C# hash password create salt question

Question

If I create salt by using something like this:

public class User
    {
        private const int Hash_Salt_Length = 8;
        private byte[] saltBytes = new byte[Hash_Salt_Length];


        public User()
        {
            RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
            rng.GetNonZeroBytes(saltBytes);     
        }
        ....

}

The saltBytes bytes array will be different for each session (restart the application). How can I check password to allow user login our application?

Answer 1

You need to store the salt in the database, along with the password hash.

Note that you shouldn't be calling GetNonZeroBytes, as that provides less randomness.

Answer 2

If the salt changes each time the application restarts, you'd have to store it in the database (on the user record).

Answer 3

The salt is a static thing that you generate when you create you user record, and you store it along with the user ID and the hash of the password + salt.

When the user tries to logon, you use the ID to lookup the salt, combine that with their password, hash it and compare to the stored hash. If they match, they're in.

The salt exists so that an attacker with access to your security database cannot pre-prepare a database of password -> hash mappings, and then perform simple reverse lookups to try to determine passwords.