How to store password as hashes and then authenticate the user without even knowing the password in plaintext?

Question

I am creating a desktop application that uses face as the password. Until now, I have been able to identify people and then authenticate them based on their faces.

What the application does is:

If a person is enrolled and presents his face in front of the web camera, the application identifies the person and automatically opens a website, fills the username and password textboxes, and automatically logs into the account associated with that face. So, the user doesn't even need to type his password.

Now, the main problem is, at the time of enrolment, the user has to present his face along with his/her username and password for the account. I am storing the username and password in the database. I want to be able to store the password in hashed form. Now, since the password is stored in sha1 form, the actual password is unknown and when the user presents his face, the password is automatically filled in by the data stored in the database. If the hashed password gets entered into the password textbox, the password will be flagged as "wrong password" by the website as they expect password to be in plaintext.

Is there any way to store the user passwords? Because storing it in plain-text doesn't seem to a good idea. Anyone with access to the database can see all the passwords for all the users. Although, if I store it in plaintext, the application will work fine since the password will be filled in plaintext automatically!

Also, let me know If there's a way to send the password to the server in hashed form and still get authenticated.

Answer 1

The common pattern is this: The password is sent to the server in plain text and the server hashes it before comparing it with the hashed password in the database.

Note that you may not want to use SHA1 for that and also read up on the usage of salt.

I only found one library suitable for vb.net: http://bcrypt.codeplex.com/

Edit: Please see whether or not you can send the hash instead of the real password, since storing encrypted passwords is not much better than plain text passwords. Where do you store the key(s)?

Answer 2

@Dip I think the question you are asking is a very common one and there is a lot of discussion and debate around it. I would advise you to first understand the various encryption / decryption algos used and the advantages / disadvantages of the same.

A quick google search and I found the following useful links to help you pick your algorithm Best algorithm to Encrypting / Decrypting a string & Key storage method http://homepages.uel.ac.uk/u0430614/Encryption%20index.htm

Once you have choosen the algorithm that works for your needs then start looking for libraries that implement that algorithm in vb.net

Answer 3

You should use these steps:

Store passwords in AES Encrpytion -> In your app, retrieve the password and decrypt it -> Recognize face -> Open Website -> Then input Username and decrypted passwords -> Log In -> Other Stuff..
You can use this AES module for encryption and decryption:

Imports System.Collections.Generic
Imports System.IO
Imports System.Linq
Imports System.Security.Cryptography
Imports System.Text
Imports System.Threading.Tasks

Public Module AES
    Public Function AES_Encrypt(bytesToBeEncrypted As Byte(), passwordBytes As Byte()) As Byte()
        Dim encryptedBytes As Byte() = Nothing

    ' Set your salt here, change it to meet your flavor:
    ' The salt bytes must be at least 8 bytes.
        Dim saltBytes As Byte() = New Byte() {1, 2, 3, 4, 5, 6, _
        7, 8}

    Using ms As New MemoryStream()
        Using AES As New RijndaelManaged()
            AES.KeySize = 256
            AES.BlockSize = 128

            Dim key = New Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000)
            AES.Key = key.GetBytes(AES.KeySize / 8)
            AES.IV = key.GetBytes(AES.BlockSize / 8)

            AES.Mode = CipherMode.CBC

            Using cs = New CryptoStream(ms, AES.CreateEncryptor(), CryptoStreamMode.Write)
                cs.Write(bytesToBeEncrypted, 0, bytesToBeEncrypted.Length)
                cs.Close()
            End Using
            encryptedBytes = ms.ToArray()
        End Using
    End Using

    Return encryptedBytes
End Function
Public Function AES_Decrypt(bytesToBeDecrypted As Byte(), passwordBytes As Byte()) As Byte()
    Dim decryptedBytes As Byte() = Nothing

    ' Set your salt here, change it to meet your flavor:
    ' The salt bytes must be at least 8 bytes.
    Dim saltBytes As Byte() = New Byte() {1, 2, 3, 4, 5, 6, _
        7, 8}

    Using ms As New MemoryStream()
        Using AES As New RijndaelManaged()
            AES.KeySize = 256
            AES.BlockSize = 128

            Dim key = New Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000)
            AES.Key = key.GetBytes(AES.KeySize / 8)
            AES.IV = key.GetBytes(AES.BlockSize / 8)

            AES.Mode = CipherMode.CBC

            Using cs = New CryptoStream(ms, AES.CreateDecryptor(), CryptoStreamMode.Write)
                cs.Write(bytesToBeDecrypted, 0, bytesToBeDecrypted.Length)
                cs.Close()
            End Using
            decryptedBytes = ms.ToArray()
        End Using
    End Using

    Return decryptedBytes
End Function
End Module

Note that the functions take byte arrays as their arguments and also return byte arrays. You can get a byte array from a string by using System.Text.Encoding.UTF8.GetBytes("string") and a string from a byte array using System.Text.Encoding.UTF8.GetString(bytes). You can change UTF8 if necessary.