Derek Slager's BCrypt Class for C# Check Password Method failed - C# Discussion Boards

How to insert image on pixel using c# code

What do you mean by: "insert image on pixel"?

Veni, vidi, abiit domum

A high-tech microdot[^]?

=========================================================
I'm an optoholic - my glass is always half full of vodka.
=========================================================

Do you mean: "how do you change a pixel in an image?" ... or: "how do you read an image, calculate the row/column adjustment necessary to insert a pixel, and compose a new image with the pixel added?"

“But I don't want to go among mad people,” Alice remarked.

“Oh, you can't help that,” said the Cat: “we're all mad here. I'm mad. You're mad.”

“How do you know I'm mad?” said Alice.

“You must be," said the Cat, or you wouldn't have come here.” Lewis Carroll

I have a horrible feeling he wants to insert a whole image in the space of a pixel... Unsure | :~

Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)

Let's call it nanojpeg?

Let me rephrase your question:

Quote:
How to read an image pixel by pixel using C#

Please correct me if i am wrong.

Hi to all,

This is with continuation of my previous question here.

I am using Microsoft Visual Studio 2010 Ultimate, C# Winforms & MySql Database.

I am trying to use BCrypt class by Derek Slager for creating and authenticating username and password. A form is use to create new user to save Username and Password to database, but this Password is not the plaintext one, it is hashed using BCrypt.HashPassword method. I am using binding source for the form, so I am using a dummy textbox which will hold the hashed value of plaintext user entered in password textbox. Then I bind the controls using following:

C#

public void BindControls()
    {
        txtUser.Text = null;
        txtPass.Text = null;
        txtHash.Text = null;


        txtID.DataBindings.Clear();
        txtUser.DataBindings.Clear();
        txtHash.DataBindings.Clear();

        txtID.DataBindings.Add(new Binding("Text", bs, "userID"));
        txtUser.DataBindings.Add(new Binding("Text", bs, "userName"));
        txtHash.DataBindings.Add(new Binding("Text", bs, "userPass"));

    }

As plaintext password is not required to save in Database, there is no need to bind it. txtHash will get hashed password after user enter plaintext password in txtPass textbox on LeaveEvent as follows:

C#

private void txtPass_Leave(object sender, EventArgs e)
    {
      txtHash.Text = null;         
      txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));
    }

Then called the save method of User class when user click Save Button:

C#

private void btnSave_Click(object sender, EventArgs e)
    {

        this.Validate();
        bs.EndEdit();

        if (!ds.HasChanges())
        {

            MessageBox.Show("No changes to save.", "Saving Records");
            return;
        }


        try
        {


            fUser.SaveUser(ds);
            MessageBox.Show("Records saved.", "Saving Records");
        }


        catch (Exception exceptionObj)
        {

            MessageBox.Show(exceptionObj.Message.ToString());

        }
    }

User class save method is follows:

C#

public void SaveUser(DataSet oDs)
   {
       oCn = da.GetConnection();
       oTrn = oCn.BeginTransaction();
       sqlDataMaster = new MySqlDataAdapter();
       try
       {

           if (oCn == null)
           {
               oCn.Open();
           }


           sInsProcName = "prInsert_User";
           insertcommand = new MySqlCommand(sInsProcName, oCn, oTrn);
           insertcommand.CommandType = CommandType.StoredProcedure;
           insertcommand.Parameters.Add(new MySqlParameter("nNewID", MySqlDbType.Int32, 0, "userID"));
           insertcommand.Parameters["nNewID"].Direction = ParameterDirection.Output;
           insertcommand.UpdatedRowSource = UpdateRowSource.OutputParameters;
           insertcommand.Parameters.Add("mUserName", MySqlDbType.VarChar, 50, "userName");
           insertcommand.Parameters.Add("mUserPass", MySqlDbType.VarChar, 60, "userPass");
           sqlDataMaster.InsertCommand = insertcommand;


