Security :: Getting "Invalid Data" While DES-decrypting?
Mar 10, 2011
I'm trying a simple encryption procedure, encrypting/decrypting a HEX value. Encryption seems to work fine: result of encryption is "85772B6784BC1505". While trying to decrypt I get an "Invalid data"-exception.
CODE:
Dim x1 As UInt64 = DES.DES_EncryptCode("&H" & "0123456789ABCDEF")
Dim x2 As UInt64 = DES.DES_DecryptCode(x1)
Private Shared KEY_64() As Byte = {7, 6, 5, 4, 3, 2, 1, 0}
Private Shared IV_64() As Byte = {0, 1, 2, 3, 4, 5, 6, 7}
I have a webApplication in which i want to encrypt the data using Public key and whan it reach to the destination webapplication it will decrypted there with corresponding private key . Is there is any way to creating this pair of key?
I have a problem hopefully someone out there will steer me in the right direction.
I have a web application that I am going to put on a standalone cd - currently the data is "Safe" because the database is in in the app folder and the code is located in the codebehind.
My problem is i'm putting this on a CD as a standalone site, anyone can access the database, or find the XML....
Is there a way to generate an encrypted Database / XML Page, that is complied with the CD, that the program can decrypt and access with a embedded key?
I want to encrypt the password entered by the user....how do i go about it?is there any built-in function for it or will i be required to write a code for it?
I received some code, a small c# asp.net application which manually posts a shared username/pwd to a 3rd party website for auto-logins from our intranet site. During transit the password is encrypted, but not within the application. Within this application a namevaluecollection is used and the username and password are hard coded. Originally the thought was, who cares if its hard coded because its shared between everyone anyway. Now we want to encrypt the username and password from within the application. I'm not sure the best way to accomplish the goal of making sure the password is encrypted "at rest". Normally I've seen passwords stored and encrypted within a database. I know we'll obviously have to move the password out of the application and store it somewhere else, I'm just not sure where. Do we move the username and pwd to the web.config file? I really am not sure the best way to approach this.
When i try to encrypt it goes fine.. but when i right after try to decrypt it i get an:"Length of the data to decrypt is invalid" error... the error occours when i try to run the code FlushFinalBlock();here is my code:
I have an internal web application which uses a custom encryption class to convert strings to varbinary(50) columns in SQL. When I display the table in a GridView, I want to use the RowDataBound event to decrypt the encrypted column back to a string to display.
Currently I have the following in my RowDataBound event:
[Code]....
This throws an exception when I try to load the page: TransformFinalBlock - Length of the data to decrypt is invalid.
I have tried just fetching the data from SQL in my query but the e.Row.Cells(3).Text evaluates to System.Byte[], so I tried using CAST([EncrytedColumn] AS varchar(50)) to convert the varbinary(50) to varchar(50), but this still resulted in the same exception being thrown.
My only solution so far has been to manually fetch the SQL data into a DataTable and decrypt the column before displaying it in the GridView, but I prefer the automated method of binding the SQLDataSource to the GridView.
I am using encryption/decryption logic from the following link: [URL] Code from this page is working but at times, its throwing an error while decyption as 'Length of the data to decrypt is invalid'. I have a very limited knowledge on this topic so I am no able to troubleshoot it further
I have all application errors sent to my email. I keep getting this:
mysite.com/webresource.axd?d=yacsx7hz0irzn_i7ifr3morrek9u6srdkqxsjvpn3mw1&t=633598204507656250 Padding is invalid and cannot be removed.
[Exception Info]
Stack Trace: at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) at System.Security.Cryptography.CryptoStream.FlushFinalBlock() [code]....
i googled and read to add machineKey in my web.config <system.web> which i did: <machineKey validationKey='0EFA95136AEA44850D5CEDDF0CC7502B1A009.....' decryptionKey='E88EB13ADB2C3D395193AA71DBB1E...' validation='SHA1'/>
and added <pages masterPageFile enableViewStateMac="true" viewStateEncryptionMode="Auto"> to my masterpage.But i keep getting that error.
I have an asp.net database which has users table. In this table password is saved as sncrypted. Now, I am creating my own users table. I want to copy user's data from my old table t this table. I can to decrypt old users table password. Which encryption technique is used by default in aspnet database for passwords.
