Hi author here! if you have any feedback or suggestion, do let me know. you can also drop me a mail – varun@ASPSecurityKit.net ASP Security Kit is my humble attempt to solve membership management problem for applications built on ASP.NET Mvc platform. I have periodically observed that There are many common but essential requirements for most real-world web applications that aren't served well. Like action-based and r…
You say that it "Implements salted password hashing" but you don't mention the details of the method. Which method is it - bcrypt, md5, scrypt, sha1, pbkdf2 or something in-house? Why not say which? I confess that I had to look up "key stretching". Is it usual to do this, and why do you do it?
[0] http://crackstation.net/hashing-security.htm
"Salt ensures that attackers can't use specialized attacks like lookup tables and rainbow tables to crack large collections of hashes quickly, but it doesn't prevent them from running dictionary or brute-force attacks on each hash individually. High-end graphics cards (GPUs) and custom hardware can compute billions of hashes per second, so these attacks are still very effective. To make these attacks less effective, we can use a technique known as key stretching. The idea is to make the hash function very slow, so that even with a fast GPU or custom hardware, dictionary and brute-force attacks are too slow to be worthwhile. The goal is to make the hash function slow enough to impede attacks, but still fast enough to not cause a noticeable delay for the user."