IIS ASP - Saving password as an encrypted string

Author

Saving password as an encrypted string

Neil G Jarman

2006-04-27, 7:52 am

Hi,

I would like to save my user's passwords as an encrypted sting.

Are their built in functions for doing this?

It's not financial data or anything, just to keep away prying eyes.

many thanks,

NEIL

Evertjan.

2006-04-27, 7:52 am

Neil G Jarman wrote on 25 apr 2006 in
microsoft.public.inetserver.asp.general:

> I would like to save my user's passwords as an encrypted sting.
>
> Are their built in functions for doing this?
>
> It's not financial data or anything, just to keep away prying eyes.
>

Prying eyes on the server?

That is not usefull, since anyone having access to the server can insert a
password bypassing backdoor.

Perhaps Rot13 will be enough?

Function ROT13(szInput)
txt = ""
coding =
" ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMa
bcdefghijklmnopqrstuvwxyzabcdefghi
jklm"
For i = 1 To Len(szInput)
character = Mid(szInput, i, 1)
position = InStr(coding, character)
If position > 0 Then character = Mid(coding, position + 13, 1)
txt = txt & character
Next
ROT13 = txt
End Function

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

Neil G Jarman

2006-04-27, 7:52 am

"Evertjan." <exjxw.hannivoort@interxnl.net> wrote in message
news:Xns97B0930DCB7FFeejj99@194.109.133.242...
> Neil G Jarman wrote on 25 apr 2006 in
> microsoft.public.inetserver.asp.general:
>
>
> Prying eyes on the server?
>
> That is not usefull, since anyone having access to the server can insert a
> password bypassing backdoor.
>
> Perhaps Rot13 will be enough?
>
> Function ROT13(szInput)
> txt = ""
> coding =
> " ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMa
bcdefghijklmnopqrstuvwxyzabcdefghi
> jklm"
> For i = 1 To Len(szInput)
> character = Mid(szInput, i, 1)
> position = InStr(coding, character)
> If position > 0 Then character = Mid(coding, position + 13, 1)
> txt = txt & character
> Next
> ROT13 = txt
> End Function
>
>
> --
> Evertjan.
> The Netherlands.
> (Please change the x'es to dots in my emailaddress)

Hi Evertjan,

Thanks for the code - yes that's probably enough.

My ony concern is that staff who have access to Enterprise Manager cold look
up the passwords of senoir managers. Best to keep them obscure.

Cheers,

NEIL

Dave Anderson

2006-04-27, 7:52 am

Neil G Jarman wrote:
> Thanks for the code - yes that's probably enough.
>
> My ony concern is that staff who have access to Enterprise Manager
> cold look up the passwords of senoir managers. Best to keep them
> obscure.

If that is your concern, then take the correct approach -- store hashed
values, not passwords. When authenticating, compared hashed inputs to the
stored hashed values.
http://en.wikipedia.org/wiki/Hashing

Here is one way to do this: http://www.codeproject.com/database/xp_md5.asp

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

Dave Anderson

2006-04-27, 7:24 pm

I wrote:
> If that is your concern, then take the correct approach -- store
> hashed values, not passwords. When authenticating, compared hashed
> inputs to the stored hashed values.
> http://en.wikipedia.org/wiki/Hashing
>
> Here is one way to do this:
> http://www.codeproject.com/database/xp_md5.asp

Also, if you are using SQL Server 2005, you can use the native HashBytes
function: http://msdn2.microsoft.com/en-us/library/ms174415(SQL.90).aspx

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

Matt G.

2006-04-28, 1:16 pm

Snitz forums use sha256. I think its similar to the hash method
mentioned above. google search:
http://www.google.com/search?q=sha2...:en-US:official