title: JavaScript: How to generate Rfc2898DeriveBytes like C#?
body: <p><strong>EDIT:</strong> Per discussion in the comments, let me clarify that this will be happening server side, behind SSL. I do not intend to expose the hashed password or the hashing scheme to the client. </p>
  
  <p>Assume we have an existing asp.net identity database with the default tables (aspnet_Users, aspnet_Roles, etc.). Based on my understanding, the password hashing algorithm uses sha256 and stores the salt + (hashed password) as a base64 encoded string. <strong><em>EDIT: This assumption is incorrect, see answer below.</em></strong></p>
  
  <p>I would like to replicate the function of the Microsoft.AspNet.Identity.Crypto class' <a href="https://gist.github.com/trailmax/553ea84d4d0e2e20fcd7" rel="nofollow noreferrer">VerifyHashedPassword</a> function with a JavaScript version. </p>
  
  <p>Let's say that a password is <strong>welcome1</strong> and its asp.net hashed password is        <strong>ADOEtXqGCnWCuuc5UOAVIvMVJWjANOA/LoVy0E4XCyUHIfJ7dfSY0Id+uJ20DTtG+A==</strong></p>
  
  <p>So far I have been able to reproduce the parts of the method that get the salt and the stored sub key.</p>
  
  <p>Where the C# implementation does more or less this:</p>
  
  <pre><code>var salt = new byte[SaltSize];
  Buffer.BlockCopy(hashedPasswordBytes, 1, salt, 0, SaltSize);
  var storedSubkey = new byte[PBKDF2SubkeyLength];
  Buffer.BlockCopy(hashedPasswordBytes, 1 + SaltSize, storedSubkey, 0, PBKDF2SubkeyLength);
  </code></pre>
  
  <p>I have the following in JavaScript (not elegant by any stretch):</p>
  
  <pre><code>var hashedPwd = "ADOEtXqGCnWCuuc5UOAVIvMVJWjANOA/LoVy0E4XCyUHIfJ7dfSY0Id+uJ20DTtG+A==";
  var hashedPasswordBytes = new Buffer(hashedPwd, 'base64');
  var saltbytes = [];
  var storedSubKeyBytes = [];
  
  for(var i=1;i&lt;hashedPasswordBytes.length;i++)
  {
    if(i &gt; 0 &amp;&amp; i &lt;= 16)
    {
      saltbytes.push(hashedPasswordBytes[i]);
    }
    if(i &gt; 0 &amp;&amp; i &gt;16) {
      storedSubKeyBytes.push(hashedPasswordBytes[i]);
    }
  }
  </code></pre>
  
  <p>Again, it ain't pretty, but after running this snippet the saltbytes and storedSubKeyBytes match byte for byte what I see in the C# debugger for salt and storedSubkey. </p>
  
  <p>Finally, in C#, an instance of Rfc2898DeriveBytes is used to generate a new subkey based on the salt and the password provided, like so:</p>
  
  <pre><code>byte[] generatedSubkey;
  using (var deriveBytes = new Rfc2898DeriveBytes(password, salt, PBKDF2IterCount))
  {
     generatedSubkey = deriveBytes.GetBytes(PBKDF2SubkeyLength);
  }
  </code></pre>
  
  <p>This is where I'm stuck. I have tried others' solutions such as <a href="https://stackoverflow.com/questions/25745974/how-to-check-asp-net-password-hash-in-node-js">this one</a>, I have used Google's and Node's CryptoJS and crypto libraries respectively, and my output never generates anything resembling the C# version. </p>
  
  <p>(Example: </p>
  
  <pre><code>var output = crypto.pbkdf2Sync(new Buffer('welcome1', 'utf16le'), 
      new Buffer(parsedSaltString), 1000, 32, 'sha256');
  console.log(output.toString('base64'))
  </code></pre>
  
  <p>generates "LSJvaDM9u7pXRfIS7QDFnmBPvsaN2z7FMXURGHIuqdY=")</p>
  
  <p>Many of the pointers I've found online indicate problems involving encoding mismatches (NodeJS / UTF-8 vs. .NET / UTF-16LE), so I've tried encoding using the default .NET encoding format but to no avail.</p>
  
  <p>Or I could be completely wrong about what I assume these libraries are doing. But any pointers in the right direction would be much appreciated.</p>