Click here to Skip to main content
15,906,097 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Dear Friends:

I need help from friends that publish some softwares. however, any comment will be appreciated.
If you want to sell your software what is your best method for encrypting sensitive information in its SQL bank? please provide me a solution that you have used in your software (I mean something that will work and reduce the vulnerably attacks in much extent).

Yours
Posted
Updated 16-Jul-12 3:28am
v3

See this article Simple encrypting and decrypting data in C#[^] for encryption/decryption of strings. I use sort of same solution and it works great.
The only "downside" is that you can't query this data from solution explorer in sql. Like
SELECT * FROM Table WHERE EncryptedValue = 'hello'
You will have do encrypt string to query.
SELECT * FROM Table WHERE EncryptedValue = 'encryptedValueFromCode'
 
Share this answer
 
C#
public string Encrypt(string Data, string Password)
        {
            byte[] clearBytes = System.Text.Encoding.Unicode.GetBytes(Data);


            PasswordDeriveBytes pdb = new PasswordDeriveBytes(Password,


                new byte[] { 0x00, 0x01, 0x02, 0x1C, 0x1D, 0x1E, 0x03, 0x04, 0x05, 0x0F, 0x20, 0x21, 0xAD, 0xAF, 0xA4 });
            MemoryStream ms = new MemoryStream();

            Rijndael alg = Rijndael.Create();
            alg.Key = pdb.GetBytes(32);

            alg.IV = pdb.GetBytes(16);
            CryptoStream cs = new CryptoStream(ms, alg.CreateEncryptor(), CryptoStreamMode.Write);

            cs.Write(clearBytes, 0, clearBytes.Length);
            cs.Close();
            byte[] encryptedData = ms.ToArray();
            return Convert.ToBase64String(encryptedData);


        }

        public string Decrypt(string Data, string Password)
        {
            byte[] clearBytes = Convert.FromBase64String(Data);


            PasswordDeriveBytes pdb = new PasswordDeriveBytes(Password,


                new byte[] { 0x00, 0x01, 0x02, 0x1C, 0x1D, 0x1E, 0x03, 0x04, 0x05, 0x0F, 0x20, 0x21, 0xAD, 0xAF, 0xA4 });
            MemoryStream ms = new MemoryStream();

            Rijndael alg = Rijndael.Create();
            alg.Key = pdb.GetBytes(32);

            alg.IV = pdb.GetBytes(16);
            CryptoStream cs = new CryptoStream(ms, alg.CreateDecryptor(), CryptoStreamMode.Write);

            cs.Write(clearBytes, 0, clearBytes.Length);
            cs.Close();
            byte[] decryptedData = ms.ToArray();
            return System.Text.Encoding.Unicode.GetString(decryptedData);


        }
 
Share this answer
 
Comments
Mmohmmad 17-Jul-12 0:59am    
Dear Henington:

thanks for your reply. do you think this method is sufficient for a software that will be publish to a public?

YOurs
It all depends on what you want to do with your data:

If you only want to check if the value entered is correct (like passwords) then a SHA1 operation would work perfectly and without hassle.

If you want to get the data back, then don't hash it, use any library out there that could offer you the level of encryption that you are looking for.

You should explain that at the beginning in order to get better help.

Good luck...
 
Share this answer
 
Comments
Mmohmmad 16-Jul-12 3:34am    
Dear Joan:

Thanks for your reply. I want to get data back so I should use symetric or asymetric algorithms. however, with these algorityms a hacker can access our data. I already should mention that I do not want 99 percent security.
if we consider the security from path 1 to 10 I want 7. What is your suggestion or solution? Is it necessary to use user-defined algorithm or just use build-in algorithms?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900