Re: How is .net generating extra bits in MD5?

From: Shawn Farkas [MS] (shawnfa_at_online.microsoft.com)
Date: 01/25/05 

Date: Tue, 25 Jan 2005 22:18:39 GMT

Hi Valery,

PasswordDeriveBytes::CryptDeriveKey() uses the CAPI CryptDeriveKey under
the cover, however Pete is using PasswordDeriveBytes::GetBytes() which
actually uses PBKDF1 to do its work.

-Shawn
http://blogs.msdn.com/shawnfa
--
This posting is provided "AS IS" with no warranties, and confers no rights.
 

Note:
For the benefit of the community-at-large, all responses to this message
are best directed to the newsgroup/thread from which they originated.
--------------------
> From: "Valery Pryamikov" <Valery@nospam.harper.no>
> References: <1106337228.327388.91720@z14g2000cwz.googlegroups.com>
> Subject: Re: How is .net generating extra bits in MD5?
> Date: Fri, 21 Jan 2005 23:25:58 +0100
> Lines: 43
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> X-RFC2646: Format=Flowed; Original
> Message-ID: <eRreufAAFHA.3836@tk2msftngp13.phx.gbl>
> Newsgroups: microsoft.public.dotnet.security
> NNTP-Posting-Host: 47.80-202-17.nextgentel.com 80.202.17.47
> Path:
cpmsftngxa10.phx.gbl!TK2MSFTNGXA06.phx.gbl!cpmsftngxa06.phx.gbl!TK2MSFTNGP08
phx.gbl!tk2msftngp13.phx.gbl
> Xref: cpmsftngxa10.phx.gbl microsoft.public.dotnet.security:8814
> X-Tomcat-NG: microsoft.public.dotnet.security
>
> Hi,
> PasswordDeriveBytes does the same thing as CryptDeriveKey and actually
> involves 3 hashes:
>
> K' = H(password)
> K = H(K' XOR {0x36}) || H(K' XOR {0x5C})
> where H is hash algorithm, || - concatenation and K' is intermediate key.
>
> -Valery.
> http://www.harper.no/valery
>
> "Pete" <jpeteb@hotmail.com> wrote in message
> news:1106337228.327388.91720@z14g2000cwz.googlegroups.com...
> > Hi,
> >
> > I have a piece of .net code I am trying to understand. It creates a MD5
> > hash then requests 256 bits from the hash, where MD5 only generates 128
> > bits. I've looked at the hash with another non-.net piece of code and
> > the first 128 bits match up correctly. How is Microsoft creating the
> > second 128 bits? I cannot seem to figure that out. Here is a code
> > fragment in C#:
> >
> > string passPhrase; // password string
> > string saltValue; // salt string
> > string hashAlgorithm; // set to "MD5"
> > int passwordIterations; // set to 2
> > int keySize; // set to 256
> >
> > byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
> > byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);
> >
> > PasswordDeriveBytes password = new PasswordDeriveBytes(
> > passPhrase,
> > saltValueBytes,
> > hashAlgorithm,
> > passwordIterations);
> > byte[] keyBytes = password.GetBytes(keySize / 8);
> >
> >
> > TIA for any help.
> >
>
>
>