Question

I’m trying to figure out how to store a hash in my Access Database. Now I have generated a hash by salting a user password with the User ID (not highly secure I know, but plenty for my purposes). I have also stored the hashed values in the database as Base64 strings (manually, I haven’t yet developed the module to do that automatically), however, when I go to retrieve the hash from the database I receive the hex code in place of the string. I know that the string is stored in the database since I stored it there manually so I’m not quite sure what’s going on.

This is the code for the login button:

Sub prcLogin()
        'Log User in

        Dim ds As New DataSet
        Dim blnCorrect As Boolean

        'Fill DataSet with login details
        prcConnectSet("SELECT * FROM Parent", "User", ds)

        strUser = txtUser.Text

        'Ensure username field is not blank
        If strUser <> "" Then

            'Search for the user
            For Each Row In ds.Tables("User").Rows
                Dim HashedPass As String = fncComputeHash(txtPass.Text & strUser)
                Dim ContainedPass As String = Row.Item(3)
                'Validate user
                If strUser = Row.Item(0) Then
                    If HashedPass = Row.Item(3) Then
                        blnCorrect = True
                        lblLoggedAs.Text = Row.Item(1)
                        Exit For
                    End If
                Else
                    blnCorrect = False
                End If
            Next
        End If

And this is the code for the hash calculator:

    Function fncComputeHash(ByVal PasswordField As String) As String
        Dim Hasher As New SHA256CryptoServiceProvider()
        Dim encoder As New UTF8Encoding()

        Return Convert.ToBase64String(Hasher.ComputeHash(encoder.GetBytes(PasswordField)))

    End Function

But when I run this instead of returning a value like “rlzhYoiO4+vpdJdsrFq5Sj9VBJ+FFYhIg9V5+z+jeNI=” which I stored in the database, it returns a value like “5C6BED0D94B9BE8AFBC5C8CAC1E9D4BE03F556917C2611EC56F4E6F341EF60D9”. Now how do I get around this? Am I storing the values incorrectly? Should I store them as a byte array? If so, how do I do that? Or am I retrieving the values incorrectly? Or are those ok and should I be converting the value once I get it back from the database?

I’m very new to this whole encryption lark and even authentication so if I’m doing something stupid do tell me.

Thanks in advance!

Edit: I’m using the “Text” data type in Access.

Edit 2: Sorry I understand the confusion now. I’m storing only the hash! Not the plaintext password. So it’s vital the hash received from the database is in the same format as that from the user id and password.

Edit 3: OK Thanks guys, I’ve solved it. I needed to convert it to a hex string using the SoapHexBinary function.

Answer 1

I found what I needed. The “SoapHexBinary” function is what I need. Here is an example:

Function fncComputeHash(ByVal PasswordField As String) As String
    'Compute SHA-256 Hash value

    Dim Hasher As New SHA256CryptoServiceProvider()
    Dim encoder As New UTF8Encoding()
    Dim shb As New SoapHexBinary(Hasher.ComputeHash(encoder.GetBytes(PasswordField)))

    Return shb.ToString

End Function