CODEWITHSUNDEEP
c#cryptography
HelpNeeder
HelpNeeder

Reputation: 6480

Which encryption algorithm to use for password-protecting data?

I am currently thinking of something to do as my final project for my C# class. The thing that came up to my mind was a password-protected data storing application which would require a password to access data stored in a binary file.

The problem is that I am not sure which encryption to use if I would decide to do this project.

What encryption would fit best this scenario? Which encryption is the best?

Just little more info what I have planned.

First, user must specify the user name/password information to save the data. Data would be saved in binary file which later should be able to view after login information are correct.

Upvotes: 1

Views: 2643

Answers (2)

Grofit
Grofit

Reputation: 18445

Not sure if this is an answer to your question, but alot of systems that store usernames and passwords tend to just hash the passwords, so you never actually store the users password, just the one way hashed version of it. That way when they try to login again you just hash the password and compare it to the existing one.

MD5 is the simplest one, but I believe SHA256/512 is one of the better ones to use, this is a one way hashing algorithm though, and may not be applicable to your situation if you need to be able to ever gain access to the plain text version of their passwords. Usually this isnt an issue as you can just get them to change their passwords and a user never really needs to see their password in plain text.

If you cannot use one way hashing, then just use blowfish or some other simple two way encryption algorithm. The internet is full of different .net encryption providers. If it is homework I dont think it will really matter, as long as you can show a working knowledge of why and when you would use encryption you should get marks.

Upvotes: 0

Dennis
Dennis

Reputation: 14477

I think you should go with AES in CTR mode.

A C# implementation of Rijndael (the underlying cipher of AES) can be found here.

There is probably not such a thing as the best encryption algorithm, but it is what everybody else is using right know.

To clarify further:

This is how encryption works:

Plaintext -> [encryption] -> Ciphertext -> [decryption] -> Plaintext

This is what you would have to use for a password manager.

This is how hashing works:

Message -> [hashing] -> Hash -> [???] -> Message

You can (and should) use hashing algorithms to store (hashed) passwords in a database for authentication purposes (e.g. log into a website). To do so, you use a salt or a key-based message authentication code.

Instead of "dehashing" the hash stored in the database, you just hash the user input and verify if it matches. This does not work for an application like a password manager.

With a cryptographically secure hashing function (like SHA-512), it is currently impossible to "dehash", i.e., even if you know the hash, you cannot retrieve the message.

Upvotes: 4

Related Questions