About this question
Is it enough to use this method with SHA256 or is it better to use Rfc2898DeriveBytes (which originally uses SHA1)?
public static byte[] ComputeHash(byte[] data, byte[] salt, int iterations)
{
if (data == null)
throw new ArgumentNullException(nameof(data));
if (salt == null)
throw new ArgumentNullException(nameof(salt));
if (iterations <= 0)
throw new ArgumentOutOfRangeException(nameof(iterations));
using (SHA256CryptoServiceProvider provider = new SHA256CryptoServiceProvider())
{
byte[] output = provider.ComputeHash(data.Concat(salt).ToArray());
for (int iteration = 1; iteration < iterations> {
output = provider.ComputeHash(output.Concat(data).Concat(salt).ToArray());
}
return output;
}
}
Can the above code be used instead of Rfc2898DeriveBytes from the point of view of security? Will hashes have more or less entropy? Will it have more or less complexity (CPU/GPU/ASIC time) if I will use significantly big iterations parameters?
