C# encrypted Login

Question

I am trying to create a simple asp.net website that allows users to register and log in. I have successfully managed to store all the data in the database and authenticate the user in the log in form. However the thing I want to do now is whenever a new user registers to store the password in the database in MD5 format and match the hashes in order for the user to be able to login.

This is the code in the register section that stores the user in the database:

try
    {
        SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["AssignmentDBConnectionString"].ConnectionString);
        conn.Open();
        string insertQuery = "insert into [AsTable] ([Username],Email,Password) values (@Username ,@Email, @Password)";
        SqlCommand com = new SqlCommand(insertQuery, conn);
        com.Parameters.AddWithValue("@Username", TextBoxUsername.Text);
        com.Parameters.AddWithValue("@email", TextBoxEmail.Text);
        com.Parameters.AddWithValue("@password", TextBoxPass.Text);

        com.ExecuteNonQuery();
        Response.Redirect("Manager.aspx");
        Response.Write("Registration Completed");

        conn.Close();

    }
    catch (Exception ex)
    {
        Response.Write("Error:"+ex.ToString());
    }

And this is the code in the login section that authenticates the user in order for him to login:

conn.Open();
        string checkPasswordQuery = "select Password from [AsTable] where Username ='" + TextBoxUsername.Text + "'";
        SqlCommand passcom = new SqlCommand(checkPasswordQuery, conn);
        string password = passcom.ExecuteScalar().ToString().Replace(" ","");
        if (password == TextBoxPassword.Text)
        {
            Session["New"] = TextBoxUsername.Text;
            Response.Write("Password is correct");
            Response.Redirect("Index.aspx");
        }
        else
        {
            Response.Write("Password is not correct");
        }
    }

    else
    {
        Response.Write("Username is not correct");
    }

}

Any ideas what to change??

Answer 1

this is how i deal with encryption

first i create a method to convert simple string to sha256 (i think this is better than md5)

public string ToSHA256(string value)
    {
        SHA256 sha256 =  SHA256.Create();

        byte[] hashData = sha256.ComputeHash(Encoding.Default.GetBytes(value));
        StringBuilder returnValue = new StringBuilder();

        for (int i = 0; i < hashData.Length; i++)
        {
            returnValue.Append(hashData[i].ToString());
        }

        return returnValue.ToString();
    }

then

just change your code in creating a user to

try
{
    SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["AssignmentDBConnectionString"].ConnectionString);
    conn.Open();
    string insertQuery = "insert into [AsTable] ([Username],Email,Password) values (@Username ,@Email, @Password)";
    SqlCommand com = new SqlCommand(insertQuery, conn);
    com.Parameters.AddWithValue("@Username", TextBoxUsername.Text);
    com.Parameters.AddWithValue("@email", TextBoxEmail.Text);
    com.Parameters.AddWithValue("@password", ToSHA256(TextBoxPass.Text));

    com.ExecuteNonQuery();
    Response.Redirect("Manager.aspx");
    Response.Write("Registration Completed");

    conn.Close();

}
catch (Exception ex)
{
    Response.Write("Error:"+ex.ToString());
}

then in retrieving password

conn.Open();
    string checkPasswordQuery = "select Password from [AsTable] where Username ='" + ToSHA256(TextBoxUsername.Text) + "'";
    SqlCommand passcom = new SqlCommand(checkPasswordQuery, conn);
    //string password = passcom.ExecuteScalar().ToString().Replace(" ","");
    if (password == ToSHA256(TextBoxPassword.Text))
    {
        Session["New"] = TextBoxUsername.Text;
        Response.Write("Password is correct");
        Response.Redirect("Index.aspx");
    }
    else
    {
        Response.Write("Password is not correct");
    }
}

else
{
    Response.Write("Username is not correct");
}
}

Answer 2

I personally use a custom random number generator, a custom scrambler (able to unscramble) and an AES encryption, input is string, output is a base64 encoded binary password. (The best practice though is to save the hashed passwords in the database, and when authenticating, hash the provided password and check against database value)

int KeyLength = 16;
public static Int32 GetASeed(String SeedStr)
{
    Int32 Seed = 0;
    for (int i = 0; i < SeedStr.Length; i++)
    {
        Seed ^= SeedStr[i];
    }
    return Seed;
}

public static byte[] Keygen(String Str)
{
    Int32 Seed = GetASeed(Str);
    Random NumGenerator = new Random(Seed);
    byte[] Key = new byte[KeyLength];
    for (int i = 0; i < KeyLength; i++)
    {
        Key[i] = (byte)NumGenerator.Next(256);
    }
    return Key;
}

public static byte[] Encrypt(String Text, String Key)
{
    Aes Encryptor = Aes.Create();
    byte[] Data;
    Encryptor.Key = Keygen(Key);
    Encryptor.IV = Keygen(Key + "dec");
    Data = Encryptor.CreateEncryptor().TransformFinalBlock(Encoding.UTF8.GetBytes(Text), 0, Text.Length);
    return Convert.ToBase64String(Data);
}


public static String Decrypt(byte[] Data, String KeyPass)
{
    Aes Decryptor = Aes.Create();
    Decryptor.Key = Keygen(KeyPass);
    Decryptor.IV = Keygen(KeyPass + "dec");
    Data = Decryptor.CreateDecryptor().TransformFinalBlock(Data, 0, Data.Length);
    return Encoding.UTF8.GetString(Convert.FromBase64String(Data));
}

Usage:

Encrypt(SomePasswordField.Text, "MyWayCoolEnkryptionKeyString");
Decrypt(DatabaseUser.Password, "MyWayCoolEnkryptionKeyString");

This is just a skeleton of an AES encryption.