Enryption in WPF

Question

Hi all I am working on a login form where I would like the user passwords to be encrypted I don't have a clue how this works can someone please help. I am using c# to do this. I am not looking for something too tight though I will be working with a 64-bit key for the password. Thanks in advance

Vulpes · Answer

Here's a console app I've written to show how you could use MD5 to hash and then verify a password: using System; using System.Security.Cryptography; using System.Text; class Test { static void Main() { string password = vulpes123; byte[] hash = MD5.Create().ComputeHash(Encoding.UTF8.GetBytes(password)); // now check various passwords for correctness string[] passwords = {avuya456 vulpes789 vulpes123}; foreach(string pwd in passwords) { if (VerifyPassword(hash pwd)) { Console.WriteLine(The correct password is {0} pwd); Console.ReadKey(); return; } } } static bool VerifyPassword(byte[] hash string password) { byte[] pwdHash = MD5.Create().ComputeHash(Encoding.UTF8.GetBytes(password)); for(int i = 0; i { if (pwdHash[i] != hash[i]) return false; } return true; } }

Vulpes · Answer

No hash algorithms only provide one-way encryption. For passwords this is usually all you need. You simply hash the password and store the hash in the database (you don't store the password as well). If someone then enters their password to log in you then compute the hash of the password entered and check it against the hash in the database. If they're the same then the login can proceed. Cryptographic hash algorithms are always such that the chance of a collision (i.e. two passwords having the same hash) are either zero or extremely slim.

Vulpes · Answer

Normally passwords are encrypted using cryptographic hashing algorthms which provide 'one way' encryption. However the weakest (and fastest) of these supported by the .NET Framework is MD5 which has a hash length of 128 bits: http://msdn.microsoft.com/en-us/library/system.security.cryptography.md5.aspx If you're looking for something that has a hash length of only 64 bits then you may have to write it yourself. The DES symmetric algorithm has a 64 bit key length but I'd have thought it would be rather tedious to use for passwords: http://msdn.microsoft.com/en-us/library/system.security.cryptography.des.aspx

Vulpes · Answer

Well the database should contain the hash itself rather than the password. So you need to hash the password entered in the textbox and then compare the result with the hash in the database for the user in question. The code will be on these lines: if (textBox1.Text.Length > 0) { byte[] hash = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(textBox1.Text)); // check it against hash in database }

Avuya Mxoli · Answer

Hi Vulpes I tried it and writing to the database the hash works perfectly now I cant seem to figutre out how to read the hash and check if its correct. I use MVVM so this is really not straight forward but let me try walk you through. I have a login screen which takes the staffNr username and password. I then check the staffNr against ones that are already in the login table in my database via a stored procedure. Then I take the password entered in the text box and from there I dont know how to apply the hash algorithm. In the console app you gave me can you tell me what I should substitute with to make it work. I know I have to get the password from the databasehash it and check it against the hash of the entered password but I just cant get my head around it. I hope you can help me with this.

Vulpes · Answer

That's right Avuya. Incidentally if you're happy with using a hash algorithm I'd use SHA256 rather than MD5 which is much more secure as it uses a 256 bit rather than a 128 bit hash and is still reasonably quick. Just replace MD5 with SHA256 in the two places it occurs in the above program. You can also increase the security of hashing algorithms by hashing multiple times rather than just once which makes 'dictionary' attacks much more time-consuming. However this may be out of place here if you're only looking for moderate security.

Avuya Mxoli · Answer

Oh I see Thank you very much I will implement this and let you know if I come across any hiccups. So from what I understand I will let the user enter their username and password then when I write them to the database I will only write the hash(referencing to your example now) then when they login again I will use the verify password method to check if its correct...

Avuya Mxoli · Answer

Thanks does your example also decrypt the password? Because for this app I'm doing I'm gonna need to be able to decrypt it as well. Basically I want my users to login and I will store their login details in a file. Now I want to be able to read the encrypted password for verification when they login again.

Avuya Mxoli · Answer

Thanks Vulpes for the links but I'm not quite sure how to apply this