NuGet/NuGetGallery — Issue #133: Use a stronger SHA hash for passwords
Author: Haacked
Created: 2011-10-18 18:14:24+00:00
State: open

The old gallery was written using SHA1 for passwords. We have to retain those for existing accounts we're importing into the new gallery.

But we want new accounts to use SHA512. Also, when you change your password, we should hash the new one to SHA512.

What we can do is add a column to the Users table that identifies the hashing algorithm. That way we know how to verify existing users.

When we create new accounts, we specify "512". When we verify a login, we look at the specified algorthm and use that.