Hashing a Non-Password in Web.Config - Possible? 1

[GacUtil]

I need to store a hashed value in a web application, presumably in the web.config file. In researching thusfar, I've found the article referenced below which deals with hashing passwords in the web.config. However, I cannot find a way to hash a non-password value in web.config.

http://msdn.microsoft.com/library/d...ssHashPasswordForStoringInConfigFileTopic.asp

Is it possible to hold a hashed, non-password value in web.config?

Thanks.

 

[BoulderBum]

You sure can! Check out the System.Security.Cryptography namespace, particularly the SHA256Managed, SHA384Managed, or SHA512Managed class.

http://msdn.microsoft.com/library/d...curityCryptographySHA256ManagedClassTopic.asp

 

[GacUtil]

Wow - Thanks for that great info, BoulderBum.

In reading through the documentation and looking at the namespace members, I don't see a way to 'decrypt' a hash to obtain the original value. Do you know if it is possible to decrypt something once it is encrypted?

Thanks again for your help.

 

[BoulderBum]

For decrypting something, you don't want to use a hashing algorithm. What hashing does is perform a calculation against the input to come up with a unique value that you can't decrypt.

For instance, if you have number values for each letters 'A', 'B', and 'C' which are 1, 2, and 3 respectively, then we could say the "hash" of ABBC is equal to 8 (i.e. 1 + 2 + 2 + 3). Thus, every time we run ABBC through our simple "hashing algorithm" we get the same value: 8.

Notice, however, that if we have the value 8, we can't conclusively tell if the text used to come up with the "hash" was actually "ABBC". After all, it could have just as easily been "BBBB" or "CCB" or "AAAAAAAA", thus we have no way to "unencrypt" the hash value 8.

In actual hashing algorithms, the process is much more complex and they make it a goal to avoid "collisions" (which are different inputs producing the same hash), but the point is that a hash is unencryptible (and that's how they like it!).

In this way, if a user enters their password, you can check if the password is correct by running it through the hash (to see if the input produced the correct value), but your password storage mechanism is secured because even if the data store was hacked, the hash value is useless to the attacker: the actual password is safe because it's not actually stored anywhere.

If you have to be able to decrypt the value, you may want to check out 3DES or RSA encryption.

http://msdn.microsoft.com/library/d...ytripledescryptoserviceproviderclasstopic.asp

http://msdn.microsoft.com/library/d...ographyrsacryptoserviceproviderclasstopic.asp

 

[GacUtil]

This is very good stuff to know. Thanks again for your help in explaining everything.