Using Secure Hashing safely in .Net

by martin 5. October 2011 22:41

SHA 1 and SHA 256 are both great hashing algorithms, but both are susceptible to a Rainbow Table attack and with Moore's law and the great race by Google, Bing, and other search engines to index absolutely every bit of data out there on the internet, the chances of these attack succeeding grows every day. As a developer fending off this kind of vector, it is considered a best practice to not only always salt your data before hashing it, but to always make sure that the salt is completely random in nature. Additionally, since both SHA 1 and SHA 256 are Big - O(n) algorithms as far as performance cost is concerned and relatively inexpensive to execute on modern hardware, it is also a good idea to have multiple iterative calls to the hashing algorithm to come up with the hash. And while we are at it, we might as well switch up between using both algorithms just in case one has a yet undiscovered flaw similar to that which was discovered with MD-5 or even SHA-0 before that. Below is a C# implementation of a secure hash helper class to help you do all this. It provides a way to create a hash from a value and to confirm that a hash was made from a given value. It currently does additional Base64 encoding/decoding of the hash value for ease of use in web applications (tamper proofing forms against request forgery, storing password hashes, etc), but this can easily be removed if you'd prefer to deal in raw byte arrays.

Code Snippet

using System;
using System.Security.Cryptography;
 
namespace SecureHashTestConsole
{
    public static class SecureHashHelper
    {
        // set this to a relatively small number that you like.  (4 to 25 suggested range)  Larger number = longer random hash
        private const int defaultNumBytesForSeed = 9;
 
        // set this to a decent number, not too low, not to high (5 to 1000 suggested range)  Larger number = slower performance but less likely rainbow table cracking possibility
        private const int defaultIterations = 88;     
 
        public static bool CompareSecureHash(string TestHash, string TestValue, int numRandBytesForSeed = defaultNumBytesForSeed, int iterations = defaultIterations)
        {
            byte[] hashArray = Convert.FromBase64String(TestHash);
            byte[] derivedSalt = new byte[numRandBytesForSeed];
            Buffer.BlockCopy(hashArray, 0, derivedSalt, 0, numRandBytesForSeed);
            string strComp = CreateSecureHash(TestValue, derivedSalt, iterations);
            return strComp.Equals(TestHash);
        }
 
        public static string CreateSecureHash(byte[] sbuffer, int numRandBytesForSeed = defaultNumBytesForSeed, int iterations = defaultIterations)
        {
            RNGCryptoServiceProvider rand = new RNGCryptoServiceProvider();
            byte[] randSalt = new byte[numRandBytesForSeed];
            rand.GetBytes(randSalt);
            return CreateSecureHash(randSalt, sbuffer, iterations);
        }
 
        public static string CreateSecureHash(string ValueToHash, int numRandBytesForSeed = defaultNumBytesForSeed, int iterations = defaultIterations)
        {
            RNGCryptoServiceProvider rand = new RNGCryptoServiceProvider();
            byte[] randSalt = new byte[numRandBytesForSeed];
            rand.GetBytes(randSalt);
            System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
            Byte[] bytes = encoding.GetBytes(ValueToHash);
            return CreateSecureHash(randSalt, bytes, iterations);
        }
 
        private static string CreateSecureHash(string ValueToHash, byte[] randSalt, int iterations = defaultIterations)
        {
            System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
            Byte[] bytes = encoding.GetBytes(ValueToHash);
            return CreateSecureHash(randSalt, bytes, iterations);
        }
        private static string CreateSecureHash(byte[] randSalt, byte[] sbuffer, int iterations = defaultIterations)
        {
            SHA1Managed sha1 = new SHA1Managed();
            SHA256Managed sha256 = new SHA256Managed();
 
            byte[] buffer = new byte[randSalt.Length + sbuffer.Length];
            Buffer.BlockCopy(randSalt, 0, buffer, 0, randSalt.Length);
            Buffer.BlockCopy(sbuffer, 0, buffer, randSalt.Length, sbuffer.Length);
 
