SQL Server 2005 Encryption and Decryption

hykyit · September 4th, 2006, 02:57 PM

Hi,

As the title says, I am looking for help for password encryption and decryption using SQL Server 2005.. I found some functions such as pwdencrypt(), pwdcompare() (both doesnt work), and now I am trying out the Asymmetric Key method.. But I am encountering some problems here.. Btw, I am hardcoding the username and password into the database..

Here is my table:-

Code:

CREATE TABLE UserLogin
(
  Username varchar(25),
  Password varchar(25)
)

Insertion:-

Code:

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'p@ssw0rd';

CREATE ASYMMETRIC KEY Asym_Password
WITH ALGORITHM = RSA_512;

DECLARE @encryptedstuff VARCHAR(25);
SELECT @encryptedstuff = EncryptByAsymKey(AsymKey_ID('Asym_Password'), N'password');

INSERT INTO UserLogin
    (Username, Password)
VALUES ('admin', @encryptedstuff);

I think there should be no problem so far... I think the problem is when I try to compare the username and password..

My Query to retrieve user with correct password:-

Code:

SELECT Username 
FROM UserLogin 
WHERE CAST(DecryptByAsymKey(AsymKey_ID('Asym_Looney_Tunes'), Password) as VARCHAR) = 'password' 
AND Username = 'admin';

I might have done something wrong here because it doesnt seem to return the username at all.. Any help will be appreciated a lot!! Thanks in advance!!

David_the_DBA · September 7th, 2006, 04:30 PM

Several problems:
1) Your key names did not match
EncryptByAsymKey(AsymKey_ID('Asym_Password')
DecryptByAsymKey(AsymKey_ID('Asym_Looney_Tunes')

2) Your input and output datatypes don't match up
You are inputing nvarchar (N'password') and trying to get out varchar (CAST(... as VARCHAR))

3) You are truncating the encrypted text and storing it in a less preferrable data type.
try varbinary(8000) since this is what all of the encrypt by functions return
Do a SELECT EncryptByAsymKey(AsymKey_ID('Asym_Password'), 'password'); and see how long the output is (in this case it is 128 bytes long)

Like this:

use master
go
drop database testdb2
go
create database testdb2
go
use testdb2
CREATE TABLE UserLogin
(
  Username varchar(25),
  Password varbinary(8000)
)

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'p@ssw0rd';

CREATE ASYMMETRIC KEY Asym_Password
WITH ALGORITHM = RSA_512;

DECLARE @encryptedstuff varbinary(8000);
SELECT @encryptedstuff = EncryptByAsymKey(AsymKey_ID('Asym_Password'), 'password');

INSERT INTO UserLogin
    (Username, Password)
VALUES ('admin', @encryptedstuff);

SELECT Username , Password
,DecryptByAsymKey(AsymKey_ID('Asym_Password'), Password)
,CAST(DecryptByAsymKey(AsymKey_ID('Asym_Password') , Password) as VARCHAR)
FROM UserLogin
WHERE CAST(DecryptByAsymKey(AsymKey_ID('Asym_Password'), Password) as VARCHAR) = 'password'
AND Username = 'admin';

David Lundell
Principal Consultant and Trainer
www.mutuallybeneficial.com

Vadivel · September 24th, 2006, 08:33 PM

May be you want to check my blog post on this topic >> http://vadivel.blogspot.com/2005/08/...ql-server.html

MVP SQL Server
http://vadivel.blogspot.com