Encrypt and Decrypt Username or Password stored in database in ASP.Net using C# and VB.Net

Size: px

Start display at page:

Download "Encrypt and Decrypt Username or Password stored in database in ASP.Net using C# and VB.Net"

Ernest Hines
6 years ago
Views:

1 Encrypt and Decrypt Username or Password stored in database in ASP.Net using C# and VB.Net Here Mudassar Ahmed Khan has explained how to encrypt and store Username or Password in SQL Server Database Table and then fetch, decrypt and display it in ASP.Net. The Username or Password will be first encrypted using AES Symmetric key (Same key) algorithm and then will be stored in the database. And while fetching it will be again decrypted using AES Algorithm using the same key that was used for encryption. In this article I will explain how to encrypt and store Username or Password in SQL Server Database Table and then fetch, decrypt and display it in ASP.Net. The Username or Password will be first encrypted using AES Symmetric key (Same key) algorithm and then will be stored in the database. And while fetching it will be again decrypted using AES Algorithm using the same key that was used for encryption. Database Schema I have created a new database named UsersDB which consist of one table named Users with the following schema.

2 You will notice that I have used NVARCHAR data type for storing Password, the reason is that when encrypted the password can contain special characters and hence it is recommended to use NVARCHAR instead of VARCHAR data type. Note: The attached sample contains the SQL Script file to create the database and the table. HTML Markup The HTML Markup consists of Username and Password TextBoxes and a GridView to display the saved Usernames and Passwords. <form id="form1" runat="server"> <table border="0" cellpadding="0" cellspacing="0"> <tr> Username: <asp:textbox ID="txtUsername" runat="server" Text="" /> </tr> <tr> Password: <asp:textbox ID="txtPassword" runat="server" TextMode="Password" /> </tr> <tr> <asp:button ID="btnSubmit" OnClick="Submit" Text="Submit" runat="server" /> </tr> </table> <hr /> <asp:gridview ID="gvUsers" runat="server" AutoGenerateColumns="false" HeaderStyle-BackColor="#3AC0F2" HeaderStyle-ForeColor="White" RowStyle-BackColor="#A1DCF2" OnRowDataBound = "OnRowDataBound">

3 <Columns> <asp:boundfield DataField="Username" HeaderText="Username" /> <asp:boundfield DataField="Password" HeaderText="Encrypted Password" /> <asp:boundfield DataField="Password" HeaderText="Desrypted Password" /> </Columns> </asp:gridview> </form> Namespaces You will need to import the following namespaces. C# using System.IO; using System.Text; using System.Data; using System.Data.SqlClient; using System.Configuration; using System.Security.Cryptography; VB.Net Imports System.IO Imports System.Text Imports System.Data Imports System.Data.SqlClient Imports System.Configuration Imports System.Security.Cryptography AES Algorithm Encryption and Decryption functions Below are the functions for Encryption and Decryption which will be used for the Encrypting or Decrypting Username or Password. Note: The following functions have been explained in the article AES Encryption Decryption (Cryptography) Tutorial with example in ASP.Net using C# and VB.Net

4 C# private string Encrypt(string cleartext) string EncryptionKey = "MAKV2SPBNI99212"; byte[] clearbytes = Encoding.Unicode.GetBytes(clearText); using (Aes encryptor = Aes.Create()) Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 ); encryptor.key = pdb.getbytes(32); encryptor.iv = pdb.getbytes(16); using (MemoryStream ms = new MemoryStream()) using (CryptoStream cs = new CryptoStream(ms, encryptor.createencryptor(), CryptoStreamMode.Write)) cs.write(clearbytes, 0, clearbytes.length); cs.close(); cleartext = Convert.ToBase64String(ms.ToArray()); return cleartext; private string Decrypt(string ciphertext) string EncryptionKey = "MAKV2SPBNI99212"; byte[] cipherbytes = Convert.FromBase64String(cipherText); using (Aes encryptor = Aes.Create()) Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 ); encryptor.key = pdb.getbytes(32); encryptor.iv = pdb.getbytes(16); using (MemoryStream ms = new MemoryStream()) using (CryptoStream cs = new CryptoStream(ms, encryptor.createdecryptor(), CryptoStreamMode.Write)) cs.write(cipherbytes, 0, cipherbytes.length);