            for (int i = 0; i < iterations; i++)
            {
                // flip the order of using these two around if you want longer hashes 
                sha256.ComputeHash(buffer);
                buffer = sha256.Hash;
                sha1.ComputeHash(buffer);
                buffer = sha1.Hash;
            }
 
            byte[] output = new byte[buffer.Length + randSalt.Length];
            Buffer.BlockCopy(randSalt, 0, output, 0, randSalt.Length);
            Buffer.BlockCopy(buffer, 0, output, randSalt.Length, buffer.Length);
 
            return Convert.ToBase64String(output);
        }
    }
}

Here is a simple console driver application that demonstrates its usage:

Code Snippet

using System;
 
namespace SecureHashTestConsole
{
    class Program
    {
        static void Main(string[] args)
        {
            var testValues = new[] {"Testing" , "2", "4343", "help", "This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here"};
            foreach (string strTestValue in testValues)
            {
                for (int i = 0; i < 10; i++)
                {
                    String hash = SecureHashHelper.CreateSecureHash(strTestValue);
                    Console.WriteLine("Hash #{0} of '{1}' = '{2}'", i+1, strTestValue, hash);
                    Console.WriteLine("Comparison = {0} (should be True)", SecureHashHelper.CompareSecureHash(hash, strTestValue));
                    Console.WriteLine("Comparison = {0} (should be False)", SecureHashHelper.CompareSecureHash(hash, strTestValue + " "));
                }
            }
        }
    }
}

Example Output

Hash #1 of 'Testing' = 'qxj1uwwjKs+4sP9mUc96gpUIVYRcyD2FliNh'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #2 of 'Testing' = '4E7baUemZRmM7oYWk2aWdQ5jpnQ8OJcr4HmS'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #3 of 'Testing' = '0RRhLyFefkcLP9X5qWp/Nih8RNjezPzHm2hM'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #4 of 'Testing' = '/c2cdFCuc+eWAOxp192gSeSdNzWkddxkOuvD'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #5 of 'Testing' = 'OWrWE/821zy8siYjnGA+VD6UYXFRJjaW9gom'

Comparison = True (should be True)

Comparison = False (should be False)

.....................................

Hash #10 of 'help' = 'yiTptJocrqyFRpp6Hlk4/cXF04T6SQdsqqt7'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #1 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'qeIzv06CJeDXzu4p3K/uFSxcqVH45Wm6ESjo'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #2 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'xrQm1kuNrczVrdONoS8sRjddq0zq2si02hyN'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #3 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'WO7aN2lXoZgg7m0EYDnKqoRQw7mg3CSH0ori'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #4 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'CgQq75ZBm40P2IrNzaVZRBBCjjn3QdlN2Ivt'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #5 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'wXGXvdU1TBQCluwL2Kce1x4SbUU0YuFup31V'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #6 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'Xzpdr5p4RHJ1O24LdDxruL4+nw+NOp0tjrsh'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #7 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'kYFQgmaZp3VG1LjwYslKdGHZg7nnlZfLHDHB'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #8 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'nA/7Ky7xbMpAZ1OVuLF7Ku/0YarzZXpKIfA8'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #9 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'b875hD3alHDPv4yrl46GsvgGtuQOLpsECj7o'

Comparison = True (should be True)

Comparison = False (should be False)

Hash #10 of 'This is a test to see if the hash will be small even though the text is a bit bigger than the others that are listed here' = 'BJHwf4plv/t0Hpx1oi0l0VuZa9Dq0FppYI2J'

Comparison = True (should be True)

Comparison = False (should be False)

Currently rated 3.0 by 5 people

Currently 3/5 Stars.
1
2
3
4
5

Tags: security, .net, c#

ASP.Net | C#

Impossible to show client side validation summary message on form validation failure using the default MS MVC 3 validation?

by martin 15. April 2011 23:05

So Microsoft has a bug in that they do not allow you to show the validation summary message in client side validation mode when you tell it to exclude the property error detail messages in the Html.ValidationSummary(true,"Please enter the required fields below.") way.

