SHA1 and MD5 cryptography

Question

how to to both client side and server side encryption of password and then to compare that password with the password which is present in database ? please give some suggestions to create secured log in page.

Sanjay Kumar · Answer

Hi public string Decrypt(string str) { str = str.Replace(" ", "+"); string DecryptKey = "2013;[pnuLIT)Y"; byte[] byKey = { }; byte[] IV = { 18, 52, 86, 120, 144, 171, 205, 239 }; byte[] inputByteArray = new byte[str.Length]; byKey = System.Text.Encoding.UTF8.GetBytes(DecryptKey.Substring(0, 8)); DESCryptoServiceProvider des = new DESCryptoServiceProvider(); inputByteArray = Convert.FromBase64String(str.Replace(" ", "+")); MemoryStream ms = new MemoryStream(); CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write); cs.Write(inputByteArray, 0, inputByteArray.Length); cs.FlushFinalBlock(); System.Text.Encoding encoding = System.Text.Encoding.UTF8; return encoding.GetString(ms.ToArray()); } string pwd; SqlCommand cmd = new SqlCommand("SELECT UserName,Password FROM tablename Where UserName='" + TextBox1.Text.Trim() + "' and Password='"+pwd(TextBox1.Text.Trim())+"' ", con); SqlDataAdapter adp = new SqlDataAdapter(cmd); DataTable dt = new DataTable(); adp.Fill(dt); if (dt.Rows.Count > 0) { for (int i = 0; i { pwd = dt.Rows[i]["Password"].ToString(); dt.Rows[i]["Password"] = Decrypt(pwd); } }

Sanjay Kumar · Answer

Hi public string Encrypt(string str) { string EncrptKey = "2013;[pnuLIT)X"; byte[] byKey = { }; byte[] IV = { 18, 52, 86, 120, 144, 171, 205, 239 }; byKey = System.Text.Encoding.UTF8.GetBytes(EncrptKey.Substring(0, 8)); DESCryptoServiceProvider des = new DESCryptoServiceProvider(); byte[] inputByteArray = Encoding.UTF8.GetBytes(str); MemoryStream ms = new MemoryStream(); CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write); cs.Write(inputByteArray, 0, inputByteArray.Length); cs.FlushFinalBlock(); return Convert.ToBase64String(ms.ToArray()); } u password = Encrypt(txt password .Text.ToString()); cmd.Parameters.AddWithValue("@Password", u password );

Jaganathan Bantheswaran · Answer

Hi, It is always better to NOT store the password anywhere. Instead, you should store passwords' hash value. So, when the user submits the password for a very first time. you can create its hash using Javascript algorithm and pass it to the server & store it. Next time, when the user is logged in, again hash the password & send it only the hash, and then in the server, compare the hash which is sent from client with the hash which is stored in DB/somewhere. For Javascript algor.. http://www.webtoolkit.info/javascript-sha256.html

SHA1 and MD5 cryptography

Answers (3)