.net - Secure Password Hashing

Question

I need to store a hash of a single password in a .Net WinForms application.

What's the most secure way to do this?

In particular:

• Salt, HMAC, or both?
• How much salt?
• How many iterations?
• What encoding? (The password is plain ASCII)

I assume that the algorithm should be either SHA512 or HMACSHA512.

Answer 1

Salt your hash with secure random salt of at least 128bits or longer, to avoid a rainbow attack and use BCrypt, PBKDF2 or scrypt. PBKDF2 comes with NIST approval.

To quote: Archive.org: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html

The problem is that MD5 is fast. So are its modern competitors, like SHA1 and SHA256. Speed is a design goal of a modern secure hash, because hashes are a building block of almost every cryptosystem, and usually get demand-executed on a per-packet or per-message basis.

Speed is exactly what you don’t want in a password hash function.

Fast password validation functions are a problem, cause they can be attacked using brute force. With all the algorithms above you can control the "slowness"