title: Effective Password Encryption
body: <p>I've taken a look at the StackOverflow question, <a href="https://stackoverflow.com/questions/877583/password-encryption-database-layer-aes-or-app-layer-aes">"Password Encryption / Database Layer AES or App Layer AES,"</a> and I'd like to effectively and efficiently hash my passwords on registration (web app) and then be able to check they are correct on login.  I'm using VB, but comfortable using C#.  </p>
  
  <p>I would love to use Jeff Atwood's Encryption class described in <a href="http://www.dotnetmonster.com/Uwe/DirItem.aspx/Articles/NET-Framework/Security/NET-Encryption-Simplified" rel="nofollow noreferrer">".NET Encryption Simplified"</a> as it's really easy to understand. It has a hashing class&mdash;but I have no idea how to "login" and compare hashes after they have been hashed.  This is Jeff's demonstration of his hash methods using his Encryption class:</p>
  
  <pre><code>Sub DemoHash()
      Dim d As New Encryption.Data( _
          "{ts '2004-10-09 08:10:04'}The world is beautiful and needs caring by its children")
  
      Dim hash As New Encryption.Hash(Encryption.Hash.Provider.SHA1)
      Dim hash2 As New Encryption.Hash(Encryption.Hash.Provider.SHA256)
      Dim hash3 As New Encryption.Hash(Encryption.Hash.Provider.SHA384)
      Dim hash4 As New Encryption.Hash(Encryption.Hash.Provider.SHA512)
      Dim hash5 As New Encryption.Hash(Encryption.Hash.Provider.MD5)
      Dim hash6 As New Encryption.Hash(Encryption.Hash.Provider.CRC32)
  
      hash.Calculate(d)
      hash2.Calculate(d)
      hash3.Calculate(d)
      hash4.Calculate(d)
      hash5.Calculate(d)
  
      Console.WriteLine("SHA1:   " &amp; hash.Value.Hex)
      Console.WriteLine("SHA256: " &amp; hash2.Value.Hex)
      Console.WriteLine("SHA384: " &amp; hash3.Value.Hex)
      Console.WriteLine("SHA512: " &amp; hash4.Value.Hex)
      Console.WriteLine("MD5:    " &amp; hash5.Value.Hex)
      Console.WriteLine("CRC32:  " &amp; hash6.Calculate(d).Hex)
      Console.WriteLine()
  
      Dim salt As New Encryption.Data("salty!")
      Console.WriteLine("Salted CRC32:  " &amp; hash6.Calculate(d, salt).Hex)
  
      Console.WriteLine("Press ENTER to continue...")
      Console.ReadLine()
  End Sub
  </code></pre>
  
  <p>So my questions are:</p>
  
  <ol>
  <li><p>I can encrypt the password (though I have no intention of storing it) and hash a string. If I were to have a user called 'barry' with a password of 'fishlegs', what is the best way to store his password and retrieve it?</p></li>
  <li><p>In SQL Server; is binary or nvarchar the best option for the storage of the hash?</p></li>
  <li><p>Based on 'barry' and his password what effectively is the hash storing? Is it an encryption of 'fishlegs' appended to a salt?</p></li>
  </ol>
  
  <p>Cryptography is hard!</p>
  
  <p>Thanks to anyone who can assist...</p>