[JoshD]

Okay guys.
My database is going to contain personal data. (such as contact details, names, password, etc...)

This is what I need:
1) I need to encrypt the database
2) However, i will also need to be able to use it in my vb.net program.

To expand on my second point, i will need to be able to display the data (non-encrypted, obviously), and i will need to be able to compare user inputted data to the database data (like, i will be using datasets, so, IF txtUsername.text = ds.tables(0) ...)

ALL help appreciated, so if you can't help ENTIRELY but have little pointers or helpful hints, that is also really helpful =)

(NOTE: i will also be posting this same message in the vb.net section in case someone there can help)

Thanks, Josh.
JD

[JoshD]

Okay guys.
My database is going to contain personal data. (such as contact details, names, password, etc...)

This is what I need:
1) I need to encrypt the database
2) However, i will also need to be able to use it in my vb.net program.

To expand on my second point, i will need to be able to display the data (non-encrypted, obviously), and i will need to be able to compare user inputted data to the database data (like, i will be using datasets, so, IF txtUsername.text = ds.tables(0) ...)

ALL help appreciated, so if you can't help ENTIRELY but have little pointers or helpful hints, that is also really helpful =)

(NOTE: i will also be posting this same message in the vb.net section in case someone there can help)

Thanks, Josh.
JD

[JoshD]

Okay guys.
My MICROSOFT ACCESS database is going to contain personal data. (such as contact details, names, password, etc...)

This is what I need:
1) I need to encrypt the database
2) However, i will also need to be able to use it in my vb.net program.

To expand on my second point, i will need to be able to display the data (non-encrypted, obviously), and i will need to be able to compare user inputted data to the database data (like, i will be using datasets, so, IF txtUsername.text = ds.tables(0) ...)

ALL help appreciated, so if you can't help ENTIRELY but have little pointers or helpful hints, that is also really helpful =)

(NOTE: i will also be posting this same message in the vb.net section in case someone there can help)

Thanks, Josh.
JD

This post has been edited by JoshD: 29 March 2010 - 01:50 PM

[JoshD]

Okay guys.
My MICROSOFT ACCESS database is going to contain personal data. (such as contact details, names, password, etc...)

This is what I need:
1) I need to encrypt the database
2) However, i will also need to be able to use it in my vb.net program.

To expand on my second point, i will need to be able to display the data (non-encrypted, obviously), and i will need to be able to compare user inputted data to the database data (like, i will be using datasets, so, IF txtUsername.text = ds.tables(0) ...)

ALL help appreciated, so if you can't help ENTIRELY but have little pointers or helpful hints, that is also really helpful =)

(NOTE: i will also be posting this same message in the database section in case someone there can help)

Thanks, Josh.
JD

This post has been edited by JoshD: 29 March 2010 - 01:50 PM

[PsychoCoder]

Topics merged, please don't create duplicate topics

There's no need to encrypt the database itself, just encrypt the data that goes into it. Take a look at this for more ideas.

[JoshD]

PsychoCoder, on 29 March 2010 - 12:58 PM, said:

Topics merged, please don't create duplicate topics

Well, i thought that might happen, i was just trying cause i know i dont go looking in areas where im not that good, so figured it was worth posting in 2 different areas as it is relevant in both, but okay. =)

PsychoCoder, on 29 March 2010 - 12:58 PM, said:

There's no need to encrypt the database itself, just encrypt the data that goes into it. Take a look at this for more ideas.

Alright, i will take a look RIGHT now. Thanks.

JD

EDIT: OWWWWWWWW! MY HEAD HURTS! Okay, well, I've read it, and im currently working on understanding it, and maybe I will be able to work out how to apply it to the data im sending to the database, if I need any help I will be right back to ask (quite probable), in the mean time, if you have any helpful hints and tips for me, PLEASE feel free to let me know!

This post has been edited by JoshD: 29 March 2010 - 03:50 PM

[_HAWK_]

This is something I built some time ago, there are better ecryptions out there, but this would get you started.

Use:

Dim encryptedString As String = "theTextToEncrypt"
Messagebox.Show(Crypto.Encrypt(encryptedString,key))

Public Class Crypto
    Private DES As New TripleDESCryptoServiceProvider
    Private MD5 As New MD5CryptoServiceProvider

    Public Shared Function MD5Hash(ByVal value As String) As Byte()
        Return MD5.ComputeHash(ASCIIEncoding.ASCII.GetBytes(value))
    End Function

    Public Shared Function Encrypt(ByVal stringToEncrypt As String, ByVal key As String) As String
        DES.Key = MD5Hash(key)
        DES.Mode = CipherMode.ECB
        Dim Buffer As Byte() = ASCIIEncoding.ASCII.GetBytes(stringToEncrypt)
        Return Convert.ToBase64String(DES.CreateEncryptor().TransformFinalBlock(Buffer, 0, Buffer.Length))
    End Function

    Public Shared Function Decrypt(ByVal encryptedString As String, ByVal key As String) As String
      Try  
        DES.Key = MD5Hash(key)
        DES.Mode = CipherMode.ECB
        Dim Buffer As Byte() = Convert.FromBase64String(encryptedString)
        Return ASCIIEncoding.ASCII.GetString(DES.CreateDecryptor().TransformFinalBlock(Buffer, 0, Buffer.Length))
      Catch
         MessageBox.Show("Wrong Key Number, decryption not available!")
      End Try 
    End Function

End Class

This post has been edited by hawkvalley1: 29 March 2010 - 04:36 PM

[JoshD]

hawkvalley1, on 29 March 2010 - 03:36 PM, said:

This is something I built some time ago, there are better ecryptions out there, but this would get you started.

