Does ComputeHash depend on machine key when calculated?

Question

I'm trying to work out whether values that have been hashed (using the code below) will be different if the machine key value is different. Also, I'd like to know if implementations in other languages (i.e. Java) would produce different results.

string hashedPassword = Convert.ToBase64String(
    new System.Security.Cryptography.SHA1CryptoServiceProvider().ComputeHash(
        System.Text.Encoding.Default.GetBytes(password)));

(I've tried to find an answer on Google but I cannot find anything definitive.)

Answer 1

SHA1CryptoServiceProvider.ComputeHash() will always return the same result for the same input (regardless of which machine it is run on). Any other correctly implemented SHA1-algorithm will also give the same result.

But note that you use System.Text.Encoding.Default.GetBytes(password) to calculate the input. This will not be independent of the machine! You should strongly consider using Encoding.UTF8 instead.

Answer 2

No, and no. The hash algorithm does not use a key, and should be implementation independent. Any platform, any machine key, should get the same output.

Incidentally, if you are doing this to store the password, you should first salt the password (normally pre-pending a number of random bytes) before hashing to prevent a dictionary attack against your database.