I ❤️ .NET

Table of Contents

1. What we gonna do?
2. Why we gonna do?
3. How we gonna do?
4. Summary

What we gonna do?

Storing passwords in plain text is like leaving your house keys under the doormat with a neon sign pointing to them. In this article, let's explore hashing techniques in .NET - the one-way transformation that keeps sensitive data secure while still being usable for authentication and data integrity checks.

We'll cover secure password hashing with ASP.NET Core Identity, general data hashing with SHA256, salt and pepper strategies, and how to implement digital signatures for non-repudiation using Azure Key Vault.

Why we gonna do?

Hashing is fundamentally different from encryption - it's a one-way transformation where you never intend to get the original data back. This makes it perfect for scenarios like password storage, data integrity checks, and creating audit trails that protect sensitive information.

Here's why hashing matters for .NET developers:

Password Security Without Recovery

Unlike encryption, hashed passwords can't be "decrypted" back to their original form. When a user logs in, you hash their input and compare it to the stored hash - never storing or handling the actual password.

Data Integrity and Checksums

Hashing allows you to detect if data has been tampered with. The same input always produces the same hash, so any change in the original data results in a completely different hash value.

Compliance and Audit Requirements

Many regulatory frameworks require secure handling of sensitive data. Hashing PII in logs allows you to maintain traceability without exposing the actual personal information, and digital signatures ensure non-repudiation for audit purposes.

However, not all hashing approaches are created equal. Simple hashes are vulnerable to dictionary and rainbow table attacks, which is why we need salt, pepper, and proper hashing algorithms designed for security-critical scenarios.

How we gonna do?

Let's implement secure hashing techniques in .NET, starting with the most critical use case - password hashing.

Step 1: Secure Password Hashing with PasswordHasher

Important: Never roll your own password hashing implementation. Use trusted solutions like ASP.NET Core Identity or external providers like Auth0. However, if you're working with legacy systems that need security improvements, here's how to use .NET's built-in PasswordHasher:

using Microsoft.AspNetCore.Identity;

public class UserService
{
    private readonly PasswordHasher<User> _passwordHasher;

    public UserService()
    {
        _passwordHasher = new PasswordHasher<User>();
    }

    public string HashPassword(User user, string password)
    {
        // This automatically generates a random salt and uses PBKDF2
        return _passwordHasher.HashPassword(user, password);
    }

    public PasswordVerificationResult VerifyPassword(User user, string hashedPassword, string providedPassword)
    {
        // This extracts the salt from the hash and verifies the password
        return _passwordHasher.VerifyHashedPassword(user, hashedPassword, providedPassword);
    }
}

public class User
{
    public int Id { get; set; }
    public string Username { get; set; }
    public string Email { get; set; }
}

The PasswordHasher internally uses PBKDF2 (Password-Based Key Derivation Function 2) with HMACSHA256, automatically generates random salts, and provides a simple interface that handles all the complexity for you.

Step 2: General Data Hashing with SHA256

For non-password data that needs hashing (like creating checksums or anonymizing PII in logs), you can use SHA256:

using System.Security.Cryptography;
using System.Text;

[ApiController]
[Route("api/[controller]")]
public class HashingController : ControllerBase
{
    [HttpPost("hash")]
    public IActionResult HashData([FromBody] string inputData)
    {
        // Convert string to byte array
        byte[] inputBytes = Encoding.UTF8.GetBytes(inputData);
        
        // Create SHA256 hash
        byte[] hashBytes = SHA256.HashData(inputBytes);
        
        // Convert to human-readable Base64 format
        string base64Hash = Convert.ToBase64String(hashBytes);
        
        return Ok(new { Hash = base64Hash });
    }
}

Warning: This basic approach is vulnerable to dictionary attacks. If someone has the hash and suspects the input was a common word or pattern, they can easily brute-force it.

Step 3: Adding Salt and Pepper for Enhanced Security

To make hashes more secure against dictionary and rainbow table attacks, add salt (unique per data item) and pepper (application-wide secret):

using System.Security.Cryptography;
using System.Text;

public class SecureHashingService
{
    private readonly string _pepper = "your-application-specific-secret-pepper"; // Store this in configuration

    public string CreateSecureHash(string data, string salt)
    {
        // Combine data with salt (unique per item) and pepper (application-wide)
        string saltedData = $"{salt}{data}{_pepper}";
        
        byte[] inputBytes = Encoding.UTF8.GetBytes(saltedData);
        byte[] hashBytes = SHA256.HashData(inputBytes);
        
        return Convert.ToBase64String(hashBytes);
    }

    public string HashUserDataForLogging(int userId, string sensitiveData)
    {
        // Use user ID as salt - this makes each hash unique even for identical data
        string salt = userId.ToString();
        return CreateSecureHash(sensitiveData, salt);
    }

    public string CreateDataChecksum(string data)
    {
        // For checksums, you might use a timestamp or GUID as salt
        string salt = Guid.NewGuid().ToString();
        return CreateSecureHash(data, salt);
    }
}

The salt should be unique per data item (like a user ID or GUID), while the pepper is a application-wide secret stored in configuration. This combination makes dictionary attacks exponentially more difficult because in case an attacker gets access to the database, they still need to know the pepper value to successfully brute-force the hashes.

