Skip to content

Compute a salted system hash

Issues a salted, time-stamped identity credential that a caller attaches to a secure-setting or crypto-configuration request. The embedded timestamp is what a later lifetime check validates.

This credential represents a claimed identity for the named system — it is not proof of possession or one-time-use, since the hash is derivable from public inputs (see Security and authorization). The later lifetime check in De-salt and validate credential lifetime verifies only that the credential is fresh; comparing the recovered hash against an authorized identity is the external validator's own responsibility.

Field Value
Operation ID OP-SH-01
Trigger Direct call, or internal delegation from Get the current application's system hash.
Inputs type (SystemType), systemName (string)
Outputs Salted hash string (~120 characters)
Primary components SystemHashService.ComputeHash
Entry point src/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SystemHashService.cs

Steps

  1. Compute the deterministic identity hash for type and systemName (BR-SH-01, BR-SH-02):
  2. Build the identity string "{systemName}-{(int)type}", using the SystemType enum's integer ordinal, not its name.
  3. Encode the identity string as UTF-16LE bytes (Encoding.Unicode.GetBytes).
  4. Compute the SHA-256 digest of those bytes.
  5. Base64-encode the digest (44 characters) and return it.

See Compute the identity hash for the full step-by-step detail of this delegation.

Origin: Step 1 is implemented in Compute the identity hash and executed on behalf of this operation. 2. Construct a salting SaltShaker pre-populated with the hex-encoded parts of the current host-local time (DateTime.Now, millisecond precision) (BR-SH-03). - Sub-steps embedded from SAIF.NetCore.HashUtil: - Chain to the parameterless constructor, which creates an independent System.Random instance used later by SaltHash for insertion positions and pad characters — this Random instance is separate from, and unrelated to, the embedded create-date timestamp. - Create the _dateParts dictionary and, for each date part, format the create date with the current culture and hex-encode it, inserting entries in this order: Minute ("mm"), Year ("yyyy"), Day ("dd"), Millisecond ("fff"), Second ("ss"), Hour ("HH", 24-hour), Month ("MM").

 > **Origin**: The sub-steps above are implemented in [Construct a salting SaltShaker](../../saif-netcore-hashutil/operations/op-hu-01-construct-salting-saltshaker.md) (`SAIF.NetCore.HashUtil`) and executed on behalf of this operation.
  1. Salt the identity hash by inserting the hex-encoded date parts at pseudo-random positions within the hash string (BR-SH-04).

  2. Sub-steps embedded from SAIF.NetCore.HashUtil:

    • For each date part, in order Minute, Year, Day, Millisecond, Second, Hour, Month: pick a random insertion index in [0, currentLength) using the SaltShaker's own Random instance, pick a random pad character in 'A'–'Y', insert the hex-encoded part at the chosen index, and append the zero-padded index, the pad character, and the new body length to a 42-character location map.
    • Return the concatenation of the 42-character location map and the fully salted hash body.

    Origin: The sub-steps above are implemented in Salt a system hash (SAIF.NetCore.HashUtil) and executed on behalf of this operation. 4. Return the salted string as the credential. - Because the insertion positions and pad characters are chosen independently at random on every call, and the embedded timestamp also typically differs between calls, two calls with identical type/systemName arguments normally return different strings — but this is not a guaranteed-unique/collision-free property (BR-SH-04).

Process flow

The following diagram shows the credential-issuance path — computing the identity hash and salting it with the current timestamp — and stops at returning the credential, before any lifetime check or external identity comparison occurs.

flowchart TD
    Start([Caller requests a credential]) --> Identity[Compute identity hash]
    Identity --> SaltConstruct[Construct salting SaltShaker with DateTime.Now]
    SaltConstruct --> SaltApply[Interleave date parts into hash]
    SaltApply --> Return([Return salted credential])

Failure and edge-case behavior

  • No input validation is performed on systemName; a null or empty value is concatenated into the identity string as-is and hashed without error.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • src/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SAIF.NetCore.SystemHash/SystemHashService.cs
  • src/SAIF.NetCore.HashUtil/SAIF.NetCore.HashUtil/SaltShaker.cs