Does ASP.NET use SHA256 or SHA1?

Question

I use the default authentication tools provided by ASP.NET 4.5 MVC and Entity Framework. I can create users with passwords, and the hashed password will appear in the database. I am trying to find out if this hash is generated using the SHA1 algorithm with a longer trust or the SHA2 algorithm (be it SHA256, SHA512, etc.).

Articles that are said to comply with SHA256 by default:

https://www.asp.net/whitepapers/aspnet4/breaking-changes#0.1__Toc256770148

http://kosmisch.net/Blog/DotNetEssential/Archive/2015/2/1/aspnet-membership-default-password-hash-algorithms-in-net-4x-and-previous-versions.html

Articles that are said to match SHA1 by default:

https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/consumer-apis/password-hashing

https://msdn.microsoft.com/en-us/library/system.security.cryptography.rfc2898derivebytes.aspx

When I follow the chain down, I fall into the PasswordHasher.cs → HashPassword () → Crypto.HashPassword () class, which I see using Rfc2898DeriveBytes, which then has a bunch of things about HMACSHA1.

Can my passwords receive hashed SHA256 or SHA1? Easy way to default SHA256?

If this helps, here is a dummy password taken from my local environment: AIPfkvy5v59jmVZdPpU9QfUMoToCQ + Rp3dBT7m9RwMKZai5 / 61REkN / 0InCtxKPUOQ ==

Answer 1

So, it looks like the answer does not match:

From comments in ASP.Net identity source code

Version 0: PBKDF2 with HMAC-SHA1, 128-bit salt, 256-bit subdivision, 1000 iterations.

See also: SDL v5.1 Cryptography Guide, Part III)

Format: {0x00, salt, subsection}

Ultimately, the hash algorithm is SHA1, but it is not a simple SHA1 hash of a password or even a SHA1 + hash.

It is worth noting that SHA1 is considered “broken” for digital signatures due to a mathematical attack, which reduces the computational effort to generate a collision to practically acceptable levels.

This does not apply to hashed passwords.

Links for further reading.

Is SHA-1 protected for password storage?

https://www.schneier.com/blog/archives/2005/02/sha1_broken.html

https://en.wikipedia.org/wiki/PBKDF2

https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

Rfc2898DeriveBytes and HMACSHA1