How To Encrypt The ViewState Using SHA1 Or Some Other Algorithm
Jan 22, 2011
I heard that .NET framework will encrypt the ViewState using SHA1 or some other algorithm. So if i know the SHA1 encryption and decryption algorithm can i tamper a ViewState?I mean a malicious user studies SHA1 encryption algorithm,if he understand that algorith and develops decryption algorithm ,will it open the road of viewstate tampering? or SHA1 or other algorithm uses any random tricks for encryption and decryption?
i want to encrypt the password by using the encryption algorithm dll uploaded by the user. is it possible to do the action. how can i call the method used by the user to create the dll.
I have an asp.net page where I have used FormsAuthentication.HashPasswordForStoringInConfigFile. Encrypted password is saved in database. I have created a forgotPassword page. Where I need to send user his password. How can I decrypt it and send it to user. if SHA1 can not be decryoted what other option should I use to encrypt the passwords?
So, I am the approach David Hayden posted on his blog [URL] to create a salt and hash the user's password by taking the user's raw password and the generated salt and using SHA1 to hash the value. I then store the salt and the hashed password in the database. zhe website is currently load balanced, so I was wondering if resulting hash value would be the same for both servers. Here is the snippet of code posted on David Hayden's blog:
private static string CreateSalt(int size) { //Generate a cryptographic random number. RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider(); byte[] buff = new byte[size]; rng.GetBytes(buff); // Return a Base64 string representation of the random number. return Convert.ToBase64String(buff); }
I have a problem .I am using CAPICOM for digitally sign the data and for this purpose i am using SHA1 algorithm.In CPICOM there is one class CAPICOM.SignedData which is used for this purpose.My problem is how can i give SHA1's hashed data to this class (to it's sign method) for returning the digital signature of exactly 172 bit long?
Now here is the weird thing. First i am running it locally on the built in vs2008 web server.I load my control in fine, do a postback from a linkbutton, locally on my machine it all works fine, no issue.However when it goes onto my host, it falls over with the message:
Failed to load viewstate. The control tree into which viewstate is being loaded must match the control tree that was used to save viewstate during the previous request.Now i also load controls dynamically and use postbacks and things in the admin area of the site...and that works fine, however my front end just keeps failing? See the code behing below:
I have been getting this error a lot lately with some of my users, and I had a couple of concerns with view state and I have read so many articles but I am still lost..
1. I use masterpage on all the pages and I need viewstate for some of the pages but..
There is a page where a user will fill out the information and then submit this data to a cgi server, and it is where I get most of the Client Disconnected errors, what would happen if I disable viewstate when they click on that button?
Now when a user browses from one page to another, does the view state from the previous page get deleted? If not how would I delete it?
Does the master page have its own viewstate? Would I be able to make sure none of items on my master page are using the viewstate?
I have a shopping cart page (Cart.aspx) that has a button that will (sometimes) post to a third party payment gateway, if payment is necessary. The payment gateway will process the payment and then do a silent post to my website (Order.aspx) so I can update the order status.
Order.aspx always throws an invalid viewstate error, even though viewstate is disabled on the page.
What's happening is that Cart.aspx (which has viewstate enabled) posts to the payment gateway, and the gateway will post it back as part of the silent post. Even though Order.aspx has viewstate disabled and validation disabled, it still tries to validate the __viewstate field it's being given.
I know setting EnableViewState=false will disable the rendering of the __viewstate field, but if another page provides the field, shouldn't it still skip validation? I tried calling ViewState.Clear() on the Page_Init event of Order.aspx, but ViewState is apparently empty. how to get around this? I don't want to disable ViewState on Cart.aspx (in some cases it may be necessary), but I can't figure out how to clear it on Order.aspx.
PasswordDeriveBytes take 4 paramteres and return an encrypted key basead on 4 parameters: passPhrase, saltValue, hashAlgoithm and password iteration
I wonder what algorithm PasswordDeviveBytes are using, so I can tell someone who are not .NET programmer that this secretkey was made by that alogorithm and that he can use this algorithm also - And then he should get the same results as PasswordDeriveBytes method
We are converting an ASP site (using DotNetNuke) to a new PHP site. The only thing we have right now is a full export of the existing database. One of the tables is called "aspnet_Membership" and contains the following fields:
Password (looks like base64) PasswordFormat (always value 2) PasswordSalt (looks like base64) PasswordQuestion (always empty) PasswordAnswer (always empty)
We would like to decode these passwords and hash them to fit our own framework. From what I understand from the .NET documentation these kind of passwords can be decrypted. Is there an algorithm available that can do this or is it more complicated than that? Will it be possible if we create an ASP script on the current server?
can I change the password algorithm and still use the sqlMembershipProvider or do I have to create a new sqlMembershipProvider. If so, are they any step by step tutorials on how to do that.