I've seen people fix this using jquery validation and unobstructive, but not with the out of the box default MicrosoftMvcValidation.js.

So there were two problems:

The first was that passing true to ValidationSummary set the replaceValidationSummary parameter in the autogenerated window.mvcClientValidationMetadata.push statement. What they should have been doing instead is simply not initializing the validationSummaryULElement.

Ok... this isn't pretty, but it works. Simply load MicrosoftMvcValidation.js in your page and then execute the code below to dynamically patch the code.

$(function () {    // this function fixes a bug.  It allows the validation summary message to be shown clientside even when the "excludePropertyErrors" bool is set to true in Html.ValidationSummary    
	var old_validate = Sys.Mvc.FormContext.prototype.validate;    
	Sys.Mvc.FormContext.prototype.validate = function () {        
		if (this.replaceValidationSummary == false) {  // only mess with this if it is turned off (MS bug)            
			this.replaceValidationSummary = true; // this is for both the debug and non debug versions            
			this._validationSummaryULElement = null;  // this is for the debug version            
			this.$8 = null;  // this is for the non debug version (does the same thing as the line above)        
		}        
		return old_validate.apply(this);   
	}
});

Currently rated 3.0 by 5 people

Currently 3/5 Stars.
1
2
3
4
5

Tags: asp.net, .net, mvc

ASP.Net | JavaScript

ASP.NET MVC Url.Content works inconsistently in HEAD tag

by martin 26. October 2010 14:13

I was trying to fix an MVC master page so that it correctly rendered urls for the referenced style sheets and JavaScript file regardless what the URL path looked like. So I ran across this StackOverflow article which told me to use Url.Content to properly resolve my relative references from the application root (not the web server root). So I did this. The all of the sudden, I started getting crazy error messages saying "A potentially dangerous Request.Path value was detected from the client (<)." It turns out that ASP.NET process things inconsistently. After reading this post and playing around, I realized that script src URLs are treated one way and link href URLs are treated a different ways when your HEAD tag has the RunAt attribute set to Server (which it does by default). I guess I'm surprised that there wasn't more about this anomaly out there. I figured that there would be a lot more folks out there using MVC that wanted to put both script and link tags in their master page so that they worked regardless of the routing path in the URL.

Currently rated 3.0 by 5 people

Currently 3/5 Stars.
1
2
3
4
5

Tags: asp.net, mvc

ASP.Net

Sorting custom data objects the easy way

by martin 28. September 2009 22:32

I recently had to implement custom sorting on couple of ASP.net pages that had to bind to a collection of custom data objects. Not wanting to re-invent the wheel on every page, I looked for an easier solution online. I ran across at least two worth mentioning: Generic Sorting Using Reflection in .NET By Jon Wojtowicz (http://www.eggheadcafe.com/articles/pfc/propertycomparer.asp) and Rocky Lhotka's MSDN article where he presents his Generics based PropertyComparer. I liked Jon's solution in that it was written using recursion so that you could easily sort by properties of properties. However Jon's implementation was not "Generics" based. Rocky's implementation was generics based, but it lacked the recursion that my solution needed. In the end, I ended up modifying Jon's code to be generics based. I sent Jon an email asking for permission to share his modified code online, but unfortunately he never responded to my email.

Below is a link to my patch file to Jon's PropertyComparer.cs file. You can download the original directly from Jon's project hosted on EggHeadCafe in the link above.

PropertyComparer.patch (2.99 kb)

Here is an example of how you would use this to support sorting in a Telerik RadGrid:

        protected void RadGrid1_SortCommand(object source, GridSortCommandEventArgs e)

            List<Employee> employees = (List<Employee>)RadGrid1.DataSource;

            CompareOrder cmpOrder;

