Password Storage

MembershipReboot stores passwords hashed. More specifically it uses the PBKDF2 hashing algorithm provided by the Rfc2898DeriveBytes in .NET.

The hashing iteration count defaults to the OWASP recommended value and is determined dynamically (since it's based upon the year). This means this value must be stored per-account, so different users might have a different values.

If desired, the iteration count can be set explicitly either on the SecuritySettings.PasswordHashingIterationCount property on in the config file:

<membershipReboot passwordHashingIterationCount="0" />

Any value less than or equal to 0 will be treated as the dynamically determined default.