RE: Password encryption

Hello Nick,

Thank you for posting here.

For password encryption, could you let me know more about your application
scenarios? Because we usually don't need to use symmetric algorithm to
encrypt and decrypt the password. Instead, we just store the hash of the
password and each time an input password need to be verified, we hash the
input and compare the result with the stored hash. To make the hash more
secure, we can add "salt" to the original password before it being hashed
and stored. To read more about the "Salt":
http://en.wikipedia.org/wiki/Salt_(cryptography).

Talking about the hash / encryption algorithms available in .NET, they
depends on the version of .NET and the version of the OS you're targeting.
If you could make this information clear to me, I can give you more
specific information. However, let me provide some general information
first.

For hashing the password, you can consider use SHA512Managed Class. This
class computes the SHA512 hash algorithm for the input data using the
managed implementation, which is supported since .NET version 1.0, and can
be used on all the desktop / server Windows systems that .NET supports. You
may also find another class called SHA512, which is an abstract class and
the base class for SHA512Managed. The online reference for SHA512Managed:
http://msdn.microsoft.com/en-us/library/system.security.cryptography.sha512m
anaged.aspx

In .NET 3.5, we also have some new SHA-512 implementations which are
actually wrapper around system functionalities. You may want to read a post
on the .NET Security Blog to find out more about the new classes:
http://blogs.msdn.com/shawnfa/archive/2007/01/17/new-crypto-algorithms-in-or
cas.aspx

For symmetric algorithms, besides the RijndaelManaged class, if you are
target .NET 3.5, you can also use the AesManaged class which provides a
managed implementation of the Advanced Encryption Standard (AES) symmetric
algorithm. The AES algorithm is essentially the Rijndael symmetric
algorithm with a fixed block size and iteration count. This class functions
the same way as the RijndaelManaged class but limits blocks to 128 bits and
does not allow feedback modes. Online reference for AesManaged class:
http://msdn.microsoft.com/en-us/library/system.security.cryptography.aesmana
ged.aspx

Please kindly let me know if you have any other concerns with more detailed
information. I will be happy to work on them with you.

Regards,

Jie Wang (jiewan@xxxxxxxxxxxxxxxxxxxx, remove 'online.')

Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
msdnmg@xxxxxxxxxxxxxx

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/en-us/subscriptions/aa948868.aspx#notifications.

Note: MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 2 business days is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions. Issues of this
nature are best handled working with a dedicated Microsoft Support Engineer
by contacting Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/en-us/subscriptions/aa948874.aspx
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

.

Relevant Pages

  • Re: New Encryption Idea
    ... performing the 5 reads necessary in the example algorithm results in a delay ... Panama at 400MB/sec, or RC4 at about 90MB/sec, or AES in CTR mode at ... and the speed failings of your design become very clear. ... > Manansala Encryption and Authentication System ...
    (sci.crypt)
  • Meganets "unbreakable" cryptography? Im skeptical.
    ... Meganet makes such grandiose claims that I can't help but ... There's plenty of coverage on secret encryption algorithms ... encryption algorithm that was granted U.S. Patent ... Labor has bought into this "snake oil" and without a doubt ...
    (sci.crypt)
  • Re: Enigma machine strenght using a computer
    ... cipher with rotors that spin backwards, forwards, stop and start based ... on other rotors, change their values according to the phase of the moon ... encryption less error-prone and they were a cost effective way to get ... case) than not since a wider base uses the same algorithm. ...
    (sci.crypt)
  • Re: Enigma machine strenght using a computer
    ... You're right that computers would allow us to implement an Enigma like ... cipher with rotors that spin backwards, forwards, stop and start based ... encryption less error-prone and they were a cost effective way to get ... I personally think this is a silly requirement, no one algorithm can be ...
    (sci.crypt)
  • Re: Enigma machine strenght using a computer
    ... cipher with rotors that spin backwards, forwards, stop and start based ... Is this a good way to get security on modern ... encryption less error-prone and they were a cost effective way to get ... I personally think this is a silly requirement, no one algorithm can be ...
    (sci.crypt)
Loading