Author: VincentV | Posted on: 10/20/2008 10:54:20 AM | Views : 845

I set up the membership system to use SHA1 because I wanted to be able to manually reset passwords if I had to with a known and easy-to-hash alogorithm.
 And so I selected SHA1 in my web.config: 'passwordFormat="Hashed"' (it defaults to SHA1).
 BUT
In the my_aspnet_Membership table, both the Password column and the PasswordKey column are filled out.
 
Let's take, for example, the string "crippen"
When I SHA1 it, I get: 643a9e46a5240777b93af9f6c8e0711e2912b83e
in the database it's:
Password: 6Ou2HJQuSEHxLbsSMZgeTpHuj90=
PasswordKey: B+LGKhw2EQRs6oGyntFv8g==

 
How the heck is Microsoft generating hashes?!
 
Thanks!

...

Go to the complete details ...