Aspnetcore.docs: Documentation on customizing default password hashing

[Kool-Koder]

Hi, I can't seem to find the tutorial for customizing Identity default password hashing. With reference to this article, may I know if what is stated inside is correct? ASP.NET Identity Version 2: PBKDF2 with HMAC-SHA1, 128-bit salt, 256-bit subkey, 1000 iterations Thank you!

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: d9869895-9ba2-5027-46cd-89d1d995cba4
• Version Independent ID: 8750939b-6ae5-3b9a-6c32-5e84b7fea22c
• Content: Identity model customization in ASP.NET Core
• Content Source: aspnetcore/security/authentication/customize-identity-model.md
• Product: aspnet-core
• GitHub Login: @ajcvickers
• Microsoft Alias: avickers

[serpent5]

Yes, that's correct. You can see for yourself in the source code.

[Kool-Koder]

How am I able to specify which version to use? Thank you!

[serpent5]

You can add something like the following to ConfigureServices:

services.Configure<PasswordHasherOptions>(
    o => o.CompatibilityMode = PasswordHasherCompatibilityMode.IdentityV2);

[Kool-Koder]

I see nice. Thank you very much! :)

[guardrex]

Yes, we need to cover PasswordHasherOptions in the auth docs. Thanks for opening.

[guardrex]

Yes, helpful b/c we often can make faster/better doc updates following discussion.

[Kool-Koder]

You can add something like the following to ConfigureServices:

services.Configure<PasswordHasherOptions>(
    o => o.CompatibilityMode = PasswordHasherCompatibilityMode.IdentityV2);

Hi, I just tried the above code and regardless whether it's V2 or V3 I could login to the database without changing anything. Is there anything else I missed? From my understanding V2 and V3 should result in different hash and therefore the user would be unable to login.

[serpent5]

The hashed password is different, but the first byte specifies which version of the hashing algorithm was actually used. When verifying a password against a hash, the VerifyHashedPassword method is able to select the correct algorithm to use based on this "format marker" byte and so the user can log in regardless of which version of the algorithm was used. The PasswordHasherCompatibilityMode is used to specify which algorithm gets used when hashing new passwords.

[guardrex]

@serpent5 I nominate you for ...

🥇 _Answer of the Day_ 🥇

Getting the .NET Foundation to send you a free case of :beer: is another matter tho. I have a feeling that I'm not going to get a lot of traction with that idea! 😁 lol

[Kool-Koder]

Great answer @serpent5 Thank you very much for sharing. Your help is much appreciated

[serpent5]

@guardrex Thanks! They say it's the thought that counts... 🤔

@Kool-Koder It's no problem at all. Glad to be able to help. 😃