Can I decrypt a password with c#, that was encrypted with PASSWORD_BCRYPT in php?

Question

I am not sure if I can decrypt passwords with c#, that i stored in a mysql database. I encrypted these passwords in php using PASSWORD_BCRYPT. And if it is possible how can I do it? Sorry but i'm a beginner and I didn't find any help on the internet. This is the piece of code I used to encrypt my passwords.

$passwort = $con->real_escape_string($_POST['passwort']);
$hash = password_hash($passwort, PASSWORD_BCRYPT);

After reading the comments I tried doing so in c# but it always says wrong password

string email = textBox1.Text;
        string password = textBox2.Text;
        string passwordHash = BCrypt.Net.BCrypt.HashPassword(password);
        MessageBox.Show(passwordHash);
        MySqlConnection conn = new MySqlConnection("datasource=127.0.0.1;port=3306;username=root;password=CIAO6CIAO6;database=kontoprogramm");
        int i = 0;
        conn.Open();
        MySqlCommand cmd = new MySqlCommand("select KLPPassword from tklassenlehrpersonen where KLPEmail = '" + email + "' and KLPPassword = '" + passwordHash + "'", conn);
        cmd.ExecuteNonQuery();
        DataTable dt = new DataTable();
        MySqlDataAdapter da = new MySqlDataAdapter(cmd);
        da.Fill(dt);
        i = Convert.ToInt32(dt.Rows.Count.ToString());
        if (i == 0)
        {
            MessageBox.Show("Falsche Email oder Kennwort!");
        }
        else
        {
            MessageBox.Show("Angemeldet!");
        }

Can somebody please help me?

Answer 1

First of all, you cannot decrypt, only if you effort to troubleshooting and hack the password decryption, for example, using Brute Force technique etc, because finally result from PHP by password_hash function is generates a hashed password, hash result. By the hash primary concept, cannot be reversible, but been comparable.

You may compare password hashs using PHP function password_verify (comparing stored hash from database with the inputed password from your C# Application). If your requirement is really decrypt, it's need to change the focus of your post, re-think to troubleshooting and hack the password decryption, for example, using Brute Force technique etc.

Now, let's go to solution: you have two ways:

a) Create an PHP WebService parameterized with the "Clear Text" as input parameter, and get the output result as a encrypted text password; the core of Web Service (in PHP) uses the password_hash with PASSWORD_BCRYPT option, to encrypt. After, your C# code consumes the encrypted data and compare this output hash with stored hash from Database; however, this alternative needs to invest many efforts in security at WebServer and WebService layers. For example, your C# code consuming this PHP Web Service as code bellow:

WebClient webclient = new WebClient();
webclient.DownloadStringCompleted += new DownloadStringCompletedEventHandler(webclient_DownloadStringCompleted);
webclient.DownloadStringAsync(new Uri("http://ws.phpurl.com/?password=stackoverflow@12345"));

void webclient_DownloadStringCompleted(object sender, DownloadStringCompletedEventArgs e)
{
    string phpWsEncryptedPass = e.Result;
    string databaseEncryptedPass = //TO DO: query Database
                                   //using WHERE statement,
                                   //parsing 'phpWsEncryptedPass' as parameter;
}

b) OR , download the binaries of the respective PHP version for Windows that you work'on, understand these DLLs methods using a DLL Reflector application (for example dotPeek ) and use C# Interop features to import the DLL thta have the password_hash and password_verify to consume this in your C# code; you need to make efforts to open the DLL, to get the correctly methods declaration. Note: this way is suggest because the Core of PHP writted in C/C++ and a C# code can be consume the DLL of PHP for Windows binaries, this code bellow has an example to do this:

    [DllImport(@"C:\ProgramFiles\PHP\php_mbstring.dll", CharSet = CharSet.Unicode)]
    internal static extern IntPtr password_hash(string clearTextpassword, int option)

    [DllImport(@"C:\ProgramFiles\PHP\php_mbstring.dll", CharSet = CharSet.Unicode)]
    internal static extern bool password_verify(string clearTextpassword, string hash)

That's all.

Answer 2

You cannot search for a hash in the database, because of the salt, instead search by username only and take the stored hash for verification. This answer shows how to do it in PHP, though the principle is the same.

And don't escape the user input before calling password_hash() this calls for trouble.