Skip to content

Commit

Permalink
Fix PasswordExtendBytes note: Actually, it's PasswordDeriveBytes.
Browse files Browse the repository at this point in the history
  • Loading branch information
xmcclure committed Feb 10, 2016
1 parent 06a945a commit dab4d91
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions docs/about-mono/releases/4.2.1.md
Original file line number Diff line number Diff line change
Expand Up @@ -205,17 +205,17 @@ Some themes in this release include:

#### System.Security.Cryptography changes ####

`System.Security.Cryptography` contains a compatibility breaking change in 4.2; the `PasswordExtendBytes` class behaves differently.
`System.Security.Cryptography` contains a compatibility breaking change in 4.2; the `PasswordDeriveBytes` class behaves differently.

`PasswordExtendBytes` contains a nonstandard extension of the PBKDF1 algorithm. The extension determines what happens when bytes are requested beyond the hash length, normally not possible with PBKDF1. Before 4.2, Mono used its own custom extension which was incompatible with Microsoft's extension. Starting with 4.2 Mono uses Microsoft's version, which unfortunately means 4.2 is incompatible with 4.0.
`PasswordDeriveBytes` contains a nonstandard extension of the PBKDF1 algorithm. The extension determines what happens when bytes are requested beyond the hash length, normally not possible with PBKDF1. Before 4.2, Mono used its own custom extension which was incompatible with Microsoft's extension. Starting with 4.2 Mono uses Microsoft's version, which unfortunately means 4.2 is incompatible with 4.0.

If your application requires consistent behavior from `PasswordExtendBytes` (for example, if you are using it to generate a decryption key), here is what you should do to ensure compatibility when using Mono 4.2:
If your application requires consistent behavior from `PasswordDeriveBytes` (for example, if you are using it to generate a decryption key), here is what you should do to ensure compatibility when using Mono 4.2:

* If you extract no more bytes than the hash length (for SHA-1, the default, this is 20 bytes) from `PasswordExtendBytes`, the behavior will be identical between all versions of Mono and Microsoft .NET.
* If you need compatibility with applications targeting Microsoft .NET, use the `PasswordExtendBytes` in `System.Security.Cryptography`.
* If you need compatibility with applications targeting Mono 4.0 or previous, you can download [this package](mono-old-passwordextendbytes-4.0.5.1.zip), which contains source for a Mono 4.0-compliant version of `PasswordExtendBytes`.
* If you extract no more bytes than the hash length (for SHA-1, the default, this is 20 bytes) from `PasswordDeriveBytes`, the behavior will be identical between all versions of Mono and Microsoft .NET.
* If you need compatibility with applications targeting Microsoft .NET, use the `PasswordDeriveBytes` in `System.Security.Cryptography`.
* If you need compatibility with applications targeting Mono 4.0 or previous, you can download [this package](mono-old-passwordextendbytes-4.0.5.1.zip), which contains source for a Mono 4.0-compliant version of `PasswordDeriveBytes`.

For new development, we recommend avoiding `PasswordExtendBytes` entirely and using `Rfc2898DeriveBytes`, which is standard-compliant (PBKDF2), more secure, and does not have the compatibility issue.
For new development, we recommend avoiding `PasswordDeriveBytes` entirely and using `Rfc2898DeriveBytes`, which is standard-compliant (PBKDF2), more secure, and does not have the compatibility issue.

### LINQ ###

Expand Down

0 comments on commit dab4d91

Please sign in to comment.