Verify Python Passlib generated PBKDF2 SHA512 Hash in .NET
<p>I am migrating a platform which used <a href="http://pythonhosted.org/passlib/" rel="nofollow">Passlib 1.6.2</a> to generate password hashes. The code to encrypt the password is (hash is called with default value for rounds):</p>

<pre><code>from passlib.hash import pbkdf2_sha512 as pb

def hash(cleartext, rounds=10001):
    return pb.encrypt(cleartext, rounds=rounds)
</code></pre>

<p>The output format looks like (for the password "Patient3" (no quotes)):</p>

<pre><code>$pbkdf2-sha512$10001$0dr7v7eWUmptrfW.9z6HkA$w9j9AMVmKAP17OosCqDxDv2hjsvzlLpF8Rra8I7p/b5746rghZ8WrgEjDpvXG5hLz1UeNLzgFa81Drbx2b7.hg
</code></pre>

<p>And "Testing123"</p>

<pre><code>$pbkdf2-sha512$10001$2ZuTslYKAYDQGiPkfA.B8A$ChsEXEjanEToQcPJiuVaKk0Ls3n0YK7gnxsu59rxWOawl/iKgo0XSWyaAfhFV0.Yu3QqfehB4dc7yGGsIW.ARQ
</code></pre>

<p>I can see that represents:</p>

<ul>
<li>Algorithm SHA512 </li>
<li>Iterations 10001</li>
<li>Salt 0dr7v7eWUmptrfW.9z6HkA (possibly)</li>
</ul>

<p>The Passlib algorithm is defined on <a href="https://pythonhosted.org/passlib/lib/passlib.hash.pbkdf2_digest.html#passlib.hash.pbkdf2_sha512" rel="nofollow">their site</a> and reads:</p>

<blockquote>
  <p>All of the pbkdf2 hashes defined by passlib follow the same format, $pbkdf2-digest$rounds$salt$checksum.</p>
  
  <p>$pbkdf2-digest$ is used as the Modular Crypt Format identifier ($pbkdf2-sha256$ in the example).
  digest - this specifies the particular cryptographic hash used in conjunction with HMAC to form PBKDF2âs pseudorandom function for that particular hash (sha256 in the example).
  rounds - the number of iterations that should be performed. this is encoded as a positive decimal number with no zero-padding (6400 in the example).
  salt - this is the adapted base64 encoding of the raw salt bytes passed into the PBKDF2 function.
  checksum - this is the adapted base64 encoding of the raw derived key bytes returned from the PBKDF2 function. Each scheme uses the digest size of its specific hash algorithm (digest) as the size of the raw derived key. This is enlarged by approximately 4/3 by the base64 encoding, resulting in a checksum size of 27, 43, and 86 for each of the respective algorithms listed above.</p>
</blockquote>

<p>I found <a href="https://www.nuget.org/packages/Passlib.NET/" rel="nofollow">passlib.net</a> which looks a bit like an abandoned beta and it uses '$6$' for the algorithm. I could not get it to verify the password. I tried changing the algorithm to $6$ but I suspect that in effect changes the salt as well.</p>

<p>I also tried using <a href="https://sourceforge.net/projects/pwdtknet/" rel="nofollow">PWDTK</a> with various values for salt and hash, but it may have been I was splitting the shadow password incorrectly, or supplying $ in some places where I should not have been.</p>

<p>Is there any way to verify a password against this hash value in .NET? Or another solution which does not involve either a Python proxy or getting users to resupply a password?</p>

<p>The hash is verified by passing the password into the PBKDF HMAC-SHA-256 hash method and then comparing the resulting hash to the saved hash portion, converted back from the Base64 version.</p>

<p>Saved hash to binary, then separate the hash
Convert the password to binary using UTF-8 encoding
PBKDF2,HMAC,SHA-256(toBinary(password, salt, 10001) == hash
Password: "Patient3"</p>

<p>$pbkdf2 - sha512$10001$0dr7v7eWUmptrfW.9z6HkA$w9j9AMVmKAP17OosCqDxDv2hjsvzlLpF8Rra8I7p/b5746rghZ8WrgEjDpvXG5hLz1UeNLzgFa81Drbx2b7.hg</p>

<p>Breaks down to (with the strings converted to standard Base64 (change '.' to '+' and add trailing '=' padding:</p>

<pre><code>pbkdf2 - sha512
10001
0dr7v7eWUmptrfW+9z6HkA==
w9j9AMVmKAP17OosCqDxDv2hjsvzlLpF8Rra8I7p/b5746rghZ8WrgEjDpvXG5hLz1UeNLzgFa81Drbx2b7+hg==
</code></pre>

<p>Decoded to hex:</p>

<pre><code>D1DAFBBFB796526A6DADF5BEF73E8790
C3D8FD00C5662803F5ECEA2C0AA0F10EFDA18ECBF394BA45F11ADAF08EE9FDBE7BE3AAE0859F16AE01230E9BD71B984BCF551E34BCE015AF350EB6F1D9BEFE86
</code></pre>

<p>Which makes sense: 16-byte (128-bit) salt and 64-byte (512-bit) SHA-512 hash.</p>

<p>Converting "Patient3" using UTF-8 to a binary array
Converting the salt from a modified BASE64 encoding to a 16 byte binary array
Using an iteration count od 10001
Feeding this to PBKDF2 using HMAC with SHA-512</p>

<p>I get </p>

<pre><code>C3D8FD00C5662803F5ECEA2C0AA0F10EFDA18ECBF394BA45F11ADAF08EE9FDBE7BE3AAE0859F16AE01230E9BD71B984BCF551E34BCE015AF350EB6F1D9BEFE86
</code></pre>

<p>Which when Base64 encoded, replacing '+' characters with '.' and stripping the trailing '=' characters returns:
   w9j9AMVmKAP17OosCqDxDv2hjsvzlLpF8Rra8I7p/b5746rghZ8WrgEjDpvXG5hLz1UeNLzgFa81Drbx2b7.hg</p>

python .net hash cryptography pbkdf2