            GridSortExpression expression = new GridSortExpression();

            if (e.NewSortOrder.Equals(GridSortOrder.Ascending))

                cmpOrder = CompareOrder.Ascending;

                expression.SortOrder = GridSortOrder.Ascending;

            else

                cmpOrder = CompareOrder.Descending;

                expression.SortOrder = GridSortOrder.Descending;

            employees.Sort(new PropertyComparer<Employee>(e.SortExpression, cmpOrder));

            expression.FieldName = e.SortExpression;

            e.Item.OwnerTableView.SortExpressions.Clear();
            e.Item.OwnerTableView.SortExpressions.AddSortExpression(expression);
            e.Item.OwnerTableView.Rebind();
            e.Canceled = true;
        }

Currently rated 5.0 by 1 people

Currently 5/5 Stars.
1
2
3
4
5

Tags: .net, asp.net, c#, poco, radgrid

ASP.Net | C#

Anonymous HTTP PUT with IIS 7

by martin 22. June 2009 21:32

From googling around in trying to get HTTP put enabled on IIS 7, I have concluded that turning on HTTP PUT verb support requires the installation of the WebDAV handler extension and that even then it only works in integrated authentication mode. If this is not true, please let me know as I was forced to write my own put HTTP handler. It actually turned out to be a lot easier than I thought it was going to be though. Implementing IHttpHandler, I ended up just having to binaryread the request into a byte array and then use a binarywriter to write it to a file after validating the PhysicalPath of the request for user permissions and validating that the "pattern" is safe (ex. file extension, path). I haven't tested the performance against the IIS 6 native solution, but it seems quite fast on today's server hardware.

Update May '11: Here is some code to get you started:

Web.Config

<appSettings>
    <add key="BasePutPath" value="C:\PutUploadDir\" />
    <add key="PutSecurityRegularExpression" value="^.+\\UPLOAD\\(\{[0-9A-F]{8}\-[0-9A-F]{4}\-[0-9A-F]{4}\-[0-9A-F]{4}\-[0-9A-F]{12}\})\\(.+\.DOC)$"/>
</appSettings>

PutHandler.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Text.RegularExpressions;
using System.Web;
using System.Data.Sql;
using System.Data;
using System.Data.SqlClient;
using System.IO;
using System.Configuration;
using System.Drawing;
using System.Drawing.Imaging;
using System.Drawing.Drawing2D;
using log4net;
using log4net.Config;
 
namespace IIS7Helper
{
    public class PutHandler : IHttpHandler
    {
        private static ILog log;
        private static string strBasePutPath;
        private static string strPutSecurityRegularExpression;
 
        static PutHandler()
        {
            log = LogManager.GetLogger(typeof(PutHandler));
            strBasePutPath = ConfigurationManager.AppSettings["BasePutPath"];
            strPutSecurityRegularExpression = ConfigurationManager.AppSettings["PutSecurityRegularExpression"];
        }
    
 
        public bool IsReusable
        {
            get { return true; }
        }
 
        
        public void ProcessRequest(HttpContext context)
        {
            try
            {
                byte[] arrBytes = context.Request.BinaryRead(context.Request.ContentLength);
                string strLocation = context.Request.PhysicalPath.ToUpper();
                bool blnRequestSecure = false;   // trust no request by default
 
                // sample url
                // https://xxx.yyy.com/Upload/{56DA31A8-15A8-4A0B-90F2-4A59909F5DCE}/MyFile.doc 
 
                string strDirName = string.Empty;
                string strFileName = string.Empty;
                string strPhysicalLocation = string.Empty;
 
                Regex re = new Regex(strPutSecurityRegularExpression, RegexOptions.Singleline);
                Match m = re.Match(strLocation);
                if (m.Success)
                {
                    strDirName = m.Groups[1].Captures[0].Value;
                    strFileName = m.Groups[2].Captures[0].Value;
 
                    strPhysicalLocation = Path.Combine(strBasePutPath, strDirName);
 