Use:

Dim encryptedString As String = "theTextToEncrypt"
Messagebox.Show(Crypto.Encrypt(encryptedString,key))

Public Class Crypto
    Private DES As New TripleDESCryptoServiceProvider
    Private MD5 As New MD5CryptoServiceProvider

    Public Shared Function MD5Hash(ByVal value As String) As Byte()
        Return MD5.ComputeHash(ASCIIEncoding.ASCII.GetBytes(value))
    End Function

    Public Shared Function Encrypt(ByVal stringToEncrypt As String, ByVal key As String) As String
        DES.Key = MD5Hash(key)
        DES.Mode = CipherMode.ECB
        Dim Buffer As Byte() = ASCIIEncoding.ASCII.GetBytes(stringToEncrypt)
        Return Convert.ToBase64String(DES.CreateEncryptor().TransformFinalBlock(Buffer, 0, Buffer.Length))
    End Function

    Public Shared Function Decrypt(ByVal encryptedString As String, ByVal key As String) As String
      Try  
        DES.Key = MD5Hash(key)
        DES.Mode = CipherMode.ECB
        Dim Buffer As Byte() = Convert.FromBase64String(encryptedString)
        Return ASCIIEncoding.ASCII.GetString(DES.CreateDecryptor().TransformFinalBlock(Buffer, 0, Buffer.Length))
      Catch
         MessageBox.Show("Wrong Key Number, decryption not available!")
      End Try 
    End Function

End Class

Thanks, hawvalley, i will take a look at it, however, if i get this method working i will stick to this one.

Okay, so, ive got the encryption working:

    Dim textbytes, encryptedtextbytes As Byte()
    Dim rsa As New RSACryptoServiceProvider
    Dim encoder As New UTF8Encoding
    Dim TextToEncrypt, EncryptedText, Username, Password As String

        txtCurUser.Text = TextToEncrypt
        encrypt()
        Username = EncryptedText
        txtCurPass.Text = TextToEncrypt
        encrypt()
        Password = EncryptedText

   Sub encrypt()
        'Use UTF8 to convert the text string into a byte array
        textbytes = encoder.GetBytes(TextToEncrypt)
        'encrypt the text
        encryptedtextbytes = rsa.Encrypt(textbytes, True)
        'Convert the encrypted byte array into a Base64 string for display purposes
        EncryptedText = Convert.ToBase64String(encryptedtextbytes)
    End Sub

That works great, and is storing in my datatbase.

But i cant get my decrypt to work

    Dim textbytes, encryptedtextbytes As Byte()
    Dim rsa As New RSACryptoServiceProvider
    Dim encoder As New UTF8Encoding
    Dim TextToCrypt, DecryptedText, Username, Password As String

        TextToDecrypt = TxtUser.Text
        decrypt()
        Username = DecryptedText
        TextToDecrypt = TxtPass.Text
        decrypt()
        Password = DecryptedText

    Sub decrypt()

        encryptedtextbytes = Convert.FromBase64String(TextToDecrypt)
        'get the decrypted clear text byte array
        textbytes = rsa.Decrypt(encryptedtextbytes, True)
        'convert the byte array to text using the same encoding format that was used for encryption
        DecryptedText = encoder.GetString(textbytes)

    End Sub

Error: Invalid length for a Base-64 char array.
Error appears on this line: encryptedtextbytes = Convert.FromBase64String(TextToDecrypt)

and yes, i have done the imports.

Any suggestions?

Thanks.

JD

EDIT: OMG! Just realised what a stupid mistake ive made. Might get it fixed now... watch this space...
having said that it is 2:15am here so i may go to bed soon.

EDIT: Okay, this isn't going to work, cause id have to decrypt ALL the database records and then compare the user input to them, sooo... IF you encrypt the user input again, can you compare the two encryptions? Or will the encryptions be different even if the user input is the same?

So say for example the username is Admin and thats been encrypted, if someone was to enter Admin, could i compare the 2 encryptions to check if its the same, or will they be different each time?

EDIT (again): Okay, i tested that, the encryption is different everytime, which is essentially makes this a reallll bummer, cause now, the only solution to my problem is to decrypt ALL the database records in that column and compare them, which is not going to be practical for 100+ users. I know how i would do it, id do it in a loop... but still, impractical.
Is there a better way?
Like, an secure encryption that always encrypts the same (im not sure about this, because in theory, if it always encrypts the same, surely its easier to crack??) anybody know?

