Question

wondering if anyone has some quick links to code snippets to generate a random salt (that’s not easy too easy to guess) and then hashing some plain text password with the generated hash.

Suggestions or links, please?

.NET code, please.

Answer 1

The salt can be know. Why would you want the salt “not easy to guess”? It just has to be unique so that if two people share the same password the salt applied to the password ensures that they don’t end up with the same hash value and to reduce the effectiveness of Rainbow attacks (where a reverse Hash dictionary is used to see the possible plain text value(s) that can produce a particular hash value)

From a code snippet on MSDN:

private static string CreateSalt(int size)
{
  // Generate a cryptographic random number using the cryptographic
  // service provider
  RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
  byte[] buff = new byte[size];
  rng.GetBytes(buff);
  // Return a Base64 string representation of the random number
  return Convert.ToBase64String(buff);
}

You can then append or prepend this on to the plain text password, then hash it.