This article deals with storing passwords securely... usually in a database, but to keep things simple, we'll just use a C# dictionary instead. As part of this article, we'll cover two interesting techniques called salting and hashing. These topics can sometimes be challenging to understand - in fact you can see from my question about salting on StackOverflow that it had taken me a while to understand the benefits of salting, but it doesn't have to be that way. I am writing this article to hopefully make this fascinating subject easy to understand.
Right, so let's get to business. Create a new Console Application using SharpDevelop or whichever IDE you prefer. Add the following near the top, so that we can use dictionaries:
using System.Collections.Generic;
Just inside your class Program, before your Main() method, add the following dictionary to store our users and their corresponding passwords (see "C# Basics: Morse Code Converter Using Dictionaries" if this seems in any way new to you):
public static Dictionary<String, String> users = new Dictionary<String, String>()
{
{ "johnny", "password" },
{ "mary", "flowers" },
{ "chuck", "roundhousekick" },
{ "larry", "password123" }
};
It is now pretty simple to add a method that can check whether a given username and password result in a successful login:
public static bool Login(String username, String password)
{
if (users.ContainsKey(username) && users[username] == password)
return true;
else
return false;
}
This code first checks that the username actually exists in the dictionary, and then checks whether the corresponding password matches.
We can now test this code by replacing the contents of Main() with the following code:
public static void Main(string[] args)
{
Console.Write("Username: ");
String username = Console.ReadLine();
Console.Write("Password: ");
Console.ForegroundColor = ConsoleColor.Black;
String password = Console.ReadLine();
Console.ResetColor();
bool loggedIn = Login(username, password);
if (loggedIn)
Console.WriteLine("You have successfully logged in!");
else
Console.WriteLine("Bugger off!");
Console.ReadLine();
}
Notice that when requesting the password, we're setting the console's text colour to black. The console's background colour is also black, so the password won't show as you type, fending off people trying to spy it while looking over your shoulder.
Press F5 to try it out:
Awesome - we have just written a very simple login system.
The problem with this system is that the passwords are stored as clear text. If we imagine for a moment that our usernames and passwords were stored in a database, then the actual passwords can easily be obtained by a hacker gaining illegal access to the database, or any administrator with access to the database. We can see this by writing a simple method that shows the users' data, simulating what a hacker would see if he managed to breach the database:
public static void Hack()
{
foreach (String username in users.Keys)
Console.WriteLine("{0}: {1}", username, users[username]);
}
We can then add the following code just before the final Console.ReadLine() in Main() to test it out:
Console.WriteLine();
Hack();
This gives us all the details, as we are expecting:
This isn't a nice thing to have - anyone who can somehow gain access to the database can see the passwords. How can we make this better?
Hashing
One way is to hash the passwords. A hash function is something that takes a piece of text and transforms it into another piece of text:
A hash function is one-way in the sense that you can use it to transform "Hello" to "8b1a9953c4611296a827abf8c47804d7", but not the other way around. So if someone gets his hands on the hash of a password, it doesn't mean that he has the password.
Another property of hash functions is that their output changes considerably even with a very small change in the input. Take a look at the following, for instance:
You can see how "8b1a9953c4611296a827abf8c47804d7" is very different from "5d41402abc4b2a76b9719d911017c592". The hashes bear no relationship with each other, even though the passwords are almost identical. This means that a hacker won't be able to notice patterns in the hashes that might allow him to guess one password based on another.
One popular hashing algorithm (though not the most secure) is MD5, which was used to produce the examples above. You can find online tools (such as this one) that allow you to compute an MD5 hash for any string you want.
In order to use MD5 in our code, we'll need to add the following statement near the top of our program code:
using System.Security.Cryptography;
At the beginning of the Program class, we can now create an instance of the MD5 class to use whenever we need:
private static MD5 hashFunction = MD5.Create();
If you look at the intellisense for MD5, you'll see that it has a ComputeHash() method, which returns an array of byte, rather than a String:
We're going to do some String work, so add the following near the top:
using System.Text;
Let's write a little helper method to hash our passwords, using Strings for both input and output:
public static String Hash(String input)
{
// code goes here
}
In this method, the first thing we need to do is convert the input String to a byte array, so that ComputeHash() can work with it. This is done using the System.Text.Encoding class, which provides several useful members for converting between Strings and bytes. In our case we can work with the ASCII encoding as follows:
byte[] inputBytes = Encoding.ASCII.GetBytes(input);
We can then compute the hash itself:
byte[] hashBytes = hashFunction.ComputeHash(inputBytes);
Since we don't like working with raw bytes, we then convert it to a hexadecimal string:
StringBuilder sb = new StringBuilder();
foreach(byte b in hashBytes)
sb.Append(b.ToString("x2").ToLower());
The "x2" bit converts each byte into two hexadecimal characters. If you think about it for a moment, hexadecimal digits are from 0 to f (representing 0-15 in decimal), which fit into four bits. But each byte is eight bits, so each byte is made up of two hex digits.
