we’re implementing a new ecommerce platform, and we want to make sure not to make mistakes that can be avoided in the security department.
This time, I took a look at the password storing and hashing. What we currently do:
We generate 8 to 16 random bytes from 0-36 and 125-255 range, use this as a salt into the password, then SHA512 it 100k times. Then we store password and salt in the user account.
The solution is in C#. Anything to add for the randomization of the salt input? Or did we miss something critical?
Please don’t invent yourself – there are proven standard methods to do so (including hashing several times etc.), see for example http://en.wikipedia.org/wiki/PBKDF2 and http://msdn.microsoft.com/en-us/library/system.security.cryptography.rfc2898derivebytes.aspx