Generating hash value

[Eliyahu Goldin]

Following Microsoft recommendations, I'd like to store a one-way passport
hash of a user's password. .NET provides method
FormsAuthentication.HashPasswordForStoringinConfigFile (...) to generate a
hash value with either SHA1 or MD5 algorithm. My problem is that the
password is to be generated on a workstation with no .NET installed. How can
I generate a hash value without .NET in the same way as
HashPasswordForStoringinConfigFile does? Is there any sequence of Windows
Crypto API calls with the same effect? An external stored procedure on the
server side?

Eliyahu

 

[Michel Gallant]

Yes, CryptoAPI supports calculating hashes using functions:
CryptCreateHash
CryptHashData
CryptGetHashParam (with dwParam = HP_HASHVAL to get actual hash buffer)
Start here:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/data_hashes.asp

The byte order in the capi buffer returned is identical to data in .NET
HashPasswordForStoringinConfigFile string.
You only need to convert the byte buffer into an ordered hex-string to match the .NET hash string.

- Michel Gallant
MVP Security

 

[Andy]

Crypto API calls with the same effect? An external stored procedure on the

server side?

you can use XP_CRYPT (www.activecrypt.com). Free version supports SHA1, MD5
and DES hashes without limitations.

 

[Eliyahu Goldin]

Thanks Michel and Andy,

Your answers are exactly what I need.

Eliyahu