Question

I have a website, with sensitive information.
And I also have a private network (closed to the internet) that the data in my website is synced into.

I have user accounts that login to the website using a private ID and Password they choose. And I want to be able to know their passwords from the inner network(the closed one).

So I was thinking of using two types of encryption. HASH(1-way) for login and authentication.
And RSA(Public-key) to encrypt the password in my website, and decrypt it with private key in my private network.

I wanted to know if my way is secured enough (or maybe over-secured?) or there is a better option.

And also, what library should I use to encrypt with RSA?

Thanks in advance,
Amir.

Answer 1

You can use System.Security.Cryptography.RSACryptoServiceProvider both to encrypt password for your private network and as hash function for authentication. Plaintext password encrypted with public key should be as secure as any other proper hash function (e.g. SHA-1), though it will be somewhat longer than typical hash function output.