Password Encryption and decryption in a secure way.

Question

Guys I am developing an application in c# asp.net which deals with money. For that application password in the database should be securely saved.For that reason I did some research and came up with below two functions for encryption and decryption respectively from c#.So my question is whether I should go with these two functions or there are other secure ways to save password securely in my database.

 private string Encrypt(string clearText)
    {
        string EncryptionKey = "MAKV2SPBNI99212";
        byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
        using (Aes encryptor = Aes.Create())
        {
            Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
            encryptor.Key = pdb.GetBytes(32);
            encryptor.IV = pdb.GetBytes(16);
            using (System.IO.MemoryStream ms = new MemoryStream())
            {
                using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
                {
                    cs.Write(clearBytes, 0, clearBytes.Length);
                    cs.Close();
                }
                clearText = Convert.ToBase64String(ms.ToArray());
            }
        }
        return clearText;
    }

    private string Decrypt(string cipherText)
    {
        string EncryptionKey = "MAKV2SPBNI99212";
        byte[] cipherBytes = Convert.FromBase64String(cipherText);
        using (Aes encryptor = Aes.Create())
        {
            Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
            encryptor.Key = pdb.GetBytes(32);
            encryptor.IV = pdb.GetBytes(16);
            using (MemoryStream ms = new MemoryStream())
            {
                using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateDecryptor(), CryptoStreamMode.Write))
                {
                    cs.Write(cipherBytes, 0, cipherBytes.Length);
                    cs.Close();
                }
                cipherText = Encoding.Unicode.GetString(ms.ToArray());
            }
        }
        return cipherText;
    }

Answer 1

In your actual implementation hardcoding your salt is not a good practice for various reasons, the most common reason could be malicious access to your code compromising all the data encrypted with such algorithm. Instead you should randomize your salt and save it somewhere, e.g. as part of your hash string or in data base for later retrieval.

There's a C# implementation of a salted password hashing algorithm in this article http://crackstation.net/hashing-security.htm. Note that the salt is randomly generated and saved as part of the hash string itself.

Answer 2

Regarding your code, it is giving a warning using Code Analisys:

CA2202: Do not dispose objects multiple times

Because of the using nested

Here is an approach to it: CA2202: How to solve

If this matter interests you, can take a look at this: CA2202: Code review

Answer 3

In general when you use cryptographic features in an app always consider using asymmetric algorithms instead of plain symmetric ones. You should consider using RSA key pairs based stuff instead of plain AES. Even better is to use a combination of them e.g: encrypt plain text using AES but then also encryt the AES key itself using RSA so that it becomes tamper proof.

But for passwords specifically you should consider using one way encryption like MD5 or SHA. This makes the password very secure. Why? since SHA or MD5 is one way hashing approach i.e: given a plain text you can derive its SHA or MD5 hash but not the other way round. There is no decrypt provisions here so even if your encrypted passwords get stolen no one can make any heads or tails of it and brute force would take years to break them down. You should do something like this:

• When creating users, SHA their passwords and save the SHA string in DB.
• when logging in, query the records based on username or email and save in a list.
• calculate SHA hash for the password which user entered in the form.
• match the calculated SHA hash against the value in password column for each record which you got back from DB.
• if match found them user is authenticated else not.

This approach also protects you form injection attacks on SQL side. Only drawback of this approach is that no one cna recover the old password back. You cannot tell the user what his/her old password was. In case of 'forget password' kind of functionality you need to recreate a new password and use that.