Hashing Passwords For Commerce Server

This post generally applies to Commerce Server 2007.

Initially labouring under the impression that CS2k7 used SHA1 or SHA256 (depending on which version is installed)...

• SHA256 Class: http://msdn.microsoft.com/en-us/library/system.security.cryptography.sha256.aspx
• How to has passwords: http://msdn.microsoft.com/en-us/library/aa545602(CS.70).aspx
• The problem with Microsoft's example encryption code: http://www.babel-lutefisk.net/2007/11/commerce-server-2007-and-password.html

I then learnt that we were, in fact, using MD5...

• http://msdn.microsoft.com/en-us/library/ms955699(CS.70).aspx

For those who want to know, MD5 is old, SHAn is newer. I believe CNG is the newest mechanism, but is not yet used by CS...

• http://msdn.microsoft.com/en-us/library/cc488019.aspx