Anyway, after that, all we need to do is return the string, so here's the entire code for the method:
public static String Hash(String input)
{
byte[] inputBytes = Encoding.ASCII.GetBytes(input);
byte[] hashBytes = hashFunction.ComputeHash(inputBytes);
StringBuilder sb = new StringBuilder();
foreach(byte b in hashBytes)
sb.Append(b.ToString("x2").ToLower());
return sb.ToString();
}
We can now change our database to use hashed passwords:
public static Dictionary<String, String> users = new Dictionary<String, String>()
{
{ "johnny", Hash("password") },
{ "mary", Hash("flowers") },
{ "chuck", Hash("roundhousekick") },
{ "larry", Hash("password123") }
};
In this way, we aren't storing the passwords themselves, but their hashes. For example, we're storing "5f4dcc3b5aa765d61d8327deb882cf99" instead of "password". That means we don't store the password itself any more (if you ever signed up to an internet forum or something, and it told you that your password can be reset but not recovered, you now know why). However, we can hash any input password and compare the hashes.
In our Login() method, we now change the line that checks username and password as follows:
if (users.ContainsKey(username) && users[username] == Hash(password))
Let's try this out (F5):
When the user types "johnny" as the username and "password" as the password, the password is hashed, giving us "5f4dcc3b5aa765d61d8327deb882cf99". Since the passwords were also stored as hashes in our database, it matches. In reality our login is doing the same thing as it was doing before - just that we added a hash step (a) when storing our passwords and (b) when receiving a password as input. Ultimately the password in our database and that entered by the user both end up being hashes, and will match if the actual password was the same.
How does this help us? As you can see from the hack output (last four lines in the screenshot above), someone who manages to breach the database cannot see the passwords; he can only get to the hashes. He can't login using a hash, since that will in turn be hashed, producing a completely different value that won't match the hash in the database.
Although hashing won't make the system 100% secure, it's sure to give any potential hacker a hard time.
Salting
You may have noticed that in the example I used, I had some pretty dumb passwords, such as "password" and "password123". Using a dictionary word such as "flowers" is also not a very good idea. Someone may be able to gain access to one of the accounts by attempting several common passwords such as "password". These attempts can be automated by simple programs, allowing hackers to attempt entire dictionaries of words as passwords in a relatively short period of time.
Likewise, if you know the hash for common passwords (e.g. "5f4dcc3b5aa765d61d8327deb882cf99" is the hash for "password"), it becomes easy to recognise such passwords when you see the expected hash. Hackers can generate dictionaries of hashes for common passwords, known as rainbow tables, and find hashes for common words used as passwords.
We can combat such attacks by a process known as salting. When we compute our hashes, we add some string that we invent. This means changing the first line of our Hash() function as follows:
byte[] inputBytes = Encoding.ASCII.GetBytes("chuck" + input);
Both the database password and the one entered by the user will be a hash of "chuck" concatenated with the password itself. When the user tries to login, it will still work, but look at what happens now:
The login worked, but the hashes have changed because of the salt! This means that even for a password as common as "password", a hacker cannot identify it from the hash, making rainbow tables much less effective.
Summary
This article described how to store passwords securely. It started off by doing the easiest and worst thing you can do: store them as clear text. A hash function was subsequently introduced, to transform the passwords into text from which the password cannot be retrieved. When a user logs in, the hash of the password he enters is compared with the password hash stored in the database.
Finally, the hashes were salted, by adding an arbitrary piece of text to them, in order to transform the hashes into different values that can't be used to identify common passwords.
I hope this made password security a little easier to understand. Please come back again, and support us by sharing this article with your friends, buying games from GOG.com, or any of the other ways described in the "Support the Ranch" page.
