C# PasswordDeriveBytes: seems that Salt does'nt matter

Question

probably I misunderstood something. The following code produces two equal keys by CryptDeriveKey with two different salt.

That is the console result:

salt1: 21 3e 18 a3 9a 8b 5f

--> Key da 89 ea 3d 91 08 20 98 20 e9 dc 45 d5 97 10 7f 8f 4a 52 15 26 68 ef 83

salt2: 9e db 4c 2b 49 b4 24

--> Key da 89 ea 3d 91 08 20 98 20 e9 dc 45 d5 97 10 7f 8f 4a 52 15 26 68 ef 83

What is my mistake?

using System;
using System.Security.Cryptography;

namespace PasswordDeriveBytes_SaltDoesntMatter
{
    class Program
    {
        // for usage in CreateAndPrintKeyAndSalt
        private static readonly string password = "secret123";
        private static readonly TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider();

        static void Main(string[] args)
        {
            byte[] salt1 = new byte[] { 33, 62, 24, 163, 154, 139, 95 };
            byte[] salt2 = new byte[] { 158, 219, 76, 43, 73, 180, 36 };

            // a TripleDESCryptoServiceProvider-instance for getting an IV

            CreateAndPrintKeyAndSalt("salt1", salt1);
            CreateAndPrintKeyAndSalt("salt2", salt2);
            Console.ReadKey();

        }

        /// <summary>
        /// print the salt and the CryptDeriveKey based on this salt
        /// !! uses the const password and cryptoServiceProvider
        /// </summary>
        /// <param name="saltName">name of the used salt</param>
        /// <param name="salt">the used salt</param>
        /// <param name="cryptoServiceProvider"></param>
        private static void CreateAndPrintKeyAndSalt(string saltName, byte[] salt)
        {
            PasswordDeriveBytes pdb = new PasswordDeriveBytes(password, salt);
            byte[] aKey = pdb.CryptDeriveKey("TripleDES", "SHA1", 192, cryptoServiceProvider.IV);
            Console.WriteLine($"{saltName}: {ByteArrayInHexText(salt)} --> Key {ByteArrayInHexText(aKey)}");
        }    

        /// <summary>
        /// returns a Textstring of each byte in arr in hex-formatting separated by space
        /// </summary>
        /// <param name="arr">the array</param>
        /// <returns>the formatted string</returns>
        public static string ByteArrayInHexText(byte[] arr)
        {
            string s = "";
            foreach (var item in arr)
            {
                s += $" {item:x2}";
            }
            return s.Substring(1);
        }

    }
}

Answer 1

According to this MSDN blog:

When calling CryptDeriveKey, the salt and iteration count that are set on the PasswordDeriveBytes object are not used, so even having different salts and iteration counts will produce the same key given that the rest of the inputs are also the same.