                    if (Directory.Exists(strPhysicalLocation))
                    {
                        blnRequestSecure = true;
                    }
                    else
                    {
                        log.Error("Directory does not exist : " + strPhysicalLocation);
                    }
                }
                else
                {
                    log.Error("Security Alert : URL RegEx failed for " + strLocation);
                }
                strPhysicalLocation = Path.Combine(strPhysicalLocation, strFileName);
                if (blnRequestSecure)
                {
                    log.Debug("About to write data to " + strPhysicalLocation);
                    BinaryWriter bw = new BinaryWriter(new FileStream(strPhysicalLocation, FileMode.CreateNew));
                    bw.Write(arrBytes);
                    bw.Flush();
                    bw.Close();
                    bw = null;
                    context.Response.StatusCode = 200;
                    context.Response.Flush();
                }
                else
                {
                    log.Error("Fall through due to either not matching regex or dir not existing. " );
                    context.Response.StatusCode = 500;
                    context.Response.Flush();
                }
            }
            catch (Exception ex)
            {
                log.Error("An error occurred : " + ex.ToString());
                context.Response.StatusCode = 500;
                context.Response.Flush();
            }
        }     
    }
}

Currently rated 5.0 by 1 people

Currently 5/5 Stars.
1
2
3
4
5

Tags: iis 7, asp.net, c#

ASP.Net | C# | Windows

Service Oriented Programming and DSLs?

by martin 19. November 2008 22:20

I recently attended Dev Connections and was shown the benefits of decoupling business logic from aspects such as authentication, authorization, security, transaction support, threading model, instantiation model, encoding, and transport mechanism. In Juval Lowy's Windows Communication Framework (WCF) seminar, I was exposed to the idea of our software tools and runtime environments evolving to allow us to utilize these functionalities in business application without even doing anything additional. Juval reiterated that WCF is not just about web service and explained many of the benefits that you would get for using WCF even on an application that does not span CPUs. These benefits include fault tolerance, fault screening (or formal fault contracts), contract first development, and the benefit of a thought out framework that provides separation of concerns for many aspects of enterprise software development.

At PDC at the end of October, Microsoft announced Azure, Oslo, and Dublin. So Azure, or the "cloud", will let you deploy and run your production applications easily and supposedly allow them to dynamically scale up on-the-fly as demand warrants. I heard this maybe being accomplished by dynamically spawning new virtualized servers from software and data that are stored in a massive partitioned and redundant sql server cluster (or I may have dreamt all this). Oslo is the hybrid (both visual (Quadrant) and textual) programming environment for creating and using custom Domain Specific Languages (DSL) and Dublin is a SQL server based repository and runtime environment for the resulting Oslo DSL programs and data structures. The DSLs are written in Mgrammer ("Mg") and the modeling language itself is just called "M". There is a silverlight video from MS on http://modelsremixed.com/ that shows the history of "modeling", starting with prehistoric times. In it, you will notice that one of the process models that they show is comprised of a component with the tiny logo that reads "Wcf" in its top left corner.

So that is a lot of new information to absorb.... but what does this all mean? Will we all really be orchestrating business process workflows written in "vertical" DSLs? Where does BPEL fit in? Is this Microsoft's killer-app ESB?

http://msdn.microsoft.com/en-us/oslo/default.aspx

Be the first to rate this post

Currently 0/5 Stars.
1
2
3
4
5

Tags: .net, soa, wcf, oslo

ASP.Net | C# | Windows

<< Previous posts

Krolik.net

explorations in coding, ramblings, etc.

Using Secure Hashing safely in .Net

Impossible to show client side validation summary message on form validation failure using the default MS MVC 3 validation?

ASP.NET MVC Url.Content works inconsistently in HEAD tag

Sorting custom data objects the easy way

Anonymous HTTP PUT with IIS 7

Service Oriented Programming and DSLs?

Welcome

Pages

Month Archive

Recent Comments

Krolik.net

explorations in coding, ramblings, etc.

Using Secure Hashing safely in .Net

Impossible to show client side validation summary message on form validation failure using the default MS MVC 3 validation?

ASP.NET MVC Url.Content works inconsistently in HEAD tag

Sorting custom data objects the easy way

Anonymous HTTP PUT with IIS 7

Service Oriented Programming and DSLs?

Welcome

Tag Cloud

Pages

Month Archive

Newsletter

Thank you

Blog Roll

Recent Comments