SHA1 and MD5 cryptography

Question

how to to both client side and server side encryption of password and then to compare that password with the password which is present in database ? please give some suggestions to create secured log in page.

Sanjay Kumar · Answer

Hi public string Decrypt(string str) { str = str.Replace(  +); string DecryptKey = 2013;[pnuLIT)Y; byte[] byKey = { }; byte[] IV = { 18 52 86 120 144 171 205 239 }; byte[] inputByteArray = new byte[str.Length]; byKey = System.Text.Encoding.UTF8.GetBytes(DecryptKey.Substring(0 8)); DESCryptoServiceProvider des = new DESCryptoServiceProvider(); inputByteArray = Convert.FromBase64String(str.Replace(  +)); MemoryStream ms = new MemoryStream(); CryptoStream cs = new CryptoStream(ms des.CreateDecryptor(byKey IV) CryptoStreamMode.Write); cs.Write(inputByteArray 0 inputByteArray.Length); cs.FlushFinalBlock(); System.Text.Encoding encoding = System.Text.Encoding.UTF8; return encoding.GetString(ms.ToArray()); } string pwd; SqlCommand cmd = new SqlCommand(SELECT UserNamePassword FROM tablename Where UserName=' + TextBox1.Text.Trim() + ' and Password='+pwd(TextBox1.Text.Trim())+'  con); SqlDataAdapter adp = new SqlDataAdapter(cmd); DataTable dt = new DataTable(); adp.Fill(dt); if (dt.Rows.Count > 0) { for (int i = 0; i { pwd = dt.Rows[i][Password].ToString(); dt.Rows[i][Password] = Decrypt(pwd); } }

Sanjay Kumar · Answer

Hi public string Encrypt(string str) { string EncrptKey = 2013;[pnuLIT)X; byte[] byKey = { }; byte[] IV = { 18 52 86 120 144 171 205 239 }; byKey = System.Text.Encoding.UTF8.GetBytes(EncrptKey.Substring(0 8)); DESCryptoServiceProvider des = new DESCryptoServiceProvider(); byte[] inputByteArray = Encoding.UTF8.GetBytes(str); MemoryStream ms = new MemoryStream(); CryptoStream cs = new CryptoStream(ms des.CreateEncryptor(byKey IV) CryptoStreamMode.Write); cs.Write(inputByteArray 0 inputByteArray.Length); cs.FlushFinalBlock(); return Convert.ToBase64String(ms.ToArray()); } u password = Encrypt(txt password .Text.ToString()); cmd.Parameters.AddWithValue(@Password u password );

Jaganathan Bantheswaran · Answer

Hi It is always better to NOT store the password anywhere. Instead you should store passwords' hash value. So when the user submits the password for a very first time. you can create its hash using Javascript algorithm and pass it to the server & store it. Next time when the user is logged in again hash the password & send it only the hash and then in the server compare the hash which is sent from client with the hash which is stored in DB/somewhere. For Javascript algor.. http://www.webtoolkit.info/javascript-sha256.html