title: What Hash Algorithm used by the Asp.net Membership?
body: <p>I'm trying to implement a <strong>custom store for passwords</strong>. Before changing a password, I need to check first whether the password has been used <strong>last 8 times</strong> the user changed the password.</p>
  
  <pre><code>var hashingAlgorithm = ConfigurationManager.AppSettings("MembershipProviderHashAlgorithm");
  var hashedPasswordDetails = pwdHistory.GetRecentPasswordDetails(userName);
  foreach (var passwordDetails_loopVariable in hashedPasswordDetails) 
  {
    passwordDetails = passwordDetails_loopVariable;
    var encodedPassword = pwdEncr
              .EncodePassword(proposedNewPassword, passwordDetails.Salt, hashingAlgorithm);
    var hashedPassword = passwordDetails.HashedPassword;
    if (hashedPassword.Equals(encodedPassword)) //This line always return FALSE.
    {
       return true;               
    }
  }
  return false;
  </code></pre>
  
  <p>The problem I'm having is that the passwords returned from the tables are always different from what I type (event when in clear there are the same). That's because of the <strong>Hashing Algorithm</strong>.</p>
  
  <p>I've tried SHA and SHA1 with no luck. Is there a particular hashing algorithm that ASP.NEt membership uses? I'm using <strong>System.Web.Security.SqlMembershipProvider version 4.0.0.0</strong> </p>
  
  <pre><code>&lt;add key="MembershipProviderHashAlgorithm" value="SHA" /&gt;
  </code></pre>
  
  <p>Thanks for helping.</p>
  
  <h1>EDIT</h1>
  
  <p>Here's part of configuration from the membership section in the <strong>web.config</strong>. Is there a way to tell which algorithm's being used.</p>
  
  <pre><code>&lt;membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15"&gt;
    &lt;providers&gt;
      &lt;clear /&gt;
      &lt;add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider,                  
           System.Web, Version=4.0.0.0, Culture=neutral,                  
           PublicKeyToken=b03f5f7f11d50a3a"
           connectionStringName="myConnectionString"
           ../..
           requiresUniqueEmail="false"
           passwordFormat="Hashed"
           maxInvalidPasswordAttempts="5"
           minRequiredPasswordLength="7"
           passwordAttemptWindow="10"/&gt;
    &lt;/providers&gt;
  &lt;/membership&gt;
  </code></pre>