How Kentico 10 hashes passwords

How Kentico 10 is hasing password?

https://docs.xperience.io/k10/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/setting-the-user-password-format

I saw algorithm as PBKDF2.

I saw default salt to be UserGUID (don't know if it is used as uppercase or lowercase)

I also saw CMSHashString key in web.config

I tried generating password using following links and update password in database but it doesn't work

https://asecuritysite.com/encryption/PBKDF2y

https://neurotechnics.com/tools/pbkdf2-test

I used following settings:

Salt = UserGUID (tried uppercase, lowercase) OR UserGUID + CMSHashString OR CMSHashString

Iterations = 1000

Key Size = 32

What am I doing wrong?

kentico 10 password

Hi Ashutosh,

The best way to write the updated password into the database would be using Kentico API, so it will be generating the hash correctly:

UserInfoProvider.SetPassword(userName, password);

If for whatever reason you'd need to customize the way how password hash is calculated, you can certainly do so, please check out the documentation.

1 votesVote for this answer Mark as a Correct answer

Thanks @Dmitry, but can you please tell how SetPassword is working behind the scenes? How many iterations, what is the key size etc, what salt etc?

0 votesVote for this answer Mark as a Correct answer

Ashutosh,

Kentico is a closed source product, so if you want that information I would recommend contacting support@kentico.com.

You can purchase a license for full source code access as well if needed.

2 votesVote for this answer Mark as a Correct answer