问题描述
您好，
我们有一个ASP.NET Web应用程序，它是在.net framework 4.5版本中构建的。目前正在生产中，该应用程序使用SHA1加密算法。这种算法在MachineKey中设置。应用程序的web.config文件的标记。此应用程序使用Asp.Net Membership概念来维护登录凭据。
由于SHA1算法即将退化，因此我们希望将应用程序从SAH1更新为SHA2。为此，我们设置了HMACSHA256。在MachineKey中应用程序的web.config文件的标记。
使用上述设置将我们的应用程序升级到SHA2后，我们希望旧用户密码（使用SHA1加密并已存在于memebership数据库中）将无法使用SHA2 alogorithm。但它允许较旧的用户登录而无需对先前加密的密码进行任何修改。
能否帮助我们解决与SHA1到SHA2迁移相关的问题：
问题1：是否在MachineKey中进行了更改。应用程序的web.config文件的标签足够/推荐用于此迁移吗？
问题2：由于我们仍然可以使用preiosuly encrpted密码登录应用程序， memebership数据库真的使用web.config文件中设置的SHA2加密？或者我们需要添加一些额外的设置来在memebership数据库级别启用SHA2加密？请给出建议。
请建议是否有最好的方法在Memebership数据库级别启用SHA2加密。
谢谢，
Riz
Hello,
We have one ASP.NET web application which is build in .net framework 4.5 version. Currently on production this application is using SHA1 encrption alogorith.This alogorithm is set in "MachineKey" tag of application's web.config file. This applicaion uses Asp.Net Membership concept for maintaining Login credentials.
As the SHA1 alogorith is on verge of degradation so we want to update our application from SAH1 to SHA2. For this we have set "HMACSHA256" in "MachineKey" tag of application's web.config file.
After upgrading our application to SHA2 with above settings, we expect that the older users passwords(which was encrypted using SHA1 and already present in memebership database) will not work with SHA2 alogorithm. But it allows older users to login without any modification in previously encrypted password.
Can you please help us on following questies related to SHA1 to SHA2 migration:
Question 1 : Does the changes made in "MachineKey" tag of application's web.config file is enough/recommended for this migration?
Question 2 : As we are still able to login into the application using previosuly encrpted passwords, does the memebership database really uses the SHA2 encrption set in web.config file? Or we need to add some additional settings to enable SHA2 encrption on memebership database level? Please advice.
Please suggest if there is any best way to enable SHA2 encrption on Memebership database level.
Thanks,
Riz
推荐答案
这篇关于从SHA1迁移到SAH2 Asp.net 4.5，C＃的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！