2 equal byte[] does not return true

Question

I'm trying to verify someone's password when logging in.

I take the entered password and retrieve the users saved hashed password and password salt.

Then I hash the entered password with the saved salt to see if it's equal to the saved password.

However, even though the byte[] storedPassword is exactly like the byte[] enteredPassword, it doesn't return true in a bool and therefore doesn't verify the user. Why is that?

public static bool VerifyPassword(byte[] newPassword, byte[] storedPassword, byte[] storedSalt)
    {
        byte[] password = CreateHashedPassword(newPassword, storedSalt);

        if (!password.Equals(storedPassword))
            return false;

        return true;
    }

Answer 1

Equals does not byte compare the two byte[] arrays. You have to compare each byte in the two arrays yourself.

Answer 2

You have to iterate over the elements of an array to see if they are the same. Using the .Equals() method only tells you if two variables reference the same array.

        for (int i = 0; i < password.Length; i++)
            if (password[i] != storedPassword[i])
                return false;
        return true;

Answer 3

You should compare each byte of your arrays, you can make a simple loop, or use the SequenceEqual Linq Extension method if available:

public static bool VerifyPassword(byte[] newPassword, byte[] storedPassword,
                                  byte[] storedSalt)
{
    byte[] password = CreateHashedPassword(newPassword, storedSalt);

    return password.SequenceEqual(storedPassword);
}

Answer 4

The System.Array.Equals method appears to test only for object identity, just like object.Equals.

You have to write a loop and compare the elements yourself.

Answer 5

Array.Equals is like object.Equals, it tests for instance equality, not for "value" equality.

You need something like:

public static boolean ByteArrayEquals(byte[] a, byte[] b) {
  if (a.Length != b.Length)
    return false;
  for (int i = 0; i < a.Length; i++)
  {
      if (a[i] != b[i])
        return false;
  }
  return true;
}