           sUpdProcName = "prUpdate_User";
           updatecommand = new MySqlCommand(sUpdProcName, oCn, oTrn);
           updatecommand.CommandType = CommandType.StoredProcedure;
           updatecommand.Parameters.Add("nNewID", MySqlDbType.Int32, 0, "userID");
           updatecommand.Parameters.Add("mUserName", MySqlDbType.VarChar, 50, "userName");
           updatecommand.Parameters.Add("mUserPass", MySqlDbType.VarChar, 60, "userPass");
           sqlDataMaster.UpdateCommand = updatecommand;

           sqlDataMaster.Update(oDs.Tables[0]);

           oTrn.Commit();


       }
       catch (MySqlException e)
       {
                           oTrn.Rollback();
           MessageBox.Show(e.ToString());

       }
   }

Data is saved successfully, no problem is there. In the password field of Table it is shows the hashed value. But problem arises when I need to validate the password via Login form. User enter username and password and click login, which fires following code:

C#

private void btnCheck_Click(object sender, EventArgs e)
    {
        string hashpassdb = dm.GetData("Select userPass from userMaster where userName = " + "'" + txtUser.Text.ToString() + "'" ).Rows[0]["userPass"].ToString();
        if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
        {
            MessageBox.Show(hashpassdb);
            MessageBox.Show("Invalid Username or Password.");
            MessageBox.Show(BCrypt.HashPassword(txtPass.Text.Trim().ToString(), hashpassdb));

        }
        else
        {
            MessageBox.Show("Login Successfull");
            ((frmMain)this.MdiParent).EnableMenu();
            this.Close();

        }
    }

    private bool DoesPasswordMatch(string userEnteredPassword, string hashedPwdFromDatabase)
    {
        return BCrypt.CheckPassword(userEnteredPassword, hashedPwdFromDatabase);

    }

dm is the instance of DAL class which contains GetData method, accepts Sql command as parameter and returns DataTable. The problem is hashed values never matched with the one using in validation, as notice in code I've use MessageBox.Show method just to ensure what value is return from Database hashed password and the one return by BCrypt.Hashpassword. They both are different. Also, I am using VarChar(60) datatype for holding hash value in Mysql.

I need some guidance about what I am doing wrong here? any help is much appreciated.

Thanks

Ahmed

I had a very quick look at what was going on - essentially, this

C#

if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))

is wrong - which I think stems from this

C#

txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));

The crux is you're generating a NEW salt when you use BCrypt.GenerateSalt(12) - you should use the original hashpassdb instead (I don't know how you are going to do that)

The reason is, hashpassdb contains the original salt value. The clue is in BCrypt's code, function CheckPassword

C#

public static bool CheckPassword(string plaintext, string hashed) {
    return StringComparer.Ordinal.Compare(hashed, HashPassword(plaintext, hashed)) == 0;
}

'g'

Garth J Lancaster wrote:

C#

if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))

is wrong - which I think stems from this

C#

txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));

Thanks for your reply...

But txtPass.Text.Trim().ToString() is not generated from txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));

Infact, there is no txtHash textbox in user login form, it only has 2 textboxes, username and password. Then uses password value (txtPass.Text.Trim.ToString())with BCrypt.CheckPassword routine with hashpassdb (retrieve from database).

txtHash textbox is used in the Form where new user is created with Username and password. It is actually hidden textbox, use only to save hash value of password in database.

Im sorry, I think you're missing the point - you're not getting the correct results because you're not comparing 'apples with apples'

If you start with a password A
And generate Hashed-Salted-Password-A
(and then store Hashed-Salted-Password-A)
And then want to compare that with Password B
You have to compare Hashed-Salted-Password-A with HashPassword(Password B, Hashed-Salted-Password-A)

'g'

Garth J Lancaster wrote:
Im sorry, I think you're missing the point - you're not getting the correct results because you're not comparing 'apples with apples'

Actually I am also trying to do the same, but what I don't understand is why it is not working.