I am using following code to encrypt and decrypt files. It works fine in windows application but shows an error in asp.net class. It's using Riijandael method.
Error : padding is invalid and cannot be removed
Code:Public Sub EncryptOrDecryptFile(ByVal strInputFile As String, _ ByVal strOutputFile As String, _ ) [code]....
Since installing the security patch for the ASP.NET Oracle Padding vunerability any user that was keeping themselves logged in to our site is getting error messages when hitting any page.
With custom errors switched off a user sees the following information
Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
I have IIS on S2k8 and a website with Windows Authentication only.
I can easily reproduce the following scenario, where HttpContext.Current.Request.LogonUserIdentity.Name has a bad value:
Login to website using FireFox, using an Active Directory account "user" (I could use IE to reproduce the same, but it's a few extra steps)Display <%=System.Web.HttpContext.Current.Request.LogonUserIdentity.Name%> on the pageIt shows "DOMAINuser", which is correctI go into Active Directory and rename the account to be "userX" instead of "user" (both SAMAccountName & UPN)Restart FireFoxLogin to website using "userX" accountThe page still shows "DOMAINuser", instead of the expected "DOMAINuserX"
It seems almost as if IIS has cached the old username and it's not showing me the new one, even though I explicitly enter it in the login prompt.
A bit more background info as suggested:I'm finsihing of an Intranet CMS web app where I have to use the products API (ASP.NET based). Because of time constraints and issues with Windows authen' I need another way to ensure staff do not need to re login everytime they visit the site to view personalised content. The way it works is that once a user logs in (username/password), a Session ID storing a new different Security context value is generated that is used to display the personalised content. The API login method called uses the username and password as parameters. The only way I can think of automatically logging in the next time the staff visits the site is by storing the password in a enrypted cookie and checking of its existing when the site is visited and then calling the API login method using the username and decrypted password cookie values.Any other ideas as an alternative welcomed.'m using some code found on the web to encrypt and decrypt a password string. It encrypts fine but when it calls the code below to decrypt the string it throws the error "Length of the data to decrypt is invalid" How can I resolve this?
We have a problem regarding decrypting the web.config... We encrypted the web.config in computer A. but we need it to decrypt it in computer B.
we got an error
"Failed to decrypt using provider 'DataProtectionConfigurationProvider'. Error ssage from the provider: Key not valid for use in specified state. (Exception om HRESULT: 0x8009000B) (D:WCFSearchweb.config line 17)
Key not valid for use in specified state. (Exception from HRESULT: 0x8009000B) Failed!"
we also tried the RSAProtectedConfigurationProvider and we're not able decrypt also...
I search google and found this unfortunately we can't decrpyt it... How do i include the key? do i need to copy and paste it?
I'm working on an ASP.NET project for the first time in about three years; in the meantime I've been working with Python/Django, PHP and Obj-C. Anyways, picked it right back up... except something that is totally killing me right now, and I have a feeling it must be staring me in the face:
I'm trying to bind to an LDAP server, for the purpose of authenticating users. The way it works here is, you bind on your own credentials, use that to find the Distinguished Name of the user you're authenticating, then you bind again on their DN and their password. If the bind is successful, the password was correct and the user can be authenticated.
Here's the problem - the first bind (on the fixed credentials, the ones with the ability to search for users and their subtrees) works fine. The search works fine. The second bind fails, no matter what, with the LDAP error INVALID_CREDENTIALS. This happens even when completely valid credentials are supplied.
Here's the code, with the usernames and passwords redacted, of course...
Since we updated our website to .NET 4.0, users using a proxy-server can't login in our webapplication anymore.In the event-viewer on the server this error is thrown:Forms authentication failed for the request. Reason: The ticket supplied was invalid.This problem only exists for users with a proxy, all other users can login normally.We are not using a web garden or multiserver (load balance) environment, just a webserver and a databaseserver.
I have a content-sensitive firewall between my clients and my server. If we exclude SSL solution (it's not available in my case) then I was thinking of a javascript library which encrypts custom fields at client-side and a .NET class decrypts them at server-side. Is there any solution out of the box (maybe a server control) ?
