解密加密的密码

Question

In my project, I had Encrypt method and also a Decrypt method. after a minor problem, a lot of the files got deleted and I am restoring them. the problem is that the Decryption method is gone and I forgot where I got it from lol.

this is the enc method:

 public static string HashPassword(string password, string salt)
    {
        string hashed = Convert.ToBase64String(KeyDerivation.Pbkdf2(
            password: password,
            salt: Encoding.UTF8.GetBytes(salt),
            prf: KeyDerivationPrf.HMACSHA1,
            iterationCount: 10000,
            numBytesRequested: 256 / 8));
        return hashed;
    }

I know that I can compare the password with the salt and then see if the hash is the same, but if I remember correctly I also could decrypt an encrypted password somehow.

any help would be appreciated.

Answer 1

As @EjoshuaS said, you are a bit mistaken, but that being said I just want to show you how to verify the password using hash, salt that are stored in the database and the password the user has given. It might help somebody else. (I'm using HMACSHA512, but you can use HMACSHA1)

    private void CreatePasswordHash(string password)
    {
        byte[] passwordHash, passwordSalt;
        using(var hmac = new System.Security.Cryptography.HMACSHA512()){
            passwordSalt = hmac.Key;
            passwordHash = hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes(password));
        }
    }

    private bool VerifyPassword(string password, byte[] passwordHash, byte[] passwordSalt)
    {
        using(var hmac = new System.Security.Cryptography.HMACSHA512(passwordSalt)){ 
            var computedHash = hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes(password)); // Create hash using password salt.
            for (int i = 0; i < computedHash.Length; i++){ // Loop through the byte array
                if(computedHash[i] != passwordHash[i]) return false; // if mismatch
            }    
        }
        return true; //if no mismatches.
    }

Answer 2

You're conflating two entirely different things here. Hashing is not the same thing as encryption.

That being said, decryption "reverses" encryption, not hashing. There is no such thing as "dehashing." The entire point of hashing is to be one-way.

Keep in mind that the entire purpose of encryption is to privately exchange information. However, presumably your customers would not want you to read their passwords (or to exchange them with someone else). The only reason you store this at all is so that you can determine whether someone who's trying to log in knows the password, and you really don't need to "know" what the password is yourself in order to do that - you just need to know whether the password the end user presents hashes to the same value as the one stored in your database.