Confirms which cryptographic and helper components are creatable via Server.CreateObject on this host. Delete this file before public launch.
| Component | ProgID | Result |
|---|---|---|
| UTF-8 encoding | System.Text.UTF8Encoding |
OK |
| ASCII encoding | System.Text.ASCIIEncoding |
OK |
| SHA-256 managed | System.Security.Cryptography.SHA256Managed |
OK |
| SHA-256 CNG | System.Security.Cryptography.SHA256Cng |
FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3 |
| SHA-256 CryptoServiceProvider | System.Security.Cryptography.SHA256CryptoServiceProvider |
FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3 |
| HMAC-SHA-256 | System.Security.Cryptography.HMACSHA256 |
OK |
| Secure RNG | System.Security.Cryptography.RNGCryptoServiceProvider |
OK |
| PBKDF2 (Rfc2898) | System.Security.Cryptography.Rfc2898DeriveBytes |
FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3 |
| Password derive bytes | System.Security.Cryptography.PasswordDeriveBytes |
FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3 |
| MSXML2.ServerXMLHTTP.6.0 | MSXML2.ServerXMLHTTP.6.0 |
OK |
| ADODB.Stream | ADODB.Stream |
OK |
| CDO.Message | CDO.Message |
OK |
| Scripting.FileSystemObject | Scripting.FileSystemObject |
OK |
Computes HMAC-SHA256(key="secret", msg="hello") and verifies the digest is 32 bytes. Copy the hex and verify against any online HMAC calculator to confirm the value.
Result: OK - digest length 32 bytes: 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b [VarType=8209 IsArray=True]
Expected value: 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b (from a reference implementation; treat as informational).
Both variants seed with a string and feed the SHA-256 output back into the next SHA-256 call for 1000 iterations. The raw variant does no normalisation; the DOM-normalised variant round-trips the buffer through MSXML2.DOMDocument bin.hex each round to force a native VT_UI1 SAFEARRAY. Both report the VarType of the first ComputeHash_2 return so you can see the actual byte-array shape .NET marshals on this host. Whichever reports OK is what the production loop in includes/hash.asp Sha256IteratedHex should use.
Raw loop: OK - completed 1000 rounds, final digest eae59c94375826c7a4550abcd630630bc31a21e748e8fe672ee0a14e612b50d0 [VarType=8209 IsArray=True]
DOM-normalised loop: OK - completed 1000 rounds, final digest eae59c94375826c7a4550abcd630630bc31a21e748e8fe672ee0a14e612b50d0 [VarType=8209 IsArray=True]
Each probe isolates one primitive from the production stack (includes/hash.asp). Later probes still run when an earlier one fails so the full state is visible. The first FAIL identifies the failing call. All probes OK means /login.asp should work.
| Probe | Result |
|---|---|
P1 RandomHex(16) |
FAIL err 13: Type mismatch |
P2 HmacSha256Hex(HASH_PEPPER, msg) |
OK digest=53242835c8b8b7ba46201f129480e2e0d4ab1c6600913e67d7a2ce91900c7d16 |
P3 HmacSha256Hex(shortkey, msg) |
OK digest=56ec399e6d353872bd32fb20a1a279d00175448a9cffba7df7ff1a8c1775cf97 |
P4 HashPasswordHmacSha256(plain) |
FAIL err 13: Type mismatch |
P5 HashPassword(plain) |
FAIL err 13: Type mismatch (HASH_ALGO=hmac-sha256-v1) |
P6 VerifyPassword(correct) |
FAIL skipped: P5 produced no hash |
P7 VerifyPassword(wrong) |
FAIL skipped: P5 produced no hash |
HASH_ALGO="pbkdf2-sha256-v1" in includes/config.asp and switch includes/hash.asp to the PBKDF2 path.includes/hash.asp works but is weaker. File a follow-up to register a custom .NET DLL exposing PBKDF2 or bcrypt before public launch.