Search code examples
c#salt-cryptographysimplemembership

Role of PasswordSalt witn SimpleMembershipProvider


I analyzed the CreateAccount method from SimpleMembershipProvider and there I found PasswordSalt is not stored up in Database and only the hashedpassword is being saved.

Is that not neccessary to save PasswordSalt in database?

int insert = db.Execute(@"INSERT INTO [" + MembershipTableName + "] (UserId, [Password], PasswordSalt, IsConfirmed, ConfirmationToken, CreateDate, PasswordChangedDate, PasswordFailuresSinceLastSuccess)"
                                    + " VALUES (@0, @1, @2, @3, @4, @5, @5, @6)", uid, hashedPassword, String.Empty /* salt column is unused */, !requireConfirmationToken, dbtoken, DateTime.UtcNow, defaultNumPasswordFailures);

Solution

  • While it is quite common to save the salt, it's not necessary. It mainly depends on how the salt is created.

    If the salt only relies on information that is already present in the database, UserId for example, it can recreate the salt using that information.

    Another option would be to concatenate the salt with the password hash without using a clear separator. So it could be that the first 8 bytes of the password hash are actually the salt.

    Then there's the chance that the salt isn't used. So there's no need to fill it. Which actually seems to be the case here.