Re: Decrypt

From: Jeff Louie (jeff_louie_at_yahoo.com)
Date: 11/26/04

  • Next message: Jim: "Working with groups of user controls..." 
    Date: Fri, 26 Nov 2004 13:09:43 -0800

    Vishal... RC4 and DES are examples of two way algorithms. The .NET
    cryptograhpy API has two way algorithms, but it is _not_ recommended
    that you store the encrypted passwords on the server. If someone
    compromises the server they can decrypt them. If you only store
    hashcodes on the server, it will be difficult to recreate the password
    table. In fact, don't just hash the passwords, but combine the password
    with a random "salt" --> hash the result and store the hash and random
    salt on the server. To verify the user's credentials, take the users
    input, add it to the stored random salt --> hash the result and compare
    it to the stored hash.

    Regards,
    Jeff
    >Can anybody tell me which encryption is used
    for two-way? So that I can encrypt/decrypt the passwords?<

    *** Sent via Developersdex http://www.developersdex.com ***
    Don't just participate in USENET...get rewarded for it!

  • Next message: Jim: "Working with groups of user controls..."

    Relevant Pages

    • Re: Hacked Passwords
      ... a null hash starting with the AAD3 characters. ... store the older LM Hash format. ... passwords on pieces of paper. ...
      (microsoft.public.security)
    • Re: Is it necessary to store the entire MD5, etc. hash for validation?
      ... >I want to store the last 10 passwords used on a legacy database that, ... but I don't have room to store 10x128+ bytes. ... I think you are mistaken about the size of the output of hash functions, ... passphrase hashes if you use SHA-256, ...
      (sci.crypt)
    • Re: secure storage in Active Directory
      ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
      (microsoft.public.security)
    • Re: secure storage in Active Directory
      ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
      (microsoft.public.win2000.security)
    • Re: Delphi Convert
      ... what is the accepted way to store the connection string user ... >names and passwords? ... Don't - ask the user for the server / database he wants to use, ... per-user basis in the user's "isolated storage" - read up the MSDN ...
      (microsoft.public.vstudio.general)