Password Encryption - C# Discussion Boards

11-Nov-02 3:50

I use the code described below to one-way hash a supplied user's password to verify it against the one-way hashed password stored in a database.
While the code works and provides the functionality I am looking for I am not convinced that it does it in the quickest/most elegant/most sensible/safest way.
Any ideas for improvement?

// Convert the supplied password into a char array
char[] password = new char[50];
System.IO.StringReader reader = new System.IO.StringReader(this.textBoxPassword);
reader.Read(password, 0, 50);

// Copy the char array into a byte array for encryption
byte[] bPassword = new byte[50];
for(int i = 0; i < 50; i++)
{
	bPassword[i] = (byte)password[i]);
}

// Hash the password
System.Security.Cryptography.SHA1 shaM = new System.Security.Cryptography.SHA1Managed();
byte[] hash = shaM.ComputeHash(bPassword);

// Convert the hash into a char array
char[] cHash = new char[hash.Length];
for(int i = 0; i < hash.Length; i++)
{
	cHash[i] = (char)hash[i];
}

// Create a string from the hash for db verification
string hashword = new string(cHash);

// ... Perform db verification

Derek Lakin.
I wish I was what I thought I was when I wished I was what I am.

Salamander Software Ltd.

David Stone11-Nov-02 4:49

11-Nov-02 4:49

You're right. It isn't the best way...

//Set up the SHA1 provider and the encoder
//The encoder lets us convert the string back and forth from the bytes that the SHA1 provider requires
SHA1 shaM = new SHA1Managed();
UnicodeEncoding enc = new UnicodeEncoding();

//Perform the encryption
byte[] original = enc.GetBytes(Text);	         //Convert Text to byte form
byte[] converted = shaM.ComputeHash(original);	//Compute the hash
Text = enc.GetString(converted);	                  //Convert bytes back to Text

The UnicodeEncoding class is in the System.Text namespace. I always do something that I think shouldn't take that much...then I find out how I could have saved myself a bunch of time and heartache by just looking for something in the FCL that would do it for me.

Oh, and you aren't supposed to create strings like this:

string hashword = new string(cHash);

You should do it like this:

string hashword = cHash;

Or, you should probably just use cHash instead of creating a new string.

You will now find yourself in a wonderous, magical place, filled with talking gnomes, mythical squirrels, and, almost as an afterthought, your bookmarks
-Shog⁹ teaching Mel Feik how to bookmark

I don't know whether it's just the light but I swear the database server gives me dirty looks everytime I wander past.
-Chris Maunder

Derek Lakin11-Nov-02 19:55

11-Nov-02 19:55

Thanks very much Big Grin | :-D

I knew there had to be a better way!

P.S. What's wrong with using one of the string constructors to create a string? Confused | :confused:

Derek Lakin.
I wish I was what I thought I was when I wished I was what I am.

Salamander Software Ltd.

David Stone12-Nov-02 4:42

12-Nov-02 4:42

I dunno. But Jeffery Richter says not to. So you know what I don't do? Use the String constructor. In Applied Microsoft .NET Framework Programming, page 253, he says:

"In C#, you can't use the new operator to construct a String object..."

Go figure... Unsure | :~

Derek Lakin12-Nov-02 19:56

12-Nov-02 19:56

David Stone wrote:
"In C#, you can't use the new operator to construct a String object..."

The code I gave does work as it should do so, can't is a bit misleading; shouldn't may have some merits, though.

David Stone wrote:
Jeffery Richter says not to

If Jeffrey says so, then I will cease this instant. I keep meaning to get the book or something similar, but haven't quite got round to it yet. I'm too busy blundering about unguided Big Grin | :-D

Derek Lakin.
I wish I was what I thought I was when I wished I was what I am.

Salamander Software Ltd.

Pete Bassett11-Nov-02 4:59

Pete Bassett

11-Nov-02 4:59

AHHH. Damn and blast. David beat me to it.

Yeah, hes right. Yours isn't the best way of doing it.

public string test2(string strBoxPassword)
{
	// Copy the char array into a byte array for encryption
	byte[] bPassword = System.Text.Encoding.Default.GetBytes(strBoxPassword);

	// Hash the password
	System.Security.Cryptography.SHA1 shaM = new System.Security.Cryptography.SHA1Managed();

	byte[] hash = shaM.ComputeHash(bPassword);

	return System.Text.Encoding.Default.GetString(hash);
}

Note that this and Davids reply are pretty similar except he excplicitly speficies the Unicode encoder. However, please note that both these methods WILL NOT return the same hash as your old method. The reason beeing is that you hard code 50 characters in the source byte array no matter what the actual length is. Our methods only hash the actual contents of the data and no extra trailing bytes.

Therefore if you already have hashes in your DB based on the originial code your probably going to have to either stick with what you have or re generate all the hashes...

Pete

Insert Sig. Here!

David Stone11-Nov-02 4:58

11-Nov-02 4:58

Pete Bassett wrote:
AHHH. Damn and blast. David beat me to it.

