C#使用 Salt + Hash 来为密码加密

protected void ButtonRegister_Click(object sender, EventArgs e) 
{ 
 string username = TextBoxUserName.Text; 
 string password = TextBoxPassword.Text; 
 // random salt 
 string salt = Guid.NewGuid().ToString();
 // random salt 
 // you can also use RNGCryptoServiceProvider class  
 //System.Security.Cryptography.RNGCryptoServiceProvider rng = new System.Security.Cryptography.RNGCryptoServiceProvider(); 
 //byte[] saltBytes = new byte[36]; 
 //rng.GetBytes(saltBytes); 
 //string salt = Convert.ToBase64String(saltBytes); 
 //string salt = ToHexString(saltBytes); 
 byte[] passwordAndSaltBytes = System.Text.Encoding.UTF8.GetBytes(password + salt);  
 byte[] hashBytes = new System.Security.Cryptography.SHA256Managed().ComputeHash(passwordAndSaltBytes);
 string hashString = Convert.ToBase64String(hashBytes);
 // you can also use ToHexString to convert byte[] to string 
 //string hashString = ToHexString(hashBytes); 
 var db = new TestEntities(); 
 usercredential newRecord = usercredential.Createusercredential(username, hashString, salt); 
 db.usercredentials.AddObject(newRecord); 
 db.SaveChanges(); 
}
string ToHexString(byte[] bytes) 
{ 
 var hex = new StringBuilder(); 
 foreach (byte b in bytes) 
 { 
 hex.AppendFormat("{0:x2}", b); 
 } 
 return hex.ToString(); 
} 

protected void ButtonSignIn_Click(object sender, EventArgs e) 
{ 
 string username = TextBoxUserName.Text; 
 string password = TextBoxPassword.Text;
 var db = new TestEntities(); 
 usercredential record = db.usercredentials.Where(x => string.Compare(x.UserName, username, true) == 0).FirstOrDefault(); 
 if (record == default(usercredential)) 
 { 
 throw new ApplicationException("invalid user name and password"); 
 }
 string salt = record.Salt; 
 byte[] passwordAndSaltBytes = System.Text.Encoding.UTF8.GetBytes(password + salt); 
 byte[] hashBytes = new System.Security.Cryptography.SHA256Managed().ComputeHash(passwordAndSaltBytes); 
 string hashString = Convert.ToBase64String(hashBytes);

 if (hashString == record.PasswordHash) 
 { 
 // user login successfully 
 } 
 else 
 { 
 throw new ApplicationException("invalid user name and password"); 
 } 
}