Thanks, JD

This post has been edited by JoshD: 29 March 2010 - 06:26 PM

[PsychoCoder]

I took the thread you started in the Databases tutorial section (2 times even for some reason) and merged it with this post. The tutorials section is not the place t

[motcom]

Just give your database a username and password.... It's not like you are writing a program for the navy.

[JoshD]

PsychoCoder, on 29 March 2010 - 08:15 PM, said:

I took the thread you started in the Databases tutorial section (2 times even for some reason) and merged it with this post. The tutorials section is not the place t

Ahahahaha, i didn't realise i was in the tutorials section... i wandered where i posted that... hah, though i dont know how i managed to do it twice.

Motcom said:

Just give your database a username and password.... It's not like you are writing a program for the navy.

True that, but none the less i would like to learn it anyway.

i would still like a better way to do this so if any one has any suggestions please let me know, but i have put it in a loop now, and i get a different error.

For cnt = 0 To MaxRows - 1
            TextToDecrypt = ds.Tables(0).Rows(cnt).Item(1)
            decrypt()
            Username = DecryptedText
            TextToDecrypt = ds.Tables(0).Rows(cnt).Item(2)
            decrypt()
            Password = DecryptedText

            If Username = ds.Tables(0).Rows(cnt).Item(1) And Password = ds.Tables(0).Rows(cnt).Item(2) Then
                MsgBox("SUCCESS!")
                cnt = MaxRows
                valid = True
            End If
        Next

        encryptedtextbytes = Convert.FromBase64String(TextToDecrypt)
        'get the decrypted clear text byte array
        textbytes = rsa.Decrypt(encryptedtextbytes, True)
        'convert the byte array to text using the same encoding format that was used for encryption
        DecryptedText = encoder.GetString(textbytes)

Error: Error occurred while decoding OAEP padding.
Occurs on this line:

textbytes = rsa.Decrypt(encryptedtextbytes, True)

JD

This post has been edited by JoshD: 30 March 2010 - 01:51 AM

[Bort]

Hi Josh,

Welcome to DiC

Instead of using RSA encryption, with which you would have to decrypt everything too, have you ever thought about using MD5 encryption? This works one way, so you encrypt ANY data you want to check and compare it with the encrypted string in the database.

Take a look here for my tutorial on MD5. MD5 is good for things like username/passwords because, as I said, it stores encrypted data in the database, so even if someone was able to get into it, they wouldn't be able to get everyone's details.

Have you ever had to have a password reset (for email, or something like that) where you have had to call someone to arrange it? They cannot give you your password because they also use some either MD5 or something similar.

Oh, and thanks Psycho for pointing Josh at my tutorial

Hope this helps,
Bort

[JoshD]

First off, there is a small error in my code i posted previously, the if statement should look like this:

            If TxtUser.Text = Username And TxtPass.Text = Password Then

However, that has not fixed the problem.

Bort, on 30 March 2010 - 12:31 AM, said:

Hi Josh,

Welcome to DiC

Instead of using RSA encryption, with which you would have to decrypt everything too, have you ever thought about using MD5 encryption? This works one way, so you encrypt ANY data you want to check and compare it with the encrypted string in the database.

Take a look here for my tutorial on MD5. MD5 is good for things like username/passwords because, as I said, it stores encrypted data in the database, so even if someone was able to get into it, they wouldn't be able to get everyone's details.

Have you ever had to have a password reset (for email, or something like that) where you have had to call someone to arrange it? They cannot give you your password because they also use some either MD5 or something similar.

Oh, and thanks Psycho for pointing Josh at my tutorial

Hope this helps,
Bort

Fantastic, that sounds like what i was hoping to do with the RSA encryption.
I will look into that one now, thanks Bort.
And again, thanks for the RSA Encryption tutorial, though it may not be what i use at the end it was extremely clear, and extremely helpful, and im sure i will use it some other time in life =D
So here i go to look at MD5.

JD.

EDIT: Okay, Bort.
This may sound stupid, but Ive never worked with Byte Types before, so im gonna need some help. Basically, the usernames and passwords are being stored in a ms access database. So i set the database field to byte, but it didn't like it.

OOOWWW my head REALLY hurts.

Right, okay.
So, im turning text to byte right?
Then I need to store that byte into a database field.
If that database field is set to text it just says System.Byte[] or summin along those lines, and if its byte it crashes.
EDIT: Thinking about it, Can i use something like this:

Convert.ToBase64String(bytHashedData)

Please help.

EDIT: IT WORKS!
Thank you all so so so so much!!
Also, sorry, looking back over my posts, it kinda looks like i used the forum as my worksheet. Aha. As I was going i was writing here, then i was realising something else trying it, and so on so on... I got there eventually though.
Next time I will do all the working before coming back and saying im stuck! Aha.
Thanks again.
JD

This post has been edited by JoshD: 30 March 2010 - 03:24 AM