Poke tongue | ;-P

It helps if you were working on the same bit of code for a personal project just about a week ago. Big Grin | :-D

Pete Bassett wrote:
Note that this and Davids reply are pretty similar except he excplicitly speficies the Unicode encoder

Death to ASCII! Long Live Unicode! Actually, your method might take Unicode...I'm not sure...
[edit]Actually, your method gets the System's current encoding. So if your OS was based on Unicode(XP I think) then it'll get a Unicode encoder.[/edit]

leppie11-Nov-02 6:15

leppie

11-Nov-02 6:15

David Stone wrote:
So if your OS was based on Unicode(XP I think) then it'll get a Unicode encoder

Wrong! Default encoder with actually return the current windows codepage. Dont ask me how, but I realised that working on my irc client. Very strange indeed. Best is just to use the same Encoder/Decoder, and not rely on different (but perhaps similar) ones.

Smile | :)

"I dont have a life, I have a program."

David Stone11-Nov-02 9:23

11-Nov-02 9:23

Hope you don't mind my asking...but what the heck is a codepage? Confused | :confused:

leppie11-Nov-02 9:58

leppie

11-Nov-02 9:58

David Stone wrote:
but what the heck is a codepage?

Not really sure either, but I think it is an extension to ASCII based on your system culture. Something along that path.... Smile | :)

"I dont have a life, I have a program."

David Stone11-Nov-02 10:47

11-Nov-02 10:47

Found it!
http://www.microsoft.com/typography/unicode/cscp.htm[^]

In Windows 95 and NT, a codepage is a list of selected character codes in a certain order. Codepages are usually defined to support specific languages or groups of languages which share common writing systems. For example, codepage 1253 provides character codes required in the Greek writing system.

The order of the character codes in a codepage allows the system to provide the appropriate character code to an application when a user presses a key on the keyboard. When a new codepage is loaded, different character codes are provided to the application.

Derek Lakin11-Nov-02 19:52

Some inherited form questions....

11-Nov-02 19:52

Thanks very much Big Grin | :-D

I knew there had to be a better way!

Derek Lakin.
I wish I was what I thought I was when I wished I was what I am.

Salamander Software Ltd.

LongRange.Shooter11-Nov-02 3:44

LongRange.Shooter

11-Nov-02 3:44

I have my inherited form created and I have the controls set to be modifiable, setting them from Private to Protected. I also added the Main() logic so that all inherited forms can be selected as a starting form.

1) The documentation says I can compile to either a DLL or an EXE, I create a DLL and create reference to that DLL, yet when I create a new inherited form, it complains that the EXE does not exist. Do I have to create BOTH an EXE and DLL????

2) All of the stuff I've read indicates that I can create code in my base form and that code will be inherited in each instance. However when I create a new inherited form, it does not copy my [STAThread] code! I have yet to try creating control code, but I expect that that code would not copy either.

Any help on smoothing out these last two bumps is appreciated!!!

Thanks.

_____________________________________________
_{I have a tendancy to where my mind on my sleeve
I have a habit of losing my shirt...}

idc_arrow and C#

Senkwe Chanda11-Nov-02 2:20

Senkwe Chanda

11-Nov-02 2:20

Anybody know how to go about getting a handle to the default windows cursor?

Cursors.Arrow.Handle returns what seems to be a valid handle, but I get an error when I call

InPtr Hicon = Cursors.Arrow.Handle;<br />
<br />
Bitmap tempBitmap = Bitmap.FromHicon(Hicon);

The error is "invalid parameter used"

\\winnt\cursors doesn't seem to contain the actual default arrow cursor as a ".cur" file. It's defined in winuser.h via MAKEINTRESOURCE(...) with the identifier IDC_ARROW.

I wouldn't mind going the unmanaged route. (I'm doing this in fact, but using a cursor in the \\winnt\cursors directory). But that's just a temp solution as I really want the default cursor. How would I define Win32's LoadImage(...) or indeed the LoadCursor(...) function with regards to the MAKEINTRESOURCE(...) call?

Gosh, what an ugly question eh?

Smile | :)

ASP.NET can never fail as working with it is like fitting bras to supermodels - it's one pleasure after the next - David Wulff

Stephane Rodriguez.11-Nov-02 3:01

Stephane Rodriguez.

11-Nov-02 3:01

Senkwe Chanda wrote:
InPtr Hicon = Cursors.Arrow.Handle;

This IntPtr is actually a WIN32 HCURSOR, not a WIN32 HICON, hence the error.

Back to real work : D-19.

Senkwe Chanda11-Nov-02 4:12

Senkwe Chanda

11-Nov-02 4:12

Thanks .S.Rod. I'm used to using them interchangably via win32. Do you have any ideas on how I can get access to the handle for the default windows cursor? IDC_ARROW?

ASP.NET can never fail as working with it is like fitting bras to supermodels - it's one pleasure after the next - David Wulff

Stephane Rodriguez.11-Nov-02 4:13

Stephane Rodriguez.

11-Nov-02 4:13

Senkwe Chanda wrote:
Do you have any ideas on how I can get access to the handle for the default windows cursor?

Doing Cursors.Arrow.Handle is the right code (internally it does a simple ::LoadCursor(IDC_CURSOR);

But, as I have already said, this call returns a HCURSOR.

What you were trying to do next is build a bitmap. That's a fine idea, but the API method you use expects an HICON, not an HCURSOR.

So you've got to find somewhere (either in the .NET API, or through WIN32) a way to convert the HCURSOR to an HICON. I guess that if that was only a matter of casting, this would not lead to an error.

What about lurking around Codeproject articles dealing with HCURSOR and HICON ?

Back to real work : D-19.