advantage of md5+salt in asp.net application

I have a question about how to use md5 and a salt to secure a password, I have already made many searches for answers to my questions.

An article I saw was using c# to convert password to md5 string, something like this:

public static string md5(string <b>sPassword</b>)
{
    System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider();
    byte[] bs = System.Text.Encoding.UTF8.GetBytes(sPassword);
    bs = x.ComputeHash(bs);
    System.Text.StringBuilder s = new System.Text.StringBuilder();
    foreach (byte b in bs)
    {
        s.Append(b.ToString("x2").ToLower());
    }
        return s.ToString();
    }
}

1. My question is the above code seems server side is its mean password traveling over internet in plain text doesn't it create any security issue or it does not matter i don't know (may be i am getting it wrong way or i am not clear about password security concept) ?

2. What i have done in my project is i am creating a secure password at client side with java script md5.js file and with user's entered password before posting login.aspx form back to server then at server side i am fetching hashed password of user from database(which was stored at the time of registration of user with same technique) and match both client side and server side hashed passwords if they match user authenticated. i don't know weather i am doing it right way or not please let me know right way if i am wrong .

3. Now the problem is i want to use SALT with the md5 (md5+salt) to make password more secure with Randomly generated salt string. how to do this should i make a random salt string at server side while page_load of login page and then send it to client side and at client mix this salt with user password before posting form.开发者_StackOverflow after post again mix the password(fetched from database) with same random string and match both password to authenticate.

4. One more question, at the time of registration of a new user, where should originally user entered password convert in md5 at client side or server side if at server side then password should post to server as it is means original password.(like "MyPassword")

---

Firstly you should be aware that SHA1 is now industry standard, but it's still fine to use Md5 for most things.

Secondly to stop plain text transmitting over the public network, use an HTTPS connection (you may need to purchase a certificate from a recognised vendor).

Also if this is for a user system, consider using ASP.net's membership system. It does this all for you and has been extensively reviewed.

The basic flow of what you describe anyway would be:

• User enters password
• Server generates random salt
• Hashed password = md5(salt + raw password)
• Store hashed password and salt along side username, dispose of raw
• When user logs in, find the associated salt with the username login is being attempted for.
• Is password valid = does md5(salt + entered password) = store hash?
• If they do, login

Once they have logged in, it might be a good idea also to regenerate a new salt and hash. Also the md5() should be applied to the password thousands of times before storing to make a dictionary attack uneconomical.

There are plenty of resources out there that go into this in more detail.

Good luck!