title: How does DotNetNuke Hash Its Passwords?
body: <p>I am writing a login system that will log in against a DotNetNuke application's database.  I have access to the database and can read the PasswordSalt in the aspnet_Membership table.  Hence I will have as inputs:</p>
  <ol>
  <li>user's password (submitted by form)</li>
  <li>user's salt (I can look up)</li>
  </ol>
  <p>and I must produce as output the hashed Password.  The PasswordFormat=2, which is &quot;Encrypted&quot;.  However, I have not been able to find details of the encryption algorithm being used, so that I can rewrite it in my own application.  So far, my research has led be to this page:</p>
  <p><a href="http://msdn.microsoft.com/en-us/library/aa478949.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/aa478949.aspx</a></p>
  <p>and also <a href="https://stackoverflow.com/a/8132734/438615">this SO post</a>, which has the following formula in one of the comments:</p>
  <pre><code>Convert.ToBase64String((new Rfc2898DeriveBytes(YourPWD, YourSALT)).GetBytes(20))
  </code></pre>
  <p>However, this formula does not appear to work on my test data, which has the following inputs and outputs:</p>
  <ol>
  <li>password: 888888</li>
  <li>salt: ahEvjCX3FM04S5cSi1qdHA==</li>
  <li>hashed password: y3rxLUDYdj1/+IGC94/tvW6M3pQTCi/9bq1cNOUgYlM=</li>
  </ol>
  <p>You can see my test here: <a href="http://ideone.com/EClO2" rel="nofollow noreferrer">http://ideone.com/EClO2</a></p>
  <pre class="lang-cs prettyprint-override"><code>using System;
  using System.Security.Cryptography;
   
  public class Test
  {
          public static void Main()
          {
                  Console.WriteLine(Convert.ToBase64String((new Rfc2898DeriveBytes(&quot;888888&quot;, System.Convert.FromBase64String(&quot;ahEvjCX3FM04S5cSi1qdHA==&quot;))).GetBytes(20)));
          }
  }
  </code></pre>
  <p>Thanks for any help!</p>
  <h1>UPDATE</h1>
  <p>Answered here: <a href="https://stackoverflow.com/questions/12433726/asp-net-membershipprovider-how-exactly-does-it-do-encryption">ASP.NET MembershipProvider -- How exactly does it do encryption?</a></p>