Password hashing

Question

Hi While saving password in DB doing hashing and saved into DB. While doing unhashing the password getting different hash value. In web.config in  securityCryptographyConfiguration I have defined algorithmType as  System.Security.Cryptography.SHA1Managed  and saltEnabled = true. If I define saltEnabled = false I'm getting same encryption value for all the password. can any one help me how to do that???? Revathi.

Revathi Murugesan · Answer

I have tried with SHA1 method its not working

Revathi Murugesan · Answer

Yes you are correct.what I want is I'm doing only hashing Ex: user want to change the existing password. The entered password value while doing hashing I suppose to get existing hash value which is stored against the user password. But I'm getting different value everytime while doing hashing. For that i'm using following code in web.config. securityCryptographyConfiguration > hashProviders > add name =  CapMonHashProvider  type =  Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.HashAlgorithmProvider Microsoft.Practices.EnterpriseLibrary.Security.Cryptography Version=5.0.414.0 Culture=neutral PublicKeyToken=31bf3856ad364e35  algorithmType =  System.Security.Cryptography.SHA1Managed mscorlib System.Core Version=3.5.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089  saltEnabled = true  /> hashProviders > securityCryptographyConfiguration > can you tel me which algorithm type I should use.

Andrew Fenster · Answer

I just wanted to point out that there is no unhashing. Hashing is a one way operation. After something is hashed you can't ever decrypt it. If someone forgets their password you cannot unhash their password and send it to them. All you can do is allow them to pick a new password. If you want to unhash you should be using encryption not hashing.

Muralidharan Deenathayalan · Answer

Please check the below links would help you. http://www.codeproject.com/KB/web-security/encrypt.aspx http://madskristensen.net.web7.reliabledomainspace.com/post/Simple-and-efficient-password-encryption-in-NET.aspx http://www.ratajik.com/CreateNetPassword/

Abhimanyu K Vatsa · Answer

Use this scenario:- You can place the chcekbox to select either SHA1 or MD5. If you wish to use one then edit the code line FormsAuthentication.HashPasswordForStoringInConfigFile(password.Text SHA1 or MD5); void Cancel_Click(object sender EventArgs e) { userName.Text = ; password.Text = ; repeatPassword.Text = ; result.Text = ; } void HashPassword_Click(object sender EventArgs e) { if (Page.IsValid) { string hashMethod = ; if (sha1.Checked) { hashMethod = SHA1; } else { hashMethod = MD5; } string hashedPassword = FormsAuthentication.HashPasswordForStoringInConfigFile(password.Text hashMethod); result.Text= + + ; } else { result.Text = There was an error on the page.; } } Hope this helps you.

Jaganathan Bantheswaran · Answer

Hi A good Article here . Surely you will get another idea instead of hashing.