private static byte[] AESEncryptData(byte[] Data, byte[] key, byte[] IVSeed)
{
byte[] retByte;
using (Aes encryptor = Aes.Create())
{
Rfc2898DeriveBytes rfcDBGen = new Rfc2898DeriveBytes(key, IVSeed, 128);
encryptor.IV = rfcDBGen.GetBytes(16);
encryptor.Key = rfcDBGen.GetBytes(32);
rfcDBGen.Dispose();
using(MemoryStream ms = new MemoryStream())
{
using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
{
cs.Write(Data, 0, Data.Length);
cs.Close();
}
retByte = ms.ToArray();
}
}
return retByte;
}
/// <summary>
/// Computes the "Hi()"-formula which is part of the client's response
/// to the server challenge.
/// </summary>
/// <param name="password">The supplied password to use.</param>
/// <param name="salt">The salt received from the server.</param>
/// <param name="count">The iteration count.</param>
/// <returns>An array of bytes containing the result of the computation of the
/// "Hi()"-formula.</returns>
/// <remarks>
/// Hi is, essentially, PBKDF2 with HMAC as the pseudorandom function (PRF) and with
/// dkLen == output length of HMAC() == output length of H(). (Refer to RFC 5802, p.6)
/// </remarks>
private byte[] Hi(string password, string salt, int count) {
// The salt is sent by the server as a base64-encoded string.
byte[] saltBytes = Convert.FromBase64String(salt);
// Annoyingly, Rfc2898DeriveBytes only implements IDisposable in .NET 4 and upwards.
var db = new Rfc2898DeriveBytes(password, saltBytes, count);
try {
// Generate 20 key bytes, which is the size of the hash result of SHA-1.
return db.GetBytes(20);
} finally {
#if !NET35
if(db != null)
db.Dispose();
#endif
}
}
static DeepLinkHelper()
{
const string Password = "******";
const string SaltString = "Afd@%f&!hg8asH2J7";
var salt = Encoding.UTF8.GetBytes(SaltString);
using (var encryptionAlgorithm = new AesManaged())
{
BlockSize = encryptionAlgorithm.LegalBlockSizes[0].MaxSize;
KeySize = encryptionAlgorithm.LegalKeySizes[0].MaxSize;
}
Rfc2898DeriveBytes keyGenerator = null;
try
{
keyGenerator = new Rfc2898DeriveBytes(Password, salt);
Key = keyGenerator.GetBytes(KeySize / 8);
InitializationVector = keyGenerator.GetBytes(BlockSize / 8);
}
finally
{
#if !SILVERLIGHT
if (keyGenerator != null)
{
keyGenerator.Dispose();
}
#endif
}
}
private byte[] Hi(string password, string salt, int count)
{
byte[] saltBytes = Convert.FromBase64String(salt);
var db = new Rfc2898DeriveBytes(password, saltBytes, count);
try
{
return db.GetBytes(20);
}
finally
{
#if !NET35
if (db != null)
{
db.Dispose();
}
#endif
}
}
//This area contains all static methods.
//This method uses the rfc2898 hash class to hash the users password.
public static Client hashPassword(Client user)
{
//tries to perform hash and catches null string
try
{
const int SALT_SIZE = 16;
byte[] saltInBytes = new byte[SALT_SIZE];
//Creates a random salt.
new RNGCryptoServiceProvider().GetBytes(saltInBytes);
user.Salt = saltInBytes;
//Generates hash with 16 byte salt, and 10000 iterations
Rfc2898DeriveBytes hash1 = new Rfc2898DeriveBytes(user.password, saltInBytes, ITERATIONS);
//Gets the hashed object.
byte[] hash = hash1.GetBytes(20);
user.Password = Convert.ToBase64String(hash);
hash1.Dispose();
//Returns the user with hashed password and salt assigned.
return user;
#region Zach's MD5 Hashing Algorithm
////holder for return text
//string returnText;
////converts input text into bytes
