c＃，对密码登录进行加密和解密。 System.Security.Cryptography.CryptographicException：错误的数据。 错误

Question

Hello all i might take your time and thx in advance for any answer. well i've been facing this problem since long time i have assignment to make a website in ASP.Net mvc and im having problem with encrypt and Decrypt for the password , for encrypt its work very fine and turn the password to hash when the user registor but what im trying to get the hash string and Decrypt when the user try to login but the Decrypt function is not working and giving me error .

in User Controllar :

 public string Decrypt(string cipherString)
        {
            string EncryptionKey = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
            //cipherString = "62KO b2aMA8=";
            int mm = cipherString.Replace(" ", "").Length % 4;
            if (mm > 0)
            {
                cipherString += new string('=', 4 - mm);
            }

            byte[] cipherBytes = Convert.FromBase64String(cipherString);
            using (Aes encryptor = Aes.Create())
            {
                Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
                encryptor.Key = pdb.GetBytes(32);
                encryptor.IV = pdb.GetBytes(16);
                using (MemoryStream ms = new MemoryStream())
                {
                    using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
                    {
                        cs.Write(cipherBytes, 0, cipherBytes.Length);
                        cs.Close(); //here the error show up 
                    }
                    cipherString = Encoding.Unicode.GetString(ms.ToArray());
                }
            }
            return cipherString;
        }

and here where i call the dcrypt for login

  public ActionResult Login(string returnUrl)
        {
            ViewBag.ReturnUrl = returnUrl;
            return View();
        }
        [HttpPost]
        [ValidateAntiForgeryToken]
        public ActionResult Login(User objUser, string returnUrl)
        {
            System.Diagnostics.Debug.WriteLine(ModelState.IsValid);
        objUser.Password = Decrypt(objUser.Password);


        {
                @ViewBag.Message = objUser.UserName;
                var obj = db.User.Where(a => a.UserName.Equals(objUser.UserName) && a.Password.Equals(objUser.Password)).FirstOrDefault();
                if (obj != null)
                {

                    Session["UserID"] = obj.UserID.ToString();
                    Session["UserName"] = obj.UserName.ToString();
                    return RedirectToAction("UserShow");
                }
            }

            @ViewBag.Message = "Error , you had insert wrong password or WIW Name";
            return View(objUser);
        }

        public ActionResult UserShow()
        {
            if (Session["UserID"] != null)
            {
                System.Diagnostics.Debug.WriteLine(Session["UserName"]);
                return View("Login");


            }
            else
            {
                return RedirectToAction("Login");
            }
        }

so can u help me finding the problem plzzzzz :(

Answer 1

The most optimal way of storing password is that you use the following technique.

1. Concatenate the password string with a unique random string. (You can use Guid class to generate such strings). Such string is called salt.
2. Next hash the resultant string (using any of the available hashing algorithms) ie, the one formed by concatenation of the actual password and salt.
3. Store the generated hash and the salt in separate fields of your table.

Now whenever you have to validate a password you will use the following process:

1. Fetch the salt for the user.
2. Concatenate the salt to the entered password.
3. Obtain the hash of the resultant string.
4. Compare this generated hash with the one stored against the user.

Answer 2

As Kell stated storing a "clear" password is a bad manner. You save the encrypted password, then when the user inputs 123456 as password, you encrypt his/her input and compare it to the stored encrypted password.