5 cs.close(); ciphertext = Encoding.Unicode.GetString(ms.ToArray()); return ciphertext; VB.Net Private Function Encrypt(clearText As String) As String Dim EncryptionKey As String = "MAKV2SPBNI99212" Dim clearbytes As Byte() = Encoding.Unicode.GetBytes(clearText) Using encryptor As Aes = Aes.Create() Dim pdb As New Rfc2898DeriveBytes(EncryptionKey, New Byte() &H49, &H76, &H61, &H6E, &H20, &H4D, _ &H65, &H64, &H76, &H65, &H64, &H65, _ &H76) encryptor.key = pdb.getbytes(32) encryptor.iv = pdb.getbytes(16) Using ms As New MemoryStream() Using cs As New CryptoStream(ms, encryptor.createencryptor(), CryptoStreamMode.Write) cs.write(clearbytes, 0, clearbytes.length) cs.close() cleartext = Convert.ToBase64String(ms.ToArray()) Return cleartext End Function Private Function Decrypt(cipherText As String) As String Dim EncryptionKey As String = "MAKV2SPBNI99212" Dim cipherbytes As Byte() = Convert.FromBase64String(cipherText) Using encryptor As Aes = Aes.Create() Dim pdb As New Rfc2898DeriveBytes(EncryptionKey, New Byte() &H49, &H76, &H61, &H6E, &H20, &H4D, _ &H65, &H64, &H76, &H65, &H64, &H65, _ &H76) encryptor.key = pdb.getbytes(32) encryptor.iv = pdb.getbytes(16)

6 Using ms As New MemoryStream() Using cs As New CryptoStream(ms, encryptor.createdecryptor(), CryptoStreamMode.Write) cs.write(cipherbytes, 0, cipherbytes.length) cs.close() ciphertext = Encoding.Unicode.GetString(ms.ToArray()) Return ciphertext End Function Encrypting and storing the Password in Database Table When the Button is clicked, the following event handler is raised which inserts the entered Username and Password into the database table. The Username is inserted directly but the Password is first encrypted using the Encryption function (discussed earlier) and then it is inserted. C# protected void Submit(object sender, EventArgs e) string constr = ConfigurationManager.ConnectionStrings["constr"].ConnectionString; using (SqlConnection con = new SqlConnection(constr)) using (SqlCommand cmd = new SqlCommand("INSERT INTO Users cmd.commandtype = CommandType.Text; cmd.parameters.addwithvalue("@username", txtusername.text.trim()); cmd.parameters.addwithvalue("@password", Encrypt(txtPassword.Text.Trim())); cmd.connection = con; con.open(); cmd.executenonquery(); con.close(); Response.Redirect(Request.Url.AbsoluteUri); VB.Net

7 Protected Sub Submit(sender As Object, e As EventArgs) Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString Using con As New SqlConnection(constr) Using cmd As New SqlCommand("INSERT INTO Users cmd.commandtype = CommandType.Text cmd.parameters.addwithvalue("@username", txtusername.text.trim()) cmd.parameters.addwithvalue("@password", Encrypt(txtPassword.Text.Trim())) cmd.connection = con con.open() cmd.executenonquery() con.close() Response.Redirect(Request.Url.AbsoluteUri) End Sub

8 Displaying the Usernames and Encrypted and Decrypted Passwords In the Page Load event of the Page, the GridView control is populated with the records from the Users table. Now in the OnRowDataBound event of the GridView, Password is fetched from the GridView Cell and is Decrypted using the Decrypt function (discussed earlier). C# protected void Page_Load(object sender, EventArgs e) if (!this.ispostback) string constr = ConfigurationManager.ConnectionStrings["constr"].ConnectionString; using (SqlConnection con = new SqlConnection(constr)) using (SqlCommand cmd = new SqlCommand("SELECT * FROM Users")) using (SqlDataAdapter sda = new SqlDataAdapter()) DataTable dt = new DataTable(); cmd.commandtype = CommandType.Text; cmd.connection = con; sda.selectcommand = cmd; sda.fill(dt); gvusers.datasource = dt; gvusers.databind(); protected void OnRowDataBound(object sender, GridViewRowEventArgs e) if (e.row.rowtype == DataControlRowType.DataRow) e.row.cells[2].text = Decrypt(e.Row.Cells[2].Text); VB.Net

9 Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load If Not Me.IsPostBack Then Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString Using con As New SqlConnection(constr) Using cmd As New SqlCommand("SELECT * FROM Users") Using sda As New SqlDataAdapter() Dim dt As New DataTable() cmd.commandtype = CommandType.Text cmd.connection = con sda.selectcommand = cmd sda.fill(dt) gvusers.datasource = dt gvusers.databind() End If End Sub Protected Sub OnRowDataBound(sender As Object, e As GridViewRowEventArgs) If e.row.rowtype = DataControlRowType.DataRow Then e.row.cells(2).text = Decrypt(e.Row.Cells(2).Text) End If End Sub

Insert Data into Table using C# Code

Insert Data into Table using C# Code CREATE TABLE [registration]( [roll_no] [int] NULL, [name] [varchar](50), [class] [varchar](50), [sex] [varchar](50), [email] [varchar](50))