search

brockallen / BrockAllen.MembershipReboot

MembershipReboot is a user identity management and authentication library.
Other
742 stars 238 forks source link

Any way to use BCrypt instead of the default hashing method? #629

Closed ZBlocker655 closed 7 years ago

ZBlocker655 commented 8 years ago

Evaluating this framework for use in a new service my team is working on. Is there any way to swap out the password hash method and use BCrypt instead? It seems to be a slightly stronger method than PBKDF2.

If not, would you recommend I instead look at IdentityReboot over ASP.NET Identity if I need BCrypt?

brockallen commented 8 years ago

There's an ICrypto interface you can plug in.

brockallen commented 8 years ago

BTW, do you have a bcrypt implementation in .NET? If so I'd be interested.

ZBlocker655 commented 8 years ago

You mean an implementation of your ICrypto interface that uses BCrypt? Not yet, since I just found out about it. Are you saying that if I end up writing one you'd be interested in adding it to this framework?

brockallen commented 8 years ago

I was just asking which bcrypt library you were using. But yea, if you do an ICrytpo using it, let me know. I'm interested in both :)

ZBlocker655 commented 8 years ago

I might end up using BCrypt.Net. Not sure yet. Still in evaluation phase.

brockallen commented 8 years ago

Any update on finding a good .NET based bcrypt?

ZBlocker655 commented 8 years ago

Still discussing with my team whether we need to put in BCrypt hashing or not. So far we're using the default for MembershipReboot. If we do go BCrypt, we'll probably use BCrypt.Net.

brockallen commented 7 years ago

Given that I don't foresee making this change, I'll close this issue. Thanks.