I need an algorithm to determine who match who in the tournament bracket, say I have 32 ( number could be flexible) contestants seeded 1 to 32, at round 1, seed 1 matches with 32, seed 2 with 31 and so forth. What about 2nd, 3rd, 4th and 5th round? I need an algorithm to be programmed into computer.
Using sha As New SHA256Managed Using memStream As New MemoryStream(Encoding.ASCII.GetBytes("Hello World!")) Dim hash() As Byte = sha.ComputeHash(memStream) Dim res As String = Encoding.Default.GetString(hash) End Using End Using
I have been unable to recreate the same hash for the same values with these two bits of code.
The javascript implementation returns: 7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069
and the vb.net example returns: ƒeñüS-ÁHÖ]ü-KÖw(JÝÒ mi"
What am I missing? I assume it's something to do with the character encoding?
I need an example on how to implement AES encryption/decryption in .NET. I've been googling but haven't yet found any good examples. I've for example found AES example whih after some research wasn't 100% AES. I have to make sure by AES encryption/decryption is 100% AES, as I have to send email to the authorities explaining how I use AES (with secret key all), so they can hire some encryption expert which verify that we encrypt/decrypt it correctly. So he can verify that the what I implemented in AES is actually 100%. I'm reading the AES standard and how it's to be implemted in .NET Here is some code I'm having trouble with:
[Code]....
Which throws an CryptographicException: Specified key is not a valid size for this algorithm.
SSCC The check digit calculation uses the standard method. Suppose you want to calculate the check digit for ID number 10614141192837465.
Step One: From the right to left, start with odd position, assign the odd/even position to each digit.
Index 1 2 3 4 5
Digit 1 0 6 1
Position odd even odd even
Step Two: Sum all digits in odd position and multiply the result by 3. (1+6+4+4+1+2+3+4+5)*3=90
Step Three: Sum all digits in even position. (0+1+1+1+9+8+7+6)=33
Step Four: Sum the results of step three and four: 90+33=123
Step Five: Divide the result of step four by 10. The check digit is the number which adds the remainder to 10. In our case, divide 123 by 10 we get the remainder 3. The check digit then is the result of 10-3=7.
I'm trying to get a decent sorting algorithm for my products database. Users can vote for their products with using scores from 0 to 5 (.5 scores are also possible like 2.5). My table structure currently looks like this:
Whenever a user votes I'm calculating the finalscore very simple like (TotalPoints / NumberOfVotes) = FinalScore. Then I sort the table on FinalScore and NumberOfVotes.Now while this works it's not excactly fair because a product which has only 1 vote of 5 stars can easily come in top rankings.I admit I'm not very good at statistics or algorithms to get a fair product listing and what I'm looking for is something which is not over the top diffucult but which is more fair then the method I'm using now.
I have a legacy MySQL database which stores the user passwords & salts for a membership system. Both of these values have been hashed using the Ruby framework - roughly like this:
So both values are stored as 40-character strings (varchar(40)) in MySQL. Now I need to import all of these users into the ASP.NET membership framework for a new web site, which uses a SQL Server database. It is my understanding that the the way I have ASP.NET membership configured, the user passwords and salts are also stored in the membership database (in table aspnet_Membership) as SHA1 hashes, which are then Base64 encoded (see here for details) and stored as nvarchar(128) data.
But from the length of the Base64 encoded strings that are stored (28 characters) it seems that the SHA1 hashes that ASP.NET membership generates are only 20 characters long, rather than 40. From some other reading I have been doing I am thinking this has to do with the number of bits per character/character set/encoding or something related.
So is there some way to convert the 40-character SHA1 hashes to 20-character hashes which I can then transfer to the new ASP.NET membership data table? I'm pretty familiar with ASP.NET membership by now but I feel like I'm just missing this one piece. However, it may also be known that SHA1 in Ruby and SHA1 in .NET are incompatible, so I'm fighting a losing battle.
I have a page that will receive an encrypted query string containing a user name, password & jobId, the problem is I don't want someone to be able to grab the encrypted url (browser history) and reuse it, so it has to change each time the page is requested.
The only way I can think of doing this is by having an encryption key associated with the the job and then change it after each time the page is requested. The client would either request the key or the entire url from a web service residing on my server.
Is this the best way to do this?
Is there a mutating encryption method out there I could use "out the box"?
Ranking of CONTAINSTABLE StatisticalWeight = Log2( ( 2 + IndexDocumentCount ) / KeyDocumentCount ) Rank = min( MaxQueryRank, HitCount * 16 * StatisticalWeight / MaxOccurrence ) can anyone explain this algorithm, more importantly i want to know about these variables used in this algorithm, whats their purpose?it would be more useful for me?
I am rewriting my PHP website into C# .NET, and I need to be able to set the algorithm used by the CreateUserWizard / Membership Provider to SHA1 so that I can port all of the user accounts over without having to force them all to reset their passwords when this project is complete. At current glance it doesn't look like it is using SHA-1, and my Googlefoo is failing me.
