Encryption in C#

Question

I have stumbled across the below snippet, which encrypts a user's password. This is what i want to do because I don't want to store the user's password in the database without any encryption.

This is working fine for what I want to achieve, but my question is this: how can I un-encrypt it to make sure the value they have entered in the password box matches?

// Hash the password details of the user!
private static string CreatePasswordHash(string pwd, string salt)
{
  string saltAndPwd = string.Concat(pwd, salt);
  string hashedPwd = 
    FormsAuthentication.HashPasswordForStoringInConfigFile(saltAndPwd, "SHA1");
  hashedPwd = string.Concat(hashedPwd, salt);
  return hashedPwd;
}

I call the above like this

string password = CreatePasswordHash(TxtPassword.Text, "1579");

The password then becomes something like this: 566DAB495AD0747B49865F9177E430DFAD63CA281579

So how do I un-encrypt that?

Thank you for your time.

You don't un-encrypt. You hash the password the user entered, with the same salt, and check if the hash is the identical to what you stored in the db. — CodesInChaos
– CodesInChaos, Commented Apr 28, 2012 at 12:49
You cannot (and don't need to) do that. The reason people use hashes is because it is not possible to reverse them — zerkms
– zerkms, Commented Apr 28, 2012 at 12:49
Use Rfc2898DeriveBytes for password hashing, and not HashPasswordForStoringInConfigFile — CodesInChaos
– CodesInChaos, Commented Apr 28, 2012 at 12:57
@CodeInChaos iv just replace haspasswordforstoringinconfigfile with what you have said but it gives me this error system.web.security.formsauthentication does not contain a definition for Rfc2898DeriveBytes ??? — Code Ratchet
– Code Ratchet, Commented Apr 28, 2012 at 13:14

Eric Lippert · Accepted Answer · 2012-04-28 15:12:50Z

8

First off, do not attempt to write your own password storage system. You will get it wrong and build an insecure system. Hire an expert who specializes in this sort of thing, have them write the system, and train you in its correct usage and maintenance.

Second, the whole point of that code is that it is impossible for you to find out the user's password. Their password is none of your business. The point of the salted hash is to build a verification system whereby you do not have to store their password in the first place but you can still verify that they know their password.

To understand how that works, read my four-part series of articles on that subject:

http://blogs.msdn.com/b/ericlippert/archive/tags/salt/

But again do not attempt to do this yourself. Hire an expert with decades of experience in this space if you need to do security work.

answered Apr 28, 2012 at 15:12

Eric Lippert

663k185 gold badges1.3k silver badges2.1k bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

zerkms Over a year ago

"Hire an expert" --- haha, if only every asker on SO hired a professional instead of doing it themselves - then no one would post questions here

Eric Lippert Over a year ago

@zerkms: There are plenty of situations in which "learning as you go" is appropriate. Particularly if the cost of making a mistake is relatively small. Building security systems is not one of them.

Henk Holterman Over a year ago

@zerkms: Use the ASP.NET Membership system and you have hired a whole team of experts. For free. And there is plenty left to ask about how to use it.

zerkms Over a year ago

@Henk Holterman: a) I'm not OP, so I don't need that b) ASP.NET Membership has nothing magic and doesn't automatically protect from anything to call it silver bullet

Nick Butler · Accepted Answer · 2012-04-28 12:50:15Z

5

The point of a hash is that no-one can decrypt it!

When a user attempts a login, you hash the entered password, and then compare the hash with what's in the database. If the hash matches, then the password was correct.

answered Apr 28, 2012 at 12:50

Nick Butler

24.5k4 gold badges51 silver badges72 bronze badges

2 Comments

Lukasz Madon Over a year ago

everybody can decrypt it. The problem is the enormous cost of decryption.

zerkms Over a year ago

@lukas: bruteforce is not a decryption. Decryption always leads to a known result in a known time.

Collectives™ on Stack Overflow

Encryption in C#

2 Answers 2

4 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related