SHA1 and MD5 cryptography

Gayatri Pattar

how to to both client side and server side encryption of password and then to compare that password with the password which is present in database ? please give some suggestions to create secured log in page.

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sanjay Kumar13y ago
Hi

public string Decrypt(string str)
{
str = str.Replace(" ", "+");
string DecryptKey = "2013;[pnuLIT)Y";
byte[] byKey = { };
byte[] IV = { 18, 52, 86, 120, 144, 171, 205, 239 };
byte[] inputByteArray = new byte[str.Length];

byKey = System.Text.Encoding.UTF8.GetBytes(DecryptKey.Substring(0, 8));
DESCryptoServiceProvider des = new DESCryptoServiceProvider();
inputByteArray = Convert.FromBase64String(str.Replace(" ", "+"));
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(byKey, IV), CryptoStreamMode.Write);
cs.Write(inputByteArray, 0, inputByteArray.Length);
cs.FlushFinalBlock();
System.Text.Encoding encoding = System.Text.Encoding.UTF8;
return encoding.GetString(ms.ToArray());
}

string pwd;
SqlCommand cmd = new SqlCommand("SELECT UserName,Password FROM tablename Where UserName='" + TextBox1.Text.Trim() + "' and Password='"+pwd(TextBox1.Text.Trim())+"' ", con);
SqlDataAdapter adp = new SqlDataAdapter(cmd);
DataTable dt = new DataTable();
adp.Fill(dt);
if (dt.Rows.Count > 0)
{
for (int i = 0; i < dt.Rows.Count; i++)
{
pwd = dt.Rows[i]["Password"].ToString();
dt.Rows[i]["Password"] = Decrypt(pwd);
}
}
Sanjay Kumar13y ago
Hi

public string Encrypt(string str)
{
string EncrptKey = "2013;[pnuLIT)X";
byte[] byKey = { };
byte[] IV = { 18, 52, 86, 120, 144, 171, 205, 239 };
byKey = System.Text.Encoding.UTF8.GetBytes(EncrptKey.Substring(0, 8));
DESCryptoServiceProvider des = new DESCryptoServiceProvider();
byte[] inputByteArray = Encoding.UTF8.GetBytes(str);
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(byKey, IV), CryptoStreamMode.Write);
cs.Write(inputByteArray, 0, inputByteArray.Length);
cs.FlushFinalBlock();
return Convert.ToBase64String(ms.ToArray());
}

upassword = Encrypt(txtpassword.Text.ToString());

cmd.Parameters.AddWithValue("@Password", upassword);
Jaganathan Bantheswaran13y ago
Hi,

It is always better to NOT store the password anywhere. Instead, you should store passwords' hash value.

So, when the user submits the password for a very first time. you can create its hash using Javascript algorithm and pass it to the server & store it.

Next time, when the user is logged in, again hash the password & send it only the hash, and then in the server, compare the hash which is sent from client with the hash which is stored in DB/somewhere.

For Javascript algor.. http://www.webtoolkit.info/javascript-sha256.html