Step 4: Digital Signatures for Non-Repudiation

For audit logs and compliance requirements, you need to ensure data hasn't been tampered with after creation. Simple hashing isn't enough because an attacker could modify the data and recalculate the hash. Instead, use digital signatures with Azure Key Vault:

using Azure.Identity;
using Azure.Security.KeyVault.Keys.Cryptography;
using System.Security.Cryptography;
using System.Text;

public class AuditSigningService
{
    private readonly CryptographyClient _cryptoClient;

    public AuditSigningService(IConfiguration configuration)
    {
        var keyVaultUrl = configuration["AzureKeyVault:Url"];
        var keyName = configuration["AzureKeyVault:SigningKeyName"];
        
        var credential = new DefaultAzureCredential();
        var keyClient = new KeyClient(new Uri(keyVaultUrl), credential);
        var key = keyClient.GetKey(keyName);
        
        _cryptoClient = new CryptographyClient(key.Value.Id, credential);
    }

    public async Task<string> SignAuditLog(string logData)
    {
        // Create SHA256 hash of the log data (this becomes our digest)
        byte[] dataBytes = Encoding.UTF8.GetBytes(logData);
        byte[] digest = SHA256.HashData(dataBytes);
        
        // Sign the digest using the private key in Key Vault
        SignResult result = await _cryptoClient.SignDataAsync(
            SignatureAlgorithm.RS256, 
            digest);
        
        // Return the signature as Base64 string
        return Convert.ToBase64String(result.Signature);
    }

    public async Task<bool> VerifyAuditLog(string logData, string signature)
    {
        try
        {
            // Recreate the digest from the log data
            byte[] dataBytes = Encoding.UTF8.GetBytes(logData);
            byte[] digest = SHA256.HashData(dataBytes);
            
            // Verify the signature against the digest
            byte[] signatureBytes = Convert.FromBase64String(signature);
            VerifyResult result = await _cryptoClient.VerifyDataAsync(
                SignatureAlgorithm.RS256, 
                digest, 
                signatureBytes);
            
            return result.IsValid;
        }
        catch
        {
            return false;
        }
    }
}

Step 5: Practical Implementation Example

Here's how you might use these techniques together in a real application:

public class UserManagementService
{
    private readonly PasswordHasher<User> _passwordHasher;
    private readonly SecureHashingService _hashingService;
    private readonly AuditSigningService _auditService;
    private readonly ILogger<UserManagementService> _logger;

    public UserManagementService(
        SecureHashingService hashingService,
        AuditSigningService auditService,
        ILogger<UserManagementService> logger)
    {
        _passwordHasher = new PasswordHasher<User>();
        _hashingService = hashingService;
        _auditService = auditService;
        _logger = logger;
    }

    public async Task<User> CreateUserAsync(string username, string email, string password)
    {
        var user = new User
        {
            Username = username,
            Email = email
        };

        // Hash the password securely
        user.PasswordHash = _passwordHasher.HashPassword(user, password);

        // Hash PII for secure logging
        string hashedEmail = _hashingService.HashUserDataForLogging(user.Id, email);
        
        // Create audit log entry
        string auditLog = $"User created: {user.Id}, Email Hash: {hashedEmail}";
        string signature = await _auditService.SignAuditLog(auditLog);
        
        // Log without exposing PII
        _logger.LogInformation("User created with ID {UserId}, Email Hash: {EmailHash}, Signature: {Signature}", 
            user.Id, hashedEmail, signature);

        return user;
    }

    public async Task<bool> ValidatePasswordAsync(User user, string password)
    {
        var result = _passwordHasher.VerifyHashedPassword(user, user.PasswordHash, password);
        
        // Log authentication attempt
        string auditLog = $"Authentication attempt for user {user.Id}: {result}";
        string signature = await _auditService.SignAuditLog(auditLog);
        
        _logger.LogInformation("Authentication attempt for user {UserId}: {Result}, Signature: {Signature}", 
            user.Id, result, signature);

        return result == PasswordVerificationResult.Success;
    }
}

Best Practices and Security Considerations

When implementing hashing in production:

• Avoid MD5: It's cryptographically broken and vulnerable to attacks
• Use SHA256 or better: For general hashing, SHA256 is currently secure
• Always use salt: Unique per data item to prevent rainbow table attacks
• Consider pepper: Application-wide secret for additional security
• Store secrets securely: Use Azure Key Vault or similar for keys and peppers
• Understand the difference: Hashing ≠ anonymization; hashing ≠ encryption
• Performance considerations: Hashing is computationally expensive; consider caching when appropriate

Summary

In this article, we explored the essential hashing techniques that every .NET developer should understand. We covered the critical difference between hashing and encryption, implemented secure password hashing with PasswordHasher, and learned how to protect against dictionary attacks using salt and pepper strategies.

Key takeaways include using ASP.NET Core Identity for password management rather than rolling your own solution, implementing proper salt and pepper techniques for general data hashing, and leveraging Azure Key Vault for digital signatures that ensure non-repudiation in audit logs.

Remember: hashing is a powerful one-way transformation that, when implemented correctly with proper salting and secure algorithms, provides robust protection for sensitive data while maintaining the ability to verify integrity and authenticate users. The investment in proper hashing techniques pays dividends in security, compliance, and peace of mind.