How to convert byte to readable string in C#?

Question

1.00/5 (1 vote)

See more:

C#

foreach (DataRow row in dt.Rows)
{
   username = row["USERNAME"].ToString();
   byte[] bytePassword = (byte[])row["PASSWORD"];
   decryptPassword = Encoding.Default.GetString(bytePassword, 0, bytePassword.Length-1);

   password = row["PASSWORD"].ToString();                    
}

string result = "This is my "+ username +" action..." + password + " : " + decryptPassword;

The result is

This is my TEST action...System.Byte[] : ‡½³wã.ç r…)©K‡n‰‚ò¹5y ÌE_0Ây™ âGâ)÷XXp@hÇ†‘,MÛÀy(ÓÊÕþB

I cannot seem to decode the password using System.Text.Encoding

I need to decrypt the PASSWORD then encrypt it again just so it could be saved in the database.

What I have tried:

stackoverflow.com
social.msdn.microsoft.com
stackoverflow.com

Posted 4-Mar-19 4:01am

Michelle Anne Rigor

Updated 4-Mar-19 4:57am

v3

Add a Solution

Comments

[no name] 4-Mar-19 10:21am

You have no business "decrypting" passwords. In your situation, you should simply be copying whatever is there "to save it in the database".

Michelle Anne Rigor 4-Mar-19 10:58am

As you can see in the code, when I get the PASSWORD at the DB it is displayed as System.byte[]. And there is a major security issue when the password is not encrypted in the DB.

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard MacCutchan · Answer 1 · 2019-03-04T04:34:00

Solution 1

See Secure Password Authentication Explained Simply[^].

Posted 4-Mar-19 4:34am

Richard MacCutchan

OriginalGriff · Answer 2 · 2019-03-04T04:54:00

Solution 2

What makes you think that a password is encrypted?
It shouldn't be: that's insecure, nearly as bad as storing it in plain text.
And System.Text.Encoding has nothing whatsoever to do with encryption - it's a translation, is all.
Passwords should be hashed, not encrypted - specifically so thay cannot be "reversed" back to the original input.
See here: Password Storage: How to do it.[^]

Posted 4-Mar-19 4:54am

OriginalGriff

v2

Comments

Michelle Anne Rigor 4-Mar-19 10:59am

The password is encrypted in the SQL Server. I needed a way to fetch the data as is and decrypt it in the C# code.

OriginalGriff 4-Mar-19 11:03am

Who encrypted it?

Dave Kreskowiak 4-Mar-19 11:16am

Password should NEVER be encrypted, only hashed.

You have the bytes from the database, but if you don't know what alogirthm(s) were used to encrypt the passwords, and any keys involved in the process, you have no hope of decrypting them.

Using an Encoder is not going to magically decrypt them. Encoding just specifies how the bytes are interpreted to generate a string from them.

OriginalGriff 4-Mar-19 11:21am

I suspect it is hashed: the data length he shows is suspiciously close to 512 bits, which could imply SHA512 hashing.
Why do I suspect nefarious intent here? :laugh:

Dave Kreskowiak 4-Mar-19 11:24am

I have the same suspicions. That number of bytes in his example makes for a really long password, even in Unicode.

Michelle Anne Rigor 5-Mar-19 2:46am

This is where the DB Manager learned to encrypt the password: How to Encrypt He informed me that he used: Deterministic

Dave Kreskowiak 5-Mar-19 8:42am

Great. Only the database engine can decrypt the password, and that video shows you exactly how to do it do you can see it in your code.

Michelle Anne Rigor 5-Mar-19 8:49am

I have researched that I can decrypt the Password but I need to get the Windows Certificate Store from the DB Manager then install that certificate at my machine. Thank you for the help tho. :)

Dave Kreskowiak 5-Mar-19 9:15am

Uh, no, you don't. That video shows you exactly what you have to do to get the database to tell you the unencrypted password, and it doesn't involve putting the certificate on your machine. The answer is LITERALLY IN THE VIDEO, but, it's quickly glossed over. Pay attention to the connection string.

Michelle Anne Rigor 5-Mar-19 9:24am

Yeah I did add the "Column Encryption Setting = Enabled" in the connection string. But I keep getting this error after adding that to my Web.config. This is the error: "System.Data.SqlClient.SqlException
HResult=0x80131904
Message=Failed to decrypt column 'PASSWORD'.
Failed to decrypt a column encryption key using key store provider: 'MSSQL_CERTIFICATE_STORE'..."

Dave Kreskowiak 5-Mar-19 11:00am

Now we're getting to the real problem. What does the rest of the error message say?

Michelle Anne Rigor 5-Mar-19 11:01am

This is the full error message:

System.Data.SqlClient.SqlException
HResult=0x80131904
Message=Failed to decrypt column 'PASSWORD'.
Failed to decrypt a column encryption key using key store provider: 'MSSQL_CERTIFICATE_STORE'. The last 10 bytes of the encrypted column encryption key are: '13-83-2C-7F-9B-A6-B9-5F-77-FD'.
Certificate with thumbprint 'AD8B4BD5A471925308407A912D31E0FADFB8202E' not found in certificate store 'My' in certificate location 'CurrentUser'. Verify the certificate path in the column master key definition in the database is correct, and the certificate has been imported correctly into the certificate location/store.
Parameter name: masterKeyPath
Source=.Net SqlClient Data Provider
StackTrace:
<cannot evaluate="" the="" exception="" stack="" trace="">

Inner Exception 1:
ArgumentException: Certificate with thumbprint 'AD8B4BD5A471925308407A912D31E0FADFB8202E' not found in certificate store 'My' in certificate location 'CurrentUser'. Verify the certificate path in the column master key definition in the database is correct, and the certificate has been imported correctly into the certificate location/store.
Parameter name: masterKeyPath

Dave Kreskowiak 5-Mar-19 11:11am

OK, from what I'm seeing on the 'net, you need the certificate that was installed on the SQL Server AND you need to export both the public and private keys on the server that were generated when the encryption was turned on for that column.

You then have to install the certificate and the the keys on the machine that's going to query for the password.