft.aspnetcore.cryptography.keyderivation/5.0.1", + "hashPath": "microsoft.aspnetcore.cryptography.keyderivation.5.0.1.nupkg.sha512" + }, "Microsoft.AspNetCore.Antiforgery/3.1.0.0": { "type": "referenceassembly", "serviceable": false, @@ -2094,16 +2120,6 @@ "serviceable": false, "sha512": "" }, - "Microsoft.AspNetCore.Cryptography.Internal/3.1.0.0": { - "type": "referenceassembly", - "serviceable": false, - "sha512": "" - }, - "Microsoft.AspNetCore.Cryptography.KeyDerivation/3.1.0.0": { - "type": "referenceassembly", - "serviceable": false, - "sha512": "" - }, "Microsoft.AspNetCore.DataProtection.Abstractions/3.1.0.0": { "type": "referenceassembly", "serviceable": false, diff --git a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.dll b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.dll index 0591f08..5dc9aeb 100644 Binary files a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.dll and b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.dll differ diff --git a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.pdb b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.pdb index 3258303..797e81d 100644 Binary files a/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.pdb and b/SecureCore/bin/Debug/netcoreapp3.1/SecureCore.pdb differ diff --git a/SecureCore/bin/Release/netcoreapp3.1/SecureCore.dll b/SecureCore/bin/Release/netcoreapp3.1/SecureCore.dll index cfd66a3..7dd4196 100644 Binary files a/SecureCore/bin/Release/netcoreapp3.1/SecureCore.dll and b/SecureCore/bin/Release/netcoreapp3.1/SecureCore.dll differ diff --git a/SecureCore/bin/Release/netcoreapp3.1/SecureCore.pdb b/SecureCore/bin/Release/netcoreapp3.1/SecureCore.pdb index 3666d8c..e5a8e86 100644 Binary files a/SecureCore/bin/Release/netcoreapp3.1/SecureCore.pdb and b/SecureCore/bin/Release/netcoreapp3.1/SecureCore.pdb differ diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache index 4468889..d708cbc 100644 --- a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache +++ b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.CoreCompileInputs.cache @@ -1 +1 @@ -25f50bd832f636a416eb773cc8db7fa1c945bb2c +7632b3c3dac860a5ca892b30d9c2c673c6b08242 diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.FileListAbsolute.txt b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.FileListAbsolute.txt index 0656850..f404686 100644 --- a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.FileListAbsolute.txt +++ b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csproj.FileListAbsolute.txt @@ -18,3 +18,6 @@ C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\Secure C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.dll C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.pdb C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.genruntimeconfig.cache +C:\Users\admin\source\repos\SecureCore\SecureCore\bin\Debug\netcoreapp3.1\Microsoft.AspNetCore.Cryptography.Internal.dll +C:\Users\admin\source\repos\SecureCore\SecureCore\bin\Debug\netcoreapp3.1\Microsoft.AspNetCore.Cryptography.KeyDerivation.dll +C:\Users\admin\source\repos\SecureCore\SecureCore\obj\Debug\netcoreapp3.1\SecureCore.csproj.CopyComplete diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache index fc42eeb..773aab8 100644 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache and b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache differ diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll index 0591f08..5dc9aeb 100644 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll and b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.dll differ diff --git a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb index 3258303..797e81d 100644 Binary files a/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb and b/SecureCore/obj/Debug/netcoreapp3.1/SecureCore.pdb differ diff --git a/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.dll b/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.dll index cfd66a3..7dd4196 100644 Binary files a/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.dll and b/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.dll differ diff --git a/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.pdb b/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.pdb index 3666d8c..e5a8e86 100644 Binary files a/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.pdb and b/SecureCore/obj/Release/netcoreapp3.1/PubTmp/Out/SecureCore.pdb differ diff --git a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache index 626c031..04d67e0 100644 Binary files a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache and b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.csprojAssemblyReference.cache differ diff --git a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.dll b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.dll index cfd66a3..7dd4196 100644 Binary files a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.dll and b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.dll differ diff --git a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.pdb b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.pdb index 3666d8c..e5a8e86 100644 Binary files a/SecureCore/obj/Release/netcoreapp3.1/SecureCore.pdb and b/SecureCore/obj/Release/netcoreapp3.1/SecureCore.pdb differ