[RESOLVED] PasswordDeriveBytes warning

[jmcilhinney]

It seems relatively straightforward to me. When a user registers you create a key generator with the password, the length of the salt you want and the number of iterations to perform, then save the generated salt and key to the database:

Private Sub registerButton_Click(sender As System.Object, e As System.EventArgs) Handles registerButton.Click
    Dim salt As Byte()
    Dim key As Byte()
 
    Register(passwordTextBox.Text, salt, key)
 
    'Save salt and key to database.
End Sub
 
Private Sub Register(password As String, ByRef salt As Byte(), ByRef key As Byte())
    'Create a key generator for the password with a 16-byte salt value that uses 10 iterations.
    Using generator As New Rfc2898DeriveBytes(password, 16, 10)
        'Get the generated salt.
        salt = generator.Salt
 
        'Get a 32-byte key.
        key = generator.GetBytes(32)
    End Using
End Sub

When the user logs on you get the salt and the key from that database, generate a key from the provided password and salt and see if it matches the stored value:

Private Sub logonButton_Click(sender As System.Object, e As System.EventArgs) Handles logonButton.Click
    'Get salt and key from database.
    Dim salt As Byte()
    Dim key As Byte()
 
    If Logon(passwordTextBox.Text, salt, key) Then
        'The logon was successful.
    End If
End Sub
 
Private Function Logon(password As String, salt As Byte(), expectedKey As Byte()) As Boolean
    'Create a key generator for the password with the specified salt value that uses 10 iterations.
    Using generator As New Rfc2898DeriveBytes(password, salt, 10)
        'Get a 32-byte key.
        Dim actualKey = generator.GetBytes(32)
 
        'Compare the actualKey to the expectedKey.
        For i = 0 To actualKey.GetUpperBound(0)
            If actualKey(i) <> expectedKey(i) Then
                'No match
                Return False
            End If
        Next
 
        'Match found
        Return True
    End Using
End Function