Cleaned up the hashing code.

SecureCore/Controllers/EmployeeController.cs

@@ -38,8 +38,10 @@ namespace SecureCore.Controllers
         [AcceptVerbs("POST")]
         public IActionResult Login(LoginInfo info)
         {
-            var hash = Auth.HashPassword(info.Password, out string salt);
-            return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash}{Environment.NewLine}Salt: {salt}{Environment.NewLine}");
+            var hash = Auth.HashPassword(info.Password);
+            var h2 = Auth.HashPassword("Nonesense", "vRWp9TP1nQDLGtDZrd2yuw==");
+
+            return Ok($"Session Key: {Auth.CreateSessionId()}{Environment.NewLine}Password Hash: {hash.Hash}{Environment.NewLine}Salt: {hash.Salt}{Environment.NewLine}{h2 == "+IGLf8scewY2LOObXqfF5IkIbhcEuPrMFc12d78jH6ZyBEMQI+Z9zixWgkQANeV3VYvURBEXIVI0/TPZrnML3w=="}");
         }
     }
 
@@ -51,41 +53,46 @@ namespace SecureCore.Controllers
 
     public static class Auth
     {
+        private static int Iterations { get; set; } = 100000;
+        private static KeyDerivationPrf KeyType { get; } = KeyDerivationPrf.HMACSHA512;
+        private static int KeySize { get; } = 512 / 8;
+        private static int SaltSize { get; } = 128 / 8; //128 bit salt
+        private static int SessionKeySize { get; } = 32; //32 bytes
+
         public static string CreateSessionId()
         {
-            var sessionId = new byte[32];
+            var sessionId = new byte[SessionKeySize];
 
             GetRandomBytes(ref sessionId);
 
-            return ConvertToHex(sessionId);
+            return Convert.ToBase64String(sessionId);
         }
 
-        public static string HashPassword(string password, out string saltString)
+        public static (string Hash, string Salt) HashPassword(string password)
         {
-            //Generate a 128 bit salt
-            var salt = new byte[128 / 8];
+            var salt = new byte[SaltSize];
 
             GetRandomBytes(ref salt);
 
-            saltString = ConvertToHex(salt);
-
-            return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyDerivationPrf.HMACSHA512, 50000, 512 / 8));
+            return (GetPasswordHash(password, salt), Convert.ToBase64String(salt));
         }
 
-        private static string ConvertToHex(byte[] bytes)
+        public static string HashPassword(string password, string hash)
         {
-            var stringBuilder = new StringBuilder();
+            var salt = Convert.FromBase64String(hash);
 
-            foreach (var b in bytes)
-                stringBuilder.AppendFormat("{0:x2}", b);
+            return GetPasswordHash(password, salt);
+        }
 
-            return stringBuilder.ToString();
+        private static string GetPasswordHash(string password, byte[] salt)
+        {
+            return Convert.ToBase64String(KeyDerivation.Pbkdf2(password, salt, KeyType, Iterations, KeySize));
         }
 
         private static void GetRandomBytes(ref byte[] bytes)
         {
-            using(var rng = RandomNumberGenerator.Create())
-                rng.GetBytes(bytes);
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
         }
     }
 }