Question

I have created a web form in c# that accepts username and password and stores password in MSSQL 2005 db in ‘image’ format. The password is merged with salt, encoded in UTF8 and lastly it is applied with a SHA512 encryption. I want to be able to see the passwords in string format when I pull them up back from the database. How should my decrypt function be, if the following is how I encrypted the password? Is that possible? :

    string loginID = "";//This will be stored in varchar format in MSSQL..(Unrelated to the question)
    string password =""; //This is where I store password inputted by user.
    Random r = new Random();
    int salt = r.Next((int)Math.Pow(2, 16));
    int verifyCode = r.Next((int)Math.Pow(2, 16));
    string tmpPwd = password.ToLower() + salt.ToString();
    UTF8Encoding textConverter = new UTF8Encoding();
    byte[] passBytes = textConverter.GetBytes(tmpPwd);
    byte[] hashedPWD = new SHA512Managed().ComputeHash(passBytes);

The value in hashedPWD is stored in MSSQL as image datatype and salt is stored as int.

Answer 1

You can’t – that’s what a hash function is, by definition – a one-way function. Up until the last line, you can get the password back, but after the hash function, all you can do is generate a second hash and compare the two to see if they’ve produced the same result, in which case you can presume that the source strings were the same.