0

I'm registering clients in my application using this code,

string query= "INSERT INTO clientes (username,morada, sexo, telemovel, nif,password,email) " +
    "VALUES(@username,@morada,@sexo,@telemovel,@nif,@password,@email)";

if(a.open_connection())
{
    MySqlCommand cmd = new MySqlCommand(query, a.connection);
    cmd.Parameters.AddWithValue("@username", textBox1.Text);
    cmd.Parameters.AddWithValue("@morada", textBox2.Text);

    cmd.Parameters.AddWithValue("@sexo", comboBox1.Text);
    cmd.Parameters.AddWithValue("@telemovel", maskedTextBox2.Text);
    cmd.Parameters.AddWithValue("@nif", maskedTextBox1.Text);
    cmd.Parameters.AddWithValue("@email", textBox7.Text);
    cmd.Parameters.AddWithValue("@password", textBox4.Text);

    cmd.ExecuteNonQuery();
    a.close_connection();
}

my question is how can i encrypt the field password?

Magnetron
  • 7,495
  • 1
  • 25
  • 41
Renato Gomes
  • 25
  • 4
  • You should be hashing passwords, not encrypting them. Either way, it seems like a pretty broad question as it stands, not to mention it's relatively easy to research online. Have you done any research on the topic yet? I ask because you haven't really shown any effort as far as your actual question is concerned. – Broots Waymb Mar 26 '19 at 18:18
  • I need to encrypt it, because the idea is to login in the website i created, and since the registring method in the website have the password encrypted (with md5) someone who creates an account in the app can´t login to the site unless the password is encrypted aswell, but i didn't manage to encrypt it yet – Renato Gomes Mar 26 '19 at 18:23
  • MD5 is a hash, not encryption... You shouldn't be using MD5 for passwords anyway.. See: https://security.stackexchange.com/questions/19906/is-md5-considered-insecure – Broots Waymb Mar 26 '19 at 18:26
  • ok guys, i get it, sorry i'm new at programming so i'm still a little bit ignorant, thanks anyway – Renato Gomes Mar 26 '19 at 18:31
  • You should actually hash the password not encrypt it. Search for password hashing algorithms, there are plenty available – Ashkan Mobayen Khiabani Mar 26 '19 at 18:51
  • Possible duplicate of [How to hash a password](https://stackoverflow.com/questions/4181198/how-to-hash-a-password) – Dour High Arch Mar 26 '19 at 20:56

1 Answers1

0

What everyone is saying is correct, it is good practice to Hash passwords rather than encrypt them.

Here is how you can use it for yours.

private const int SHAVALUE = 16; // Change this number to whatever you want. It's like your key
        private const int CB = 20; // You can change this two if you want (For extra security, maybe)
        private static string GetPasswordReadyForDatabaseStorage(string password)
        {
            var salt = new byte[SHAVALUE];
            //Create the salt value with a cryptographic PRNG:
            new RNGCryptoServiceProvider().GetBytes(salt);
            //Create the Rfc2898DeriveBytes and get the hash value:
            var pbkdf2 = new Rfc2898DeriveBytes(password, salt, 10000);
            var hash = pbkdf2.GetBytes(CB);
            //Combine the salt and password bytes for later use:
            var hashBytes = new byte[SHAVALUE+CB];
            Array.Copy(salt, 0, hashBytes, 0, SHAVALUE);
            Array.Copy(hash, 0, hashBytes, SHAVALUE, CB);
            //Turn the combined salt+hash into a string for storage
            return Convert.ToBase64String(hashBytes);
        }
        private static bool VerifyPassword(string passwordUserEntered)
        {
            /* Fetch the stored value */
            string getPasswordHash = savedPasswordHash;//<--- Get the hash password from the database and place it here.
            /* Extract the bytes */
            var hashBytes = Convert.FromBase64String(getPasswordHash);
            /* Get the salt */
            var salt = new byte[SHAVALUE];
            Array.Copy(hashBytes, 0, salt, 0, SHAVALUE);
            /* Compute the hash on the password the user entered */
            var pbkdf2 = new Rfc2898DeriveBytes(passwordUserEntered, salt, 10000);
            var hash = pbkdf2.GetBytes(CB);
            /* Compare the results */
            for (int i = 0; i < CB; i++)
            if (hashBytes[i + SHAVALUE] != hash[i])
            {
                return false;
            }

            return true;
        }

You can go even further and use SecureStrings instead of string parameters. Hope this helps!

Here is the link to where i referenced this code https://stackoverflow.com/a/10402129/251311

JayHandle
  • 176
  • 7