|
Let me rephrase your question:
Quote: How to read an image pixel by pixel using C#
Please correct me if i am wrong.
|
|
|
|
|
Hi to all,
This is with continuation of my previous question here.
I am using Microsoft Visual Studio 2010 Ultimate, C# Winforms & MySql Database.
I am trying to use BCrypt class by Derek Slager for creating and authenticating username and password. A form is use to create new user to save Username and Password to database, but this Password is not the plaintext one, it is hashed using BCrypt.HashPassword method. I am using binding source for the form, so I am using a dummy textbox which will hold the hashed value of plaintext user entered in password textbox. Then I bind the controls using following:
public void BindControls()
{
txtUser.Text = null;
txtPass.Text = null;
txtHash.Text = null;
txtID.DataBindings.Clear();
txtUser.DataBindings.Clear();
txtHash.DataBindings.Clear();
txtID.DataBindings.Add(new Binding("Text", bs, "userID"));
txtUser.DataBindings.Add(new Binding("Text", bs, "userName"));
txtHash.DataBindings.Add(new Binding("Text", bs, "userPass"));
}
As plaintext password is not required to save in Database, there is no need to bind it. txtHash will get hashed password after user enter plaintext password in txtPass textbox on LeaveEvent as follows:
private void txtPass_Leave(object sender, EventArgs e)
{
txtHash.Text = null;
txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));
}
Then called the save method of User class when user click Save Button:
private void btnSave_Click(object sender, EventArgs e)
{
this.Validate();
bs.EndEdit();
if (!ds.HasChanges())
{
MessageBox.Show("No changes to save.", "Saving Records");
return;
}
try
{
fUser.SaveUser(ds);
MessageBox.Show("Records saved.", "Saving Records");
}
catch (Exception exceptionObj)
{
MessageBox.Show(exceptionObj.Message.ToString());
}
}
User class save method is follows:
public void SaveUser(DataSet oDs)
{
oCn = da.GetConnection();
oTrn = oCn.BeginTransaction();
sqlDataMaster = new MySqlDataAdapter();
try
{
if (oCn == null)
{
oCn.Open();
}
sInsProcName = "prInsert_User";
insertcommand = new MySqlCommand(sInsProcName, oCn, oTrn);
insertcommand.CommandType = CommandType.StoredProcedure;
insertcommand.Parameters.Add(new MySqlParameter("nNewID", MySqlDbType.Int32, 0, "userID"));
insertcommand.Parameters["nNewID"].Direction = ParameterDirection.Output;
insertcommand.UpdatedRowSource = UpdateRowSource.OutputParameters;
insertcommand.Parameters.Add("mUserName", MySqlDbType.VarChar, 50, "userName");
insertcommand.Parameters.Add("mUserPass", MySqlDbType.VarChar, 60, "userPass");
sqlDataMaster.InsertCommand = insertcommand;
sUpdProcName = "prUpdate_User";
updatecommand = new MySqlCommand(sUpdProcName, oCn, oTrn);
updatecommand.CommandType = CommandType.StoredProcedure;
updatecommand.Parameters.Add("nNewID", MySqlDbType.Int32, 0, "userID");
updatecommand.Parameters.Add("mUserName", MySqlDbType.VarChar, 50, "userName");
updatecommand.Parameters.Add("mUserPass", MySqlDbType.VarChar, 60, "userPass");
sqlDataMaster.UpdateCommand = updatecommand;
sqlDataMaster.Update(oDs.Tables[0]);
oTrn.Commit();
}
catch (MySqlException e)
{
oTrn.Rollback();
MessageBox.Show(e.ToString());
}
}
Data is saved successfully, no problem is there. In the password field of Table it is shows the hashed value. But problem arises when I need to validate the password via Login form. User enter username and password and click login, which fires following code:
private void btnCheck_Click(object sender, EventArgs e)
{
string hashpassdb = dm.GetData("Select userPass from userMaster where userName = " + "'" + txtUser.Text.ToString() + "'" ).Rows[0]["userPass"].ToString();
if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
{
MessageBox.Show(hashpassdb);
MessageBox.Show("Invalid Username or Password.");
MessageBox.Show(BCrypt.HashPassword(txtPass.Text.Trim().ToString(), hashpassdb));
}
else
{
MessageBox.Show("Login Successfull");
((frmMain)this.MdiParent).EnableMenu();
this.Close();
}
}
private bool DoesPasswordMatch(string userEnteredPassword, string hashedPwdFromDatabase)
{
return BCrypt.CheckPassword(userEnteredPassword, hashedPwdFromDatabase);
}
dm is the instance of DAL class which contains GetData method, accepts Sql command as parameter and returns DataTable. The problem is hashed values never matched with the one using in validation, as notice in code I've use MessageBox.Show method just to ensure what value is return from Database hashed password and the one return by BCrypt.Hashpassword. They both are different. Also, I am using VarChar(60) datatype for holding hash value in Mysql.
I need some guidance about what I am doing wrong here? any help is much appreciated.
Thanks
Ahmed
|
|
|
|
|
I had a very quick look at what was going on - essentially, this
if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
is wrong - which I think stems from this
txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));
The crux is you're generating a NEW salt when you use BCrypt.GenerateSalt(12) - you should use the original hashpassdb instead (I don't know how you are going to do that)
The reason is, hashpassdb contains the original salt value. The clue is in BCrypt's code, function CheckPassword
public static bool CheckPassword(string plaintext, string hashed) {
return StringComparer.Ordinal.Compare(hashed, HashPassword(plaintext, hashed)) == 0;
}
'g'
|
|
|
|
|
Garth J Lancaster wrote:
if (!BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
is wrong - which I think stems from this
txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));
Thanks for your reply...
But txtPass.Text.Trim().ToString() is not generated from txtHash.Text = BCrypt.HashPassword(txtPass.Text.Trim().ToString(),BCrypt.GenerateSalt(12));
Infact, there is no txtHash textbox in user login form, it only has 2 textboxes, username and password. Then uses password value (txtPass.Text.Trim.ToString())with BCrypt.CheckPassword routine with hashpassdb (retrieve from database).
txtHash textbox is used in the Form where new user is created with Username and password. It is actually hidden textbox, use only to save hash value of password in database.
|
|
|
|
|
Im sorry, I think you're missing the point - you're not getting the correct results because you're not comparing 'apples with apples'
If you start with a password A
And generate Hashed-Salted-Password-A
(and then store Hashed-Salted-Password-A)
And then want to compare that with Password B
You have to compare Hashed-Salted-Password-A with HashPassword(Password B, Hashed-Salted-Password-A)
'g'
|
|
|
|
|
Garth J Lancaster wrote: Im sorry, I think you're missing the point - you're not getting the correct results because you're not comparing 'apples with apples'
Actually I am also trying to do the same, but what I don't understand is why it is not working.
Let me re-phrase my problem without code:
Form User Creation:
1.New User create with Username and Password, password is hashed and stored in db,using a hidden textbox (txtHash).
Form User Login:
1. User enter username and password.
2. Get hashed password from db and stored it in hashpassdb string.
3. Now compare the user entered password with BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
I know there is something wrong in logic behind User login form, but I am unable to track it. I've used breakpoints in BCrypt.Checkpassword function to check what values are in, and they are different. But the question is why?
|
|
|
|
|
ahmed_one wrote: 3. Now compare the user entered password with
BCrypt.CheckPassword(txtPass.Text.Trim().ToString(), hashpassdb))
yes, but, arnt you doing something funky in txtPass.Leave event ? that means the result you get from
txtPass.Text.Trim().ToString()
is effectively
HashPassword(user entered password ,BCrypt.GenerateSalt(12));
?
|
|
|
|
|
As you've quote point number 3, which is related to User login form, there is no txtPass.leave event used in User Login form. It is only used in User Creation Form, so ultimately there is no:
HashPassword(user entered password ,BCrypt.GenerateSalt(12));
Used for txtPass. It's the plaintext where user enter password.
I know what you are trying to say, that when comparing password, what I am doing is to generate new hash due to the result of GenerateSalt(12). But this is not the case, I simply get hash value from db and put it in CheckPassword method alongwith plaintext password enter by user. I am sure BCrypt.GenerateSalt(12) is not call anywhere in UserLogin form.
I am following this guide in my application.
|
|
|
|
|
ok, which version of BCrypt are you using ?
|
|
|
|
|
|
There appears to be a more up-to-date version here http://bcrypt.codeplex.com/[^]
Nonetheless, I did a quick and dirty test with that version you used with VS2005 :-
namespace DSBcryptTest
{
class Program
{
static void Main(string[] args)
{
String Password_Text = "Lorem_ipsum_dolor_sit_amet";
String Password_Hashed = BCrypt.HashPassword(Password_Text, BCrypt.GenerateSalt(12));
Console.WriteLine("Hashed Password {0}", Password_Hashed);
String Test_Password_Text = Password_Text;
if (BCrypt.CheckPassword(Test_Password_Text, Password_Hashed))
{
Console.WriteLine("Passwords Match");
}
}
}
and there was nothing wrong / I got the expected result - obviously I should be using Nunit/unit tests etc, but meh ...
I copied BCrypt.cs into a new project, removed the assembly directive at the top, then used it directly as opposed to the dll version - but that wouldn't matter - it just means I can step into the code
So, Im sorry, I cant think of where to go
|
|
|
|
|
Thanks for reply.
Garth J Lancaster wrote: I copied BCrypt.cs into a new project, removed the assembly directive at the top, then used it directly as opposed to the dll version - but that wouldn't matter - it just means I can step into the code
I didn't get the above part "removed the assembly directive"?? what does it mean? I am also using BCrypt.cs file not the dll..
May be assembly directive has something to do with my problem?
|
|
|
|
|
nup, not the issue - you wouldn't even be able to build it if that were the issue - I had a 'Duplicate AssemblyVersion Attribute' error with the same in AssemblyInfo.cs - so I removed [assembly: System.Reflection.AssemblyVersion("0.1")] from near the top of my copy of BCrypt.cs
All I proved was there's nothing obviously wrong with that version of BCrypt.cs, but it was only one test
|
|
|
|
|
Ok so may be I need to also test it with simple code, after the successful test I will add it to my project.
I will let you know the result of test.
Thanks
|
|
|
|
|
btw - what is the length of the hashed password you get back from the DB ?
|
|
|
|
|
BCrypt hashed password is returning 60 Char length in my case.
|
|
|
|
|
I don't believe it...I've done hours and hours of testing and all of them is succeed...And guess what is the stupid mistake I was doing?? I've accidentally set CharacterCasing to upper when creating new user...And in Login Form it is set to default normal.
Now it is working...
Thanks for be patient with my stupidity.
Ahmed
|
|
|
|
|
Well done for fixing it. Don't be worried about it - we've all made mistakes like this at one time or another.
|
|
|
|
|
Thanks....as a beginner these mistakes surely hard to find, but no doubt they make me learn something.....
|
|
|
|
|
as POH said 'well done' - you got there in the end
'next time', when using someone else's code, knock up a set of unit tests and make sure its working before you start coding against it in anger - that will eliminate it from the things you have to consider when it all looks pear-shaped
'g'
|
|
|
|
|
Thanks...I will follow your guidelines..
|
|
|
|
|
I am trying to make a software that combine all the internet connection and make it as one to get full bandwidth speed.
I am doing it as a project for my college. I have knowledge about C# and little knowledge about network programming. Does anybody know a good network programming book which will help me solve my problems.
|
|
|
|
|
C# isn't going to help you do this. What you're talking about requires writing a driver and putting it into the network stack.
No, you can't write it in C# (easily anyway).
No, I don't know of a single book that's going to talk about writing code to do this. Books will cover the OSI model and writing drivers for Windows, but nothing on your specific case. This is require you to know the Window NDIS stack and kernel level debugging on top of the other two topics I mentioned.
In short, this is NOT suitable as a school project as there is a lot of work involved and school projects usually have too short of a timeframe to pull something like this off.
|
|
|
|
|
Dave Kreskowiak wrote: In short, this is NOT suitable as a school project
Even shorter, this is not the GIMME CODEZ category 
|
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
