03-27-2012, 05:48 PM
Answered here: https://twitter.com/#!/skradel/status/18...9412002816
It's simply sha1(salt | utf16bytes(secret)). Don't blame .NET, blame the lazy MembershipProvider implementation... you could verify this (and investigate other possibly behaviors) by viewing the assembly containing the MembershipProvider in something like ILSpy.
It's simply sha1(salt | utf16bytes(secret)). Don't blame .NET, blame the lazy MembershipProvider implementation... you could verify this (and investigate other possibly behaviors) by viewing the assembly containing the MembershipProvider in something like ILSpy.