title: Password Hashing - Why salt 60,000 times
body: <p>I'm working for a Fortune 100 company and I'm thrown into being tasked with security moving from SHA1 to SHA-2 .   This is not my area of expertise, but as I study cryptography I am questioning the outdated information etc...</p>
  
  <ol>
  <li><p>SHA-2 is obviously needed over SHA-1 but when the security team KNOWS that the hashing of password + salt is using SHA,  with GPU being so ridiculously fast at cracking billions of hashes - I do not get why for passwords i'm not being told to use bcrypt or another equivalent that is slow   ,  WHY?</p></li>
  <li><p>I'm shown a powerpoint slide in which i'm told to create my salt 60,000 times.  I searched all over the internet and I'm not seeing any such advise or examples.  Why?</p></li>
  </ol>
  
  <p>I'm using C# </p>
  
  <pre><code>string SaltAndPwd = string.Concat(plainTextPassword, salt);
  SHA256 sha2 = SHA256Managed.Create();
  byte[] buff = sha2.ComputeHash(Encoding.Unicode.GetBytes(SaltAndPwd));
  </code></pre>
  
  <p>I suppose that I'm not told to create a salt over and over, but to create the hash over and over.</p>
  
  <p>Would this logic be appropriate?  </p>
  
  <pre><code>string plainTextPassword = "aF7Cvs+QzZKM=4!";  
  string salt = "o9kc5FvhWQU==";
  SHA256 sha2 = SHA256Managed.Create();
  
  for(var i = 0; i &lt;= 60000; i++)
  {
     byte[] buff = sha2.ComputeHash(Encoding.Unicode.GetBytes(SaltAndPwd));
  }
  </code></pre>
  
  <p>How do I make this hashing to work properly?</p>
  
  <p><strong>Update  found the powerpoint slide</strong></p>
  
  <p><a href="https://i.stack.imgur.com/z37E4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/z37E4.png" alt="enter image description here"></a></p>
  
  <p><strong>Update with Code - Problem with implementation on verification of the hash</strong></p>
  
  <p>Problem is when I use the check on the code I'm trying 
  <code>if (resultHash.Equals(hassPassword))</code>   and it does not match...</p>
  
  <pre><code>    public string BuildVerify()
      {
  
          string password = "";
          string salt = "";
          byte[] result;
  
  
          using (var sha256 = SHA256.Create())
          {
              password = "hovercraft";
  
              // step 1: you can use RNGCryptoServiceProvider for something worth using
              var passwordHashing = new PasswordHashing();
              salt = passwordHashing.CreateRandomSalt();
  
              // step 2
              string hash =
                 Convert.ToBase64String(sha256.ComputeHash(Encoding.UTF8.GetBytes(salt + password)));
  
              // step 3
              result = sha256.ComputeHash(Encoding.UTF8.GetBytes(salt + hash));
  
              // step 4
              for (int i = 0; i &lt; 60000; i++)
              {
                  result =
                   sha256.ComputeHash(Encoding.UTF8.GetBytes(salt + Convert.ToBase64String(result)));
              }
          }
  
  
          // TESTING  VERIFY this works ..
  
          string SaltAndPwd = string.Concat(password, salt);
          SHA256 sha2 = SHA256Managed.Create();
          byte[] buff = sha2.ComputeHash(Encoding.Unicode.GetBytes(SaltAndPwd));
          string resultHash = Convert.ToBase64String(buff);
          string hassPassword = Convert.ToBase64String(result);
  
          if (resultHash.Equals(hassPassword))
          {
              // perfect 
          }
  
  
  
  
          return "";
  
      }
  
  
  public class PasswordHashing
  {
  
      public string CreateRandomSalt()
      {
          string password = "";
          password = HashPassword.CreateSalt(8) + "=";
          password = password.Replace("/", "c");
          return password;
      }
  
  }
  </code></pre>
  
  <p>/// </p>
  
  <pre><code>    public static string CreateSalt(int size)
      {
          RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
  
          byte[] buff = new byte[size];
          rng.GetBytes(buff);
          return Convert.ToBase64String(buff);
      }
  </code></pre>
  
  <p>NEW Question 
    figured that I would go ahead and create a new question , thanks everyone in advance.
  <a href="https://stackoverflow.com/questions/37354199/verification-of-hashing-password-is-not-working-complete-code-shown">Verification of Hashing password is not working</a></p>