如何在SQL Server 2008 R2中存儲散列密碼

Question

我試圖在SQL Server 2008 R2中存儲散列密碼，但是當我將存儲的版本與原始文件進行比較時，它們不匹配。

string password = "12345"; 
User user = new User(); 
user.USERNAME = "JohnDoe"; 

using (var rngCsp = new RNGCryptoServiceProvider()) 
{ 
      byte[] salt = new byte[32]; 
      rngCsp.GetBytes(salt); 
      user.SALT = UTF8Encoding.UTF8.GetString(salt); 
} 

using (SHA256CryptoServiceProvider sha = new SHA256CryptoServiceProvider()) 
{ 
    user.PASSWORD = UTF32Encoding.UTF8.GetString(sha.ComputeHash(UTF8Encoding.UTF8.GetBytes(password + user.SALT))); 
} 

//store the user on db 
db.UserUpdate(user); 

// now get the db values that have been saved and compare with original 
var userOnDB = db.UsersGet(user.USERNAME); 
var passwordOnDb = userOnDB.PASSWORD; 

//this returns false 
if (passwordOnDb == user.PASSWORD) 
{ 

} 

SQL Server表具有列：

TABLE [dbo].[USERS] 
(
    [ID] [int] IDENTITY(1,1) NOT NULL, 
    [SALT] [nvarchar](50) NOT NULL, 
    [PASSWORD] [nvarchar](50) NOT NULL, 
    ......... 
) 

這是我的數據庫訪問代碼：

public USER UsersGet(string userName) 
{ 
     using (MyEntities ctx = new MyEntities()) 
     { 
      return ctx.USERS.Where(a => a.USERNAME == userName).FirstOrDefault(); 
     } 
} 

public void UserUpdate(USER user) 
{ 
    try 
    { 
      using (MyEntities ctx = new MyEntities()) 
      { 
       if (controller.ID == 0) 
       { 
        ctx.Entry(user).State = System.Data.Entity.EntityState.Added; 
       } 
       else 
       { 
        ctx.Entry(user).State = System.Data.Entity.EntityState.Modified; 
       } 

       ctx.SaveChanges(); 
      } 
     } 
     catch (Exception ex) 
     { 
      throw new Exception(ex.InnerException.InnerException.Message); 
     } 
    } 

這裏是我的User對象

public int ID { get; set; } 
public string FIRSTNAME { get; set; } 
public string LASTNAME { get; set; } 
public string ADDRESS1 { get; set; } 
public string ADDRESS2 { get; set; } 
public string ADDRESS3 { get; set; } 
public string TOWN { get; set; } 
public string POCODE { get; set; } 
public string MOBILE { get; set; } 
public string COMMENTS { get; set; } 
public bool ACTIVE { get; set; } 
public string NIC { get; set; } 
public string LANDLINE { get; set; } 
public string USERNAME { get; set; } 
public string EMAIL { get; set; } 
public string SALT { get; set; } 
public string PASSWORD { get; set; } 

所以我我以爲我是穆斯在SQL Server表中沒有錯誤的列類型。

Answer 1

如果你想密碼哈希來匹配你需要使用保存在數據庫中的鹽不是創建一個新的