Encrypt and Decrypt password in asp.net mvc

Nikhil Ladva

10y8.7k.NET

Encrypt and Decrypt password in asp.net mvc using To Base64String it's right way and it's secure?

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

Naveenkumar Tholkappian10y ago
Hi,
use SHA encryption method.
while generating password encrypt using SHA and store in the db varchar(max)
When you compare the password just encrypt the user input with SHA and compare directly with the db.
no one can decrypt the password even you database is also have encrypted value
if you forgot the password just re-generate the password and encrypt using SHA . before saving the password send email to user.
+1
Ananth G10y ago
Hi Friend,
Base64String is not Secure. you will use MD5 Encryption(Cryptography)
I give code forMD5 Encryption and Decryption(Cryptography);
passPhrase ,saltValue ,initVector this variables are the key for Encryption and Decryption
public static string passPhrase = "YOUR KEY1";
public static string saltValue = "YOUR KE2";
public static string initVector = "YOUR KE3";
public static string FunForEncrypt(string objText)
{
int keySize = 256;
int passwordIterations = 03;
string hashAlgorithm = "MD5";
byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);
byte[] plainTextBytes = Encoding.UTF8.GetBytes(objText);
PasswordDeriveBytes password = new PasswordDeriveBytes
(
passPhrase,
saltValueBytes,
hashAlgorithm,
passwordIterations
);
byte[] keyBytes = password.GetBytes(keySize / 8);
RijndaelManaged symmetricKey = new RijndaelManaged();
symmetricKey.Mode = CipherMode.CBC;
ICryptoTransform encryptor = symmetricKey.CreateEncryptor
(
keyBytes,
initVectorBytes
);
MemoryStream memoryStream = new MemoryStream();
CryptoStream cryptoStream = new CryptoStream
(
memoryStream,
encryptor,
CryptoStreamMode.Write
);
cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
cryptoStream.FlushFinalBlock();
byte[] cipherTextBytes = memoryStream.ToArray();
memoryStream.Close();
cryptoStream.Close();
string cipherText = Convert.ToBase64String(cipherTextBytes);
cipherText = HttpUtility.UrlEncode(cipherText);
return cipherText;
}
public static string FunForDecrypt(string cipherText)
{
string plainText = "";
int keySize = 256;
int passwordIterations = 03;
string hashAlgorithm = "MD5";

try
{
cipherText = HttpUtility.UrlDecode(cipherText);
byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector);
byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue);
byte[] cipherTextBytes = Convert.FromBase64String(cipherText);
PasswordDeriveBytes password = new PasswordDeriveBytes
(
passPhrase,
saltValueBytes,
hashAlgorithm,
passwordIterations
);
byte[] keyBytes = password.GetBytes(keySize / 8);
RijndaelManaged symmetricKey = new RijndaelManaged();
symmetricKey.Mode = CipherMode.CBC;
ICryptoTransform decryptor = symmetricKey.CreateDecryptor
(
keyBytes,
initVectorBytes
);
MemoryStream memoryStream = new MemoryStream(cipherTextBytes);
CryptoStream cryptoStream = new CryptoStream
(
memoryStream,
decryptor,
CryptoStreamMode.Read
);
byte[] plainTextBytes = new byte[cipherTextBytes.Length];
int decryptedByteCount = cryptoStream.Read
(
plainTextBytes,
0,
plainTextBytes.Length
);
memoryStream.Close();
cryptoStream.Close();
plainText = Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount);
}
catch (Exception ex)
{
plainText = "";
}
return plainText;
}
+1
Vishal Jadav10y ago
Hi,
Nope its not secure.
Because it can be easily known by anyone with good coding practice.
There are a lot way to encrypt / decrypt.
You can use TripleDES, AES so on.
But i suggest you to do it in SQL server.
SQL Server provides few Encryption / Decryption function (in-built).
Keep datatype of password column to varbinary.
I am using below function for Encryption / Decryption
--FORENCRYPTION
ENCRYPTBYPASSPHRASE(MyKeyPhrase','VISHAL')
--FORDECRYPTION
CONVERT(VARCHAR(100),DECRYPTBYPASSPHRASE('MyKeyPhrase','VISHAL')=@INPUT_PASSWORDcollateSQL_Latin1_General_CP1_CS_AS
Above code might help you.
Thanks.
Cheers...
0
Bikesh Srivastava10y ago
http://www.aspsnippets.com/Articles/Encrypt-and-Decrypt-Username-or-Password-stored-in-database-in-ASPNet-using-C-and-VBNet.aspx
0
Nitin Sontakke10y ago
The code given at following link would be useful
http://johnnycoder.com/blog/2008/07/03/c-encryption-decryption-helper-class/
IMPORTANT: Please remember to change the cryptokey variable value and also IV array values.
0
Tejas Trivedi10y ago
Hello Nikhil,

Base64 is encoding technique. The most secure way is to use cryptographic technique like SHA, RSA and AES 128.

Please let me know if more information is required.

Please don't forget to mark as answer if this helps.
0