.NET中如何安全地进行密码哈希存储_密码安全哈希存储方案

using System;
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    private const int SaltSize = 16;
    private const int HashSize = 32;
    private const int Iterations = 100000;

    public static string HashPassword(string password)
    {
        using (var rng = RandomNumberGenerator.Create())
        {
            byte[] salt = new byte[SaltSize];
            rng.GetBytes(salt);

            using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, Iterations, HashAlgorithmName.SHA256))
            {
                byte[] hash = pbkdf2.GetBytes(HashSize);
                return Convert.ToBase64String(salt) + ":" + Convert.ToBase64String(hash);
            }
        }
    }

    public static bool VerifyPassword(string password, string hashedPassword)
    {
        var parts = hashedPassword.Split(':');
        if (parts.Length != 2) return false;

        byte[] salt = Convert.FromBase64String(parts[0]);
        byte[] expectedHash = Convert.FromBase64String(parts[1]);

        using (var pbkdf2 = new Rfc2898DeriveBytes(password, salt, Iterations, HashAlgorithmName.SHA256))
        {
            byte[] actualHash = pbkdf2.GetBytes(HashSize);
            return CryptographicOperations.FixedTimeEquals(actualHash, expectedHash);
        }
    }
}

var hasher = new PasswordHasher<ApplicationUser>();
string hashed = hasher.HashPassword(user, "用户密码");

var result = hasher.VerifyPassword(user, hashed, "输入密码");
if (result == PasswordVerificationResult.Success)
{
    // 登录成功
}