Let me re-phrase my problem without code:

Form User Creation:
1.New User create with Username and Password, password is hashed and stored in db,using a hidden textbox (txtHash).

Form User Login:
1. User enter username and password.
2. Get hashed password from db and stored it in hashpassdb string.
3. Now compare the user entered password with BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))

I know there is something wrong in logic behind User login form, but I am unable to track it. I've used breakpoints in BCrypt.Checkpassword function to check what values are in, and they are different. But the question is why?

ahmed_one wrote:
3. Now compare the user entered password with
BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))

yes, but, arnt you doing something funky in txtPass.Leave event ? that means the result you get from

txtPass.Text.Trim().ToString()

is effectively

HashPassword(user entered password ,BCrypt.GenerateSalt(12));

?

As you've quote point number 3, which is related to User login form, there is no txtPass.leave event used in User Login form. It is only used in User Creation Form, so ultimately there is no:

C#

HashPassword(user entered password ,BCrypt.GenerateSalt(12));

Used for txtPass. It's the plaintext where user enter password.

I know what you are trying to say, that when comparing password, what I am doing is to generate new hash due to the result of GenerateSalt(12). But this is not the case, I simply get hash value from db and put it in CheckPassword method alongwith plaintext password enter by user. I am sure BCrypt.GenerateSalt(12) is not call anywhere in UserLogin form.

I am following this guide in my application.

ok, which version of BCrypt are you using ?

Derek Slagers Bcrypt class.

Downloaded from http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password-hashing-for-dotnet-and-mono.ashx[^]

There appears to be a more up-to-date version here http://bcrypt.codeplex.com/[^]

Nonetheless, I did a quick and dirty test with that version you used with VS2005 :-

C#

namespace DSBcryptTest
{
    class Program
    {
        static void Main(string[] args)
        {
            String Password_Text   = "Lorem_ipsum_dolor_sit_amet";

            String Password_Hashed = BCrypt.HashPassword(Password_Text, BCrypt.GenerateSalt(12));
            Console.WriteLine("Hashed Password {0}", Password_Hashed);

            String Test_Password_Text = Password_Text;

            if (BCrypt.CheckPassword(Test_Password_Text, Password_Hashed))
            {
                Console.WriteLine("Passwords Match");
            }

        }
    }

and there was nothing wrong / I got the expected result - obviously I should be using Nunit/unit tests etc, but meh ...

I copied BCrypt.cs into a new project, removed the assembly directive at the top, then used it directly as opposed to the dll version - but that wouldn't matter - it just means I can step into the code

So, Im sorry, I cant think of where to go

Thanks for reply.

Garth J Lancaster wrote:
I copied BCrypt.cs into a new project, removed the assembly directive at the top, then used it directly as opposed to the dll version - but that wouldn't matter - it just means I can step into the code

I didn't get the above part "removed the assembly directive"?? what does it mean? I am also using BCrypt.cs file not the dll..

May be assembly directive has something to do with my problem?

nup, not the issue - you wouldn't even be able to build it if that were the issue - I had a 'Duplicate AssemblyVersion Attribute' error with the same in AssemblyInfo.cs - so I removed [assembly: System.Reflection.AssemblyVersion("0.1")] from near the top of my copy of BCrypt.cs

All I proved was there's nothing obviously wrong with that version of BCrypt.cs, but it was only one test

Ok so may be I need to also test it with simple code, after the successful test I will add it to my project.

I will let you know the result of test.

Thanks

btw - what is the length of the hashed password you get back from the DB ?

BCrypt hashed password is returning 60 Char length in my case.

I don't believe it...I've done hours and hours of testing and all of them is succeed...And guess what is the stupid mistake I was doing?? I've accidentally set CharacterCasing to upper when creating new user...And in Login Form it is set to default normal.

Now it is working...

Thanks for be patient with my stupidity.

Ahmed

Well done for fixing it. Don't be worried about it - we've all made mistakes like this at one time or another.

Thanks....as a beginner these mistakes surely hard to find, but no doubt they make me learn something.....