Encryption

LondonLad · Joined: 04 Oct 2007 Posts: 31

Hi
I have a program that encrypts its password and stores this in the
registry.(OK I know this is not rocket science) but what I want to know is,
could I store this in the registry as a string of *
Convrt it like the PasswordChar does with VB Textbox and then change it back
to the encrypted Chars to Decrypt?

Archived from group: microsoft>public>vb>general>discussion

MikeD · Joined: 04 Oct 2007 Posts: 3348

"LondonLad" wrote in message @microsoft.com...
> Hi
> I have a program that encrypts its password and stores this in the
> registry.(OK I know this is not rocket science) but what I want to know
> is,
> could I store this in the registry as a string of *
> Convrt it like the PasswordChar does with VB Textbox and then change it
> back
> to the encrypted Chars to Decrypt?

No. If you save it to the registry (or whereever) as a string of *
characters, then that's all you're gonna get back when you read it. The
textbox caches the actual string and just displays the password chars. It
doesn't "convert" anything. Or at least that's what I presume.

--
Mike
Microsoft MVP Visual Basic

Larry Serflaten · Joined: 04 Oct 2007 Posts: 2644

"LondonLad" wrote
> I have a program that encrypts its password and stores this in the
> registry.(OK I know this is not rocket science) but what I want to know is,
> could I store this in the registry as a string of *
> Convrt it like the PasswordChar does with VB Textbox and then change it back
> to the encrypted Chars to Decrypt?

A. No, the characters aren't converted, the textbox hides them by showing only
the PW character. When you check its text property, the actual characters
are returned.

B. Don't decrypt the passwords. Let the user enter what they will, and encrypt
that for saving to the Registry. When you go to validate, again let the user
type in what they will and you again encrypt that. Then compare the two
encrypted values....

LFS

Richard Mueller [MVP] · Joined: 04 Oct 2007 Posts: 49

"LondonLad" wrote in message @microsoft.com...
> Hi
> I have a program that encrypts its password and stores this in the
> registry.(OK I know this is not rocket science) but what I want to know
> is,
> could I store this in the registry as a string of *
> Convrt it like the PasswordChar does with VB Textbox and then change it
> back
> to the encrypted Chars to Decrypt?

As noted, there should never be any need to decrypt the passwords. Even
better is to use a hash function. This is like encryption except it is very
difficult (hopefully impossible) to reverse. You compare hashed values to
determine if the user provided the correct password. Given the hashed value
you cannot determine the plaintext password.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

LondonLad · Joined: 04 Oct 2007 Posts: 31

Hi Richard
Thanks all for your posts, at the moment I decrypt to check the password,
but I will change to take on board Larry's point. But I am very interested in
your point on hashed values can you give me a snippet of code to work from
please.

"Richard Mueller [MVP]" wrote:

>
> "LondonLad" wrote in message
> @microsoft.com...
> > Hi
> > I have a program that encrypts its password and stores this in the
> > registry.(OK I know this is not rocket science) but what I want to know
> > is,
> > could I store this in the registry as a string of *
> > Convrt it like the PasswordChar does with VB Textbox and then change it
> > back
> > to the encrypted Chars to Decrypt?
>
> As noted, there should never be any need to decrypt the passwords. Even
> better is to use a hash function. This is like encryption except it is very
> difficult (hopefully impossible) to reverse. You compare hashed values to
> determine if the user provided the correct password. Given the hashed value
> you cannot determine the plaintext password.
>
> --
> Richard Mueller
> Microsoft MVP Scripting and ADSI
> Hilltop Lab - http://www.rlmueller.net
> --
>
>
>

Michael Cole · Joined: 04 Oct 2007 Posts: 79

LondonLad wrote:
> Hi Richard
> Thanks all for your posts, at the moment I decrypt to check the
> password, but I will change to take on board Larry's point. But I am
> very interested in your point on hashed values can you give me a
> snippet of code to work from please.

If you want to decrypt the password, then you can't use a hash. Do an
internet search on "hash algorythm" - lots of available reading...

--
Regards,

Michael Cole