Encrypt and Decrypt password in asp.net mvc

Question

Encrypt and Decrypt password in asp.net mvc using To Base64String  it's right way and it's secure?

Naveenkumar Tholkappian · Answer

Hi, use SHA encryption method. while generating password encrypt using SHA and store in the db varchar(max) When you compare the password just encrypt the user input with SHA and compare directly with the db. no one can decrypt the password even you database is also have encrypted value if you forgot the password just re-generate the password and encrypt using SHA . before saving the password send email to user.

Ananth G · Answer

Hi Friend, Base64String is not Secure. you will use MD5 Encryption(Cryptography) I give code forMD5 Encryption and Decryption(Cryptography); passPhrase ,saltValue ,initVector this variables are the key for Encryption and Decryption public static string passPhrase = "YOUR KEY1"; public static string saltValue = "YOUR KE2"; public static string initVector = "YOUR KE3"; public static string FunForEncrypt(string objText) { int keySize = 256; int passwordIterations = 03; string hashAlgorithm = "MD5"; byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector); byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue); byte[] plainTextBytes = Encoding.UTF8.GetBytes(objText); PasswordDeriveBytes password = new PasswordDeriveBytes ( passPhrase, saltValueBytes, hashAlgorithm, passwordIterations ); byte[] keyBytes = password.GetBytes(keySize / 8); RijndaelManaged symmetricKey = new RijndaelManaged(); symmetricKey.Mode = CipherMode.CBC; ICryptoTransform encryptor = symmetricKey.CreateEncryptor ( keyBytes, initVectorBytes ); MemoryStream memoryStream = new MemoryStream(); CryptoStream cryptoStream = new CryptoStream ( memoryStream, encryptor, CryptoStreamMode.Write ); cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length); cryptoStream.FlushFinalBlock(); byte[] cipherTextBytes = memoryStream.ToArray(); memoryStream.Close(); cryptoStream.Close(); string cipherText = Convert.ToBase64String(cipherTextBytes); cipherText = HttpUtility.UrlEncode(cipherText); return cipherText; } public static string FunForDecrypt(string cipherText) { string plainText = ""; int keySize = 256; int passwordIterations = 03; string hashAlgorithm = "MD5"; try { cipherText = HttpUtility.UrlDecode(cipherText); byte[] initVectorBytes = Encoding.ASCII.GetBytes(initVector); byte[] saltValueBytes = Encoding.ASCII.GetBytes(saltValue); byte[] cipherTextBytes = Convert.FromBase64String(cipherText); PasswordDeriveBytes password = new PasswordDeriveBytes ( passPhrase, saltValueBytes, hashAlgorithm, passwordIterations ); byte[] keyBytes = password.GetBytes(keySize / 8); RijndaelManaged symmetricKey = new RijndaelManaged(); symmetricKey.Mode = CipherMode.CBC; ICryptoTransform decryptor = symmetricKey.CreateDecryptor ( keyBytes, initVectorBytes ); MemoryStream memoryStream = new MemoryStream(cipherTextBytes); CryptoStream cryptoStream = new CryptoStream ( memoryStream, decryptor, CryptoStreamMode.Read ); byte[] plainTextBytes = new byte[cipherTextBytes.Length]; int decryptedByteCount = cryptoStream.Read ( plainTextBytes, 0, plainTextBytes.Length ); memoryStream.Close(); cryptoStream.Close(); plainText = Encoding.UTF8.GetString(plainTextBytes, 0, decryptedByteCount); } catch (Exception ex) { plainText = ""; } return plainText; }

Vishal Jadav · Answer

Hi, Nope its not secure. Because it can be easily known by anyone with good coding practice. There are a lot way to encrypt / decrypt. You can use TripleDES, AES so on. But i suggest you to do it in SQL server. SQL Server provides few Encryption / Decryption function (in-built). Keep datatype of password column to varbinary. I am using below function for Encryption / Decryption --FORENCRYPTION ENCRYPTBYPASSPHRASE(MyKeyPhrase ',' VISHAL') --FORDECRYPTION CONVERT ( VARCHAR (100),DECRYPTBYPASSPHRASE( 'MyKeyPhrase' , 'VISHAL' )=@INPUT_PASSWORD collate SQL_Latin1_General_CP1_CS_AS Above code might help you. Thanks. Cheers...

Bikesh Srivastava · Answer

http://www.aspsnippets.com/Articles/Encrypt-and-Decrypt-Username-or-Password-stored-in-database-in-ASPNet-using-C-and-VBNet.aspx

Nitin Sontakke · Answer

The code given at following link would be useful http://johnnycoder.com/blog/2008/07/03/c-encryption-decryption-helper-class/ IMPORTANT: Please remember to change the cryptokey variable value and also IV array values.

Tejas Trivedi · Answer

Hello Nikhil, Base64 is encoding technique. The most secure way is to use cryptographic technique like SHA, RSA and AES 128. Please let me know if more information is required. Please don't forget to mark as answer if this helps.