encryption - ASP.NET MembershipProvider uses passwordSalt when encrypting -

encryption - ASP.NET MembershipProvider uses passwordSalt when encrypting -

i've question asp.net membership (from .net 2.0), , more way encrypts passwords (when take encrypt them, , not hash then), , way verifies them.

i under impression password salt create sense if take hash passwords, , not encrypt them. and, according msdn documentation on old-school membership providers

passwordsalt nvarchar(128) randomly generated 128-bit value used salt password hashes; stored in base-64-encoded form

but, i've tried changing salt password that's stored encrypted, , validation of password stopped working (the encrypted password not changed, passwordsalt).

so, passwordsalt involved when encrypting/validating password using membership providers (since validation stopped working, i'd is, i've no thought why)?

thanks, , best.

edit: i've tried inputting invalid base64 salt, , got stacktrace, bit weird in opinion, encryption check. looks more hash check. weird thing none of documented on msdn.

[formatexception: invalid length base-64 char array or string.] system.convert.frombase64_decode(char* startinputptr, int32 inputlength, byte* startdestptr, int32 destlength) +14390811 system.convert.frombase64charptr(char* inputptr, int32 inputlength) +162 system.convert.frombase64string(string s) +56 system.web.security.sqlmembershipprovider.encodepassword(string pass, int32 passwordformat, string salt) +148 system.web.security.sqlmembershipprovider.checkpassword(string username, string password, boolean updatelastloginactivitydate, boolean failifnotapproved, string& salt, int32& passwordformat) +245 system.web.security.sqlmembershipprovider.validateuser(string username, string password) +195

i've managed step-into system.web.dll , found cause. apparently, msdn documentation not implementation.

in case encryption selected, apparently utilize salt.

private string encodepassword(string pass, int passwordformat, string salt) { byte[] bin = encoding.unicode.getbytes(pass); byte[] bsalt = convert.frombase64string(salt); byte[] bret = null; ... byte[] ball = new byte[bsalt.length + bin.length]; buffer.blockcopy(bsalt, 0, ball, 0, bsalt.length); buffer.blockcopy(bin, 0, ball, bsalt.length, bin.length); bret = encryptpassword(ball, _legacypasswordcompatibilitymode); }

encryption hash