How to sign a JWT using RS256 with RSA private key

I know this post is old, but it took me forever to figure this out, so I thought I would share. To test I created RSA keys using OpenSSL: openssl genrsa -out privateKey.pem 512 openssl rsa -in privateKey.pem -pubout -out publicKey.pem You will need the following 2 nuget packages: https://github.com/dvsekhvalnov/jose-jwt http://www.bouncycastle.org/csharp/ Test Code public static …

Read more

Hashing passwords with MD5 or sha-256 C#

Don’t use a simple hash, or even a salted hash. Use some sort of key-strengthening technique like bcrypt (with a .NET implementation here) or PBKDF2 (with a built-in implementation). Here’s an example using PBKDF2. To generate a key from your password… string password = GetPasswordFromUserInput(); // specify that we want to randomly generate a 20-byte …

Read more

Best practice for hashing passwords – SHA256 or SHA512?

Switching to SHA512 will hardly make your website more secure. You should not write your own password hashing function. Instead, use an existing implementation. SHA256 and SHA512 are message digests, they were never meant to be password-hashing (or key-derivation) functions. (Although a message digest could be used a building block for a KDF, such as …

Read more

Is there a limit on the message size for SHA-256?

There is technically a limit, but it’s quite large. The padding scheme used for SHA-256 requires that the size of the input (in bits) be expressed as a 64-bit number. Therefore, the maximum size is (264-1)/8 bytes ~= 2’091’752 terabytes. That renders the limit almost entirely theoretical, not practical. Most people don’t have the storage …

Read more

How to use sha256 in php5.3.0

Could this be a typo? (two Ps in ppasscode, intended?) $_POST[‘ppasscode’]; I would make sure and do: print_r($_POST); and make sure the data is accurate there, and then echo out what it should look like: echo hash(‘sha256’, $_POST[‘ppasscode’]); Compare this output to what you have in the database (manually). By doing this you’re exploring your …

Read more

How can I compute a SHA-2 (ideally SHA 256 or SHA 512) hash in iOS?

This is what I’m using for SHA1: #import <CommonCrypto/CommonDigest.h> + (NSData *)sha1:(NSData *)data { unsigned char hash[CC_SHA1_DIGEST_LENGTH]; if ( CC_SHA1([data bytes], [data length], hash) ) { NSData *sha1 = [NSData dataWithBytes:hash length:CC_SHA1_DIGEST_LENGTH]; return sha1; } return nil; } Replace CC_SHA1 with CC_SHA256 (or whichever you need), as well as CC_SHA1_DIGEST_LENGTH with CC_SHA256_DIGEST_LENGTH.