Decoding of Password in ASP.NET

Question

Hi all There is a problem I enrypt password using FormsAuthentication.HashPasswordForStoringInConfigFile Method end successfully encrypt the password but I am facing problem in decryption of that password. help me out.

Raman Ghantiyala · Answer

using System; using System.Data; using System.Data.SqlClient; using System.IO; using System.Security.Cryptography; using System.Text; using System.Windows.Forms; private static readonly byte[] _key = { 0xA1 0xF1 0xA6 0xBB 0xA2 0x5A 0x37 0x6F 0x81 0x2E 0x17 0x41 0x72 0x2C 0x43 0x27 }; private static readonly byte[] _initVector = { 0xE1 0xF1 0xA6 0xBB 0xA9 0x5B 0x31 0x2F 0x81 0x2E 0x17 0x4C 0xA2 0x81 0x53 0x61 }; private static string Decrypt(string Value) { SymmetricAlgorithm mCSP; ICryptoTransform ct = null; MemoryStream ms = null; CryptoStream cs = null; byte[] byt; byte[] _result; mCSP = new RijndaelManaged(); try { mCSP.Key = _key; mCSP.IV = _initVector; ct = mCSP.CreateDecryptor(mCSP.Key mCSP.IV); byt = Convert.FromBase64String(Value); ms = new MemoryStream(); cs = new CryptoStream(ms ct CryptoStreamMode.Write); cs.Write(byt 0 byt.Length); cs.FlushFinalBlock(); cs.Close(); _result = ms.ToArray(); } catch { _result = null; } finally { if (ct != null) ct.Dispose(); if (ms != null) ms.Dispose(); if (cs != null) cs.Dispose(); } return ASCIIEncoding.UTF8.GetString(_result); } private static string Encrypt(string Password) { if (string.IsNullOrEmpty(Password)) return string.Empty; byte[] Value = Encoding.UTF8.GetBytes(Password); SymmetricAlgorithm mCSP = new RijndaelManaged(); mCSP.Key = _key; mCSP.IV = _initVector; using (ICryptoTransform ct = mCSP.CreateEncryptor(mCSP.Key mCSP.IV)) { using (MemoryStream ms = new MemoryStream()) { using (CryptoStream cs = new CryptoStream(ms ct CryptoStreamMode.Write)) { cs.Write(Value 0 Value.Length); cs.FlushFinalBlock(); cs.Close(); return Convert.ToBase64String(ms.ToArray()); } } } } call this string appPassword = Encrypt(dbPassword);

Vulpes · Answer

Notice that the FormsAuthentication.HashPasswordForStoringInConfigFile() method only supports two algorithms SHA1 and MD5 both of which are hashing algorithms (hence the name of the method) providing one way encryption. It does not support symmetric algorithms such as Rijndael which would allow you to decode the password if you knew the key and initialization vector used to encode them in the first place.

Vulpes · Answer

You're not going to be able to decode a password which has been hashed (a form of one-way encryption) because it's the hash that's stored not the password itself. All you can do is to validate a password by checking that the hash it produces is the same as the one that's stored.