0

I have spent all day trying to make a usable pbkdf2 password for the mosquitto-auth-plug. This program sets it up exactly the way it should be stored in the mysql database. I have a password hash generated by the program that comes with auth-plug and mosquitto loves it. I just can't replicate it in c#, if anyone can help please let me know.

public string CreatePasswordHash(string password)
    {

        var salt = GenerateRandomSalt();    
        var iterationCount = GetIterationCount();
        var hashValue = GenerateHashValue(password, salt, iterationCount);
        string result = "PBKDF2$sha256$" + iterationCount + "$" + Convert.ToBase64String(salt) + "$" + Convert.ToBase64String(hashValue);
        return result;

    }

    private int GetIterationCount()
    {
        return 901;
    }

    private static byte[] GenerateRandomSalt()
    {
        var csprng = new RNGCryptoServiceProvider();
        var salt = new byte[SaltByteLength];
        csprng.GetBytes(salt);
        return salt;
        //return GetLetter();
    }

    private static byte[] GenerateHashValue(string password, byte[] salt, int iterationCount)
    {
         byte[] hashValue;
         var valueToHash = string.IsNullOrEmpty(password) ? string.Empty : password;
         using (var pbkdf2 = new Rfc2898DeriveBytes(valueToHash, salt, iterationCount))
         {
             hashValue = pbkdf2.GetBytes(DerivedKeyLength);
         }
        return hashValue;


    }

---EDIT-----

Rfc2898DeriveBytes states -- Implements password-based key derivation functionality, PBKDF2, by using psuedo-random number generator based on HMACSHA1.

The program/auth-plug seems to be using sha256 is there a c# PBKDF2 that uses this.

3
  • I don't fully understand your question. You do have an external program (not shown in the question) which creates a PBKDF2 hash from a password and stores the hash in the db. Then you get a password from a user and try to create the same hash as in the database (via the code you posted above). Die I understand that correctly?
    – mat
    Jul 3, 2017 at 8:37
  • Yes the auth-plugin for mosquitto mqtt broker has it's own password checking function that is supposed to use PBKDF2. I have a program from them that creates a hash that I manually put in the database and it works. However when I try to duplicate the process in c# my hash isn't correct. Their program is in c and I need my users to be able to create/change their password in a mobile app written in c#
    – Mark
    Jul 3, 2017 at 15:31
  • Link to the plug in if that helps .... github.com/jpmens/mosquitto-auth-plug
    – Mark
    Jul 3, 2017 at 15:37

2 Answers 2

0

As you have already stated in your edit, the problem appears to be the difference in hash functions used between the mosquitto plugin (which only supports SHA-256, according to the source code) and the .NET implementation (which can only do SHA-1).

A more flexible implementation of PBKDF2 is available in BouncyCastle, a more lightweight implementation can be found here. If you are not satisfied with those two, you could chose to implemnt PBKDF2 yourself, which is not really hard.

0

Well it appears there really wasn't an answer and there weren't many who had tried. I figured out the problem and after contacting the mosquitto-auth-plug author he felt it would be good for us to add my solution to his contrib folder on the plugins github repo.

So now if you need a c# hashing algorithm for mosquitto-auth-plug just go to the repo in git here

https://github.com/jpmens/mosquitto-auth-plug/tree/master/contrib/C%23

and follow my instructions --- Let me know if you have any problems

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.