The most common way to hash passwords for storage in .NET is using PBKDF2 via the Rfc2898DeriveBytes class. Actually, you might be doing it using System.Web.Helpers.Crypto, which internally uses the aforementioned class.
The Rfc2898DeriveBytes class has been around since (I think) .NET 2.0 and it always uses HMAC-SHA1 internally. On the other hand, the Crypto class – which is convenient because it returns the final base 64 string – uses a fixed iteration count of 1000. By now we should be using at least HMAC-SHA256 and 80K+ iterations on PBKDF2! It’s worth pointing that there are open source versions that allow us to change the iteration count and try to select the appropriate number of iterations accordingly to the current year.
As part of ASP.NET 5 development there is a new KeyDerivation class which includes a method for PBKDF2 that allows us to customize the HMAC and iteration count. The HMAC options are still a fixed enum, but at least HMAC-SHA256 and –SHA512 are available. Similar to System.Web’s Crypto class, ASP.NET 5 Identity includes a new PasswordHasher class that wraps KeyDerivation in a convenient way. It always uses HMAC-SHA256 but this time the iteration count is configurable.
Despite being on the DataProtection repository, these new key-derivation classes are available on a dedicated, self-contained package (still on pre-release). Let’s wait for the final version!
More info on ASP.NET documentation.
Luís Gonçalves 