How to store a system.net.mail password in the database

Question

I need to store email passwords which will be used with system.net.mail. These need to be retrieved and sent as plain text but I don't want to store them as plain text. This isn't really about security as its for an intranet and I just don't want the results being displayed in plain text in the CMS.

I've read plenty of articles saying that storing password should be done using SHA1. From what I've read hashing is no good because the plain text cant be retrieved.

I am currently trying this methods:

public static string EncodePasswordToBase64(string password)
    {
        try
        {
            byte[] encData_byte = new byte[password.Length];
            encData_byte = System.Text.Encoding.UTF8.GetBytes(password);
            string encodedData = Convert.ToBase64String(encData_byte);
            return encodedData;
        }
        catch (Exception ex)
        {
            throw new Exception("Error in base64Encode" + ex.Message);
        }
    }

and

public static string DecodeFrom64(string encodedData)
    {
        System.Text.UTF8Encoding encoder = new System.Text.UTF8Encoding();
        System.Text.Decoder utf8Decode = encoder.GetDecoder();
        byte[] todecode_byte = Convert.FromBase64String(encodedData);
        int charCount = utf8Decode.GetCharCount(todecode_byte, 0, todecode_byte.Length);
        char[] decoded_char = new char[charCount];
        utf8Decode.GetChars(todecode_byte, 0, todecode_byte.Length, decoded_char, 0);
        string result = new String(decoded_char);
        return result;
    }

but I cant seem to find the correct data type in my database to store the value. Its currently set to nvarchar(MAX).

The cell contents display like this (with spaces between each value):

Q X B j L W V w M X B =

Strangely when I click and enter the cell to copy the data all I get is:

Q

What data type should I use for this column?

@Tamal Thanks but I've already read the information on that page. Did you? — spryce, Feb 03 '13 at 07:01

score 0 · Answer 1 · edited May 23 '17 at 11:54

0

Well, you're correct that hashing is not the correct way to go. What you actually want to use is Symmetric Encryption which will allow you to encrypt the data in the DB but then to decrypt it back in your main program.

AES is the recommended standard. Here is an example of how it used in C#.

I'd read a little bit more about how to correctly choose an IV to avoid common pitfalls.

edited May 23 '17 at 11:54

Community

1
1

answered Feb 03 '13 at 07:28

Blachshma

17,097
4
58
72

1

Both you guys got down votes but not from me. I dont have that priveledge yet. Shouldnt you leave a comment if your going to down vote someone? – spryce Feb 04 '13 at 00:51

Jas · Accepted Answer · 2013-02-03T07:48:45.823

You can use something like this..

//For encrypting string.

public static string Encrypt(string toEncrypt, bool useHashing)
    {
        byte[] keyArray;
        byte[] toEncryptArray = UTF8Encoding.UTF8.GetBytes(toEncrypt);
        string key = "UglyRandomKeyLike-lkj54923c478";
        if (useHashing)
        {
            MD5CryptoServiceProvider hashmd5 = new MD5CryptoServiceProvider();
            keyArray = hashmd5.ComputeHash(UTF8Encoding.UTF8.GetBytes(key));
            hashmd5.Clear();
        }
        else
            keyArray = UTF8Encoding.UTF8.GetBytes(key);

        TripleDESCryptoServiceProvider tdes = new TripleDESCryptoServiceProvider();
        tdes.Key = keyArray;
        tdes.Mode = CipherMode.ECB;
        tdes.Padding = PaddingMode.PKCS7;

        ICryptoTransform cTransform = tdes.CreateEncryptor();
        byte[] resultArray = cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length);
        tdes.Clear();
        return Convert.ToBase64String(resultArray, 0, resultArray.Length);
    }

// To decrypt string

public static string Decrypt(string cipherString, bool useHashing)
    {
        byte[] keyArray;
        byte[] toEncryptArray = Convert.FromBase64String(cipherString);
        string key = "UglyRandomKeyLike-lkj54923c478";
        if (useHashing)
        {
            MD5CryptoServiceProvider hashmd5 = new MD5CryptoServiceProvider();
            keyArray = hashmd5.ComputeHash(UTF8Encoding.UTF8.GetBytes(key));
            hashmd5.Clear();
        }
        else
            keyArray = UTF8Encoding.UTF8.GetBytes(key);

        TripleDESCryptoServiceProvider tdes = new TripleDESCryptoServiceProvider();
        tdes.Key = keyArray;
        tdes.Mode = CipherMode.ECB;
        tdes.Padding = PaddingMode.PKCS7;

        ICryptoTransform cTransform = tdes.CreateDecryptor();
        byte[] resultArray = cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length);

        tdes.Clear();
        return UTF8Encoding.UTF8.GetString(resultArray);
    }

The above mentioned method will encrypt your password and you can store it in varchar field in your database. The second method takes encrypted password and return it in normal string I hope this is what you are looking for.. I am not able to comment in your question.

@spryce if you are referring to the comment in which you are talking about the datatype field in sql and Q X B j L W V w M X B =. It will solve your that problem to. You can take a varchar(MAX) field. And the type of string you will get from above encryption function will be something like this. "tupBY1u4XVY=" — Jas, Feb 04 '13 at 04:43
No I meant the comment to Blachshma. I'm not sure why both you guys got down voted. It wasn't me. I don't have enough rep to upvote / downvote. — spryce, Feb 04 '13 at 07:52

How to store a system.net.mail password in the database

2 Answers2