How to check password manually in Asp.Net identity 2?

Question

This might actually be more of a conceptual question. In Asp.Net Identity the PasswordHasher generates a different hash for the same string every time you do:

new PasswordHasher.HashPassword("myString");

Now if for some reason I need to manually compare a user's input to the password saved in the database, I will most probably get a different string when I hash the user's entered password, than the one that is stored in the database.

Can someone please explain this to me? Shouldn't hashing the same string result in the same hash and if not, how does Identity itself realize that two different hashes are in fact the same?

Rave

Answer 1

PasswordHasher generates different hashes each time because it uses salting technique. This technique secure the hashed password against dictionary attacks. By the way you could use following code to manually verify the password:

if(PasswordHasher.VerifyHashedPassword("hashedPassword", "password") 
    != PasswordVerificationResult.Failed)
{
    // password is correct 
}

Faithfaithful

Where is the salt passed into the method? in order for the password to be "hashed" properly it must use the same salt that was used to hash the original password. – Dawndawna

@Dawndawna salt included in hashedPassword. So by passing hashedPassword the salt also passed to method as well. – Faithfaithful

Answer 2

var user = _userManager.Users.SingleOrDefault(p => p.PhoneNumber == model.PhoneNumber);
            if (user == null)
            {
                return RedirectToAction(nameof(Login));
            }

            var result1 = _userManager.PasswordHasher.VerifyHashedPassword(user, user.PasswordHash, model.Password);
            if (result1 != PasswordVerificationResult.Success)
            {
                ModelState.AddModelError(string.Empty, "Invalid login attempt.");
                return View(model);
            }

Delinquency