last day (14 days later) » 

11:45 AM
3
A: Encrypt passwords on Sql Server 2008 using SHA1

KritnerHash and salt passwords in C# https://crackstation.net/hashing-security.htm https://www.bentasker.co.uk/blog/security/201-why-you-should-be-asking-how-your-passwords-are-stored As I stated in my comments, hashing passwords is something that you probably shouldn't be doing yourself. A few thin...

 
Thanks ,Will give it a try :)
Thanks a lot @Kritner.I am new to c#.All I wanted is that whenever the user enters the password ,it should be stored in the sql server Database in encrypted format.Our customers are not that much sophisticated to crack the password :) So no worries
Hey Kitner I am able to encrypt the password ,Now how will comparison take place ie(Converting encrypted to decrypted to compare) ,
 
this is why i pointed out encryption IS NOT the same thing as hashing. An SHA1 hash is one way once you hash it, you cannot reverse it to its original form. the same characters will get hashed to the same hash each time. This is why hashes are used and not encryption, administrators of systems cannot "recover" passwords ever, the only option is to reset.
for "checking for login" success, you already have that in my answer. You take the user's raw password, hash it, and then compare that hash to the hash on record for that user. Is there something I'm missing that you need?
 
I modified the stored procedure as per your answer,but I am getting login failed message.I dont know where I am going wrong Do you know bout this Exec master.dbo.xp_sha1 (@0Password, @EncPassword output how to add this to my stored procedure and encrypt it
 
I'm in chat.stackoverflow.com/rooms/11391/sql for a bit so hopefully this can be worked out, I have not used the sp you're referring to in your last comment
 
Hey
you there
 
11:47 AM
Morning
 
its evening here in INdia
:)
 
I'll be in and out but i'll see if i can help you out :)
so what did you end up going with for doing your hashing? sql sp or the c# solution?
 
well My requirements have changed

this is my stored procedure

Exec master.dbo.xp_sha1 @Password, @EncPassword output
sorry
create procedure Proc_LoginCheck
@UserID varchar(20),
@Password varchar(20)
As

Declare
@EncPassword varchar(20),
@DBPassword varchar(20),
@Message varchar(20)

SET NOCOUNT ON

Exec master.dbo.xp_sha1 @Password, @EncPassword output
Insert into Clients(Userid,Password)
Values(UserID,EncPassword)
Select '0|Following User Added Successfully'+rtrim(@UserID) as @Message
return @Message
Set NOCOUNT OFF
this is throwing errors
 
well like i said i've not used xp_sha1, why aren't you going with the HASHBYTES function posted?
 
I want when a user sends his password in plain text format from C#, it should be stored in the database table in encrypted format for which I have written the above code
Ok
I have tried and it worked fine
but I guess xp_sha1 would be better
 
11:52 AM
well i'm not familiar with that SP or how it works, so i can't really say
 
Oh no worries :)
 
what errors are you getting when trying to use the xp_sha1 sp?
 
Msg 128, Level 15, State 1, Procedure Proc_LoginCheck, Line 15
The name "UserID" is not permitted in this context. Valid expressions are constants, constant expressions, and (in some contexts) variables. Column names are not permitted.
Msg 102, Level 15, State 1, Procedure Proc_LoginCheck, Line 16
Incorrect syntax near '@Message'.
 
well in:
Values(UserID,EncPassword)
UserId and encPassword don't mean anything without a from
i think you're looking for @userId
and @encPassword
 
yeah right
 
12:00 PM
but aside from that, i can't really help you with the xp_sha1 i can't even find that proc in my master db
 
but the basic idea of it is you hash the password, and store that hash on your db for the user
and to confirm the user's password, you take the password entered by the user, hash it, and then compare that hash to the hash in your db for the user
 
but like i said in the comments, you can't "undo" a hash
or get the original password from a hash rather
that's the purpose of hashing
though with encryption, you can get the original
 
but can comparing be done?
 
12:03 PM
yes, but you're comparing hashes
not passwords
 
exactly
let me give it a try
can you give me your email id
because you must not be visiting SO regularly
 
12:34 PM
Sorry was afk, i'd prefer not to give out my email address especially since other people can join this chat and see the chat history :P
i'm on SO pretty often i can check in
 

last day (14 days later) »