Question

Application : Nerddinner.

This SP is for an inserting password for newly created User. I was trying to figure out where the @Password come from in the application code since it is provided to this SP.
I looked for it on application level, but I could not find it on application level. Does anyone know where the SP is used in the application to pass @Password?

  ALTER PROCEDURE [dbo].[aspnet_Membership_CreateUser]
            @ApplicationName                        nvarchar(256),
            @UserName                               nvarchar(256),
            @Password                               nvarchar(128),
            @PasswordSalt                           nvarchar(128),
            @Email                                  nvarchar(256),
            @PasswordQuestion                       nvarchar(256),
            @PasswordAnswer                         nvarchar(128),
            @IsApproved                             bit,
            @CurrentTimeUtc                         datetime,
            @CreateDate                             datetime = NULL,
            @UniqueEmail                            int      = 0,
            @PasswordFormat                         int      = 0,
            @UserId                                 uniqueidentifier OUTPUT

Answer 1

This is how MS does it:

internal string EncodePassword(string pass, int passwordFormat, string salt)
    {
        if(passwordFormat == 0) // MembershipPasswordFormat.Clear
            return pass;

        byte[] bIn = Encoding.Unicode.GetBytes(pass);
        byte[] bSalt = Convert.FromBase64String(salt);
        byte[] bAll = new byte[bSalt.Length + bIn.Length];
        byte[] bRet = null;

        Buffer.BlockCopy(bSalt, 0, bAll, 0, bSalt.Length);
        Buffer.BlockCopy(bIn, 0, bAll, bSalt.Length, bIn.Length);
        if(passwordFormat == 1)
        { // MembershipPasswordFormat.Hashed
            HashAlgorithm s = HashAlgorithm.Create(Membership.HashAlgorithmType);
            bRet = s.ComputeHash(bAll);
        }
        else
        {
            bRet = EncryptPassword(bAll);
        }

        return Convert.ToBase64String(bRet);
    }