38 lines
749 B
Plaintext
38 lines
749 B
Plaintext
== How to fix it in .NET
|
|
|
|
=== Code examples
|
|
|
|
include::../../common/fix/code-rationale.adoc[]
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,csharp,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
using System.Security.Cryptography;
|
|
|
|
public static void hash(string password)
|
|
{
|
|
var salt = Encoding.UTF8.GetBytes("salty");
|
|
var hashed = new Rfc2898DeriveBytes(password, salt); // Noncompliant
|
|
}
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,csharp,diff-id=1,diff-type=compliant]
|
|
----
|
|
using System.Security.Cryptography;
|
|
|
|
public static void hash(string password)
|
|
{
|
|
var hashed = new Rfc2898DeriveBytes(password, 32, 10000, HashAlgorithmName.SHA256);
|
|
}
|
|
----
|
|
|
|
=== How does this work?
|
|
|
|
include::../../common/fix/salt.adoc[]
|
|
|
|
include::../../common/fix/auto-salt.adoc[]
|
|
|