Storing a SHA512 Password Hash in Database

asp.net sql-server hash cryptography sha512
Chris picture Chris · Dec 1, 2009 · Viewed 13.3k times · Source

In my ASP.NET web app I'm hashing my user passwords with SHA512.

Despite much SO'ing and Googling I'm unclear how I should be storing them in the database (SQL2005) - the code below shows the basics of how I'm creating the hash as a string and I'm currently inserting it into the database into a Char(88) column as that seems to be the length created consistently

Is holding it as a String the best way to do it, if so will it always be 88 chars on a SHA512 (as I have seen some bizarre stuff on Google)? 

 Dim byteInput As Byte() = Encoding.UTF8.GetBytes(sSalt & sInput)
 Dim hash As HashAlgorithm = New SHA512Managed()
 Dim sInsertToDatabase As String =  Convert.ToBase64String(hash.ComputeHash(byteInput))

Answer

Vinko Vrsalovic picture Vinko Vrsalovic · Dec 1, 2009

SHA512 outputs 512 bits, or 64 bytes. You can store those 64 bytes in a binary column, if you so wished.

If you want to handle the hash outside your application is more comfortable to store a Base64 string, as you are doing now. Base64 adds roughly a 33% of constant overhead, so you can expect the string to be always 88 chars.

That said, ASP.NET has a fairly comprehensive authentication system builtin, which you should use.

Related questions

Call a stored procedure with parameter in c#

I can do a delete, insert and update in my program and I try to do an insert by call a created stored procedure from my database. This a button insert I make work well. private void btnAdd_Click(object …

Read More
How can I solve a connection pool problem between ASP.NET and SQL Server?

The last few days we see this error message in our website too much: "Timeout expired. The timeout period elapsed prior to obtaining a connection from the pool. This may have occurred because all pooled connections were in use and …

Read More
Cannot open database "test" requested by the login. The login failed. Login failed for user 'xyz\ASPNET'

I have created a web service which is saving some data into to db. But I am getting this error: Cannot open database "test" requested by the login. The login failed. Login failed for user 'xyz\ASPNET'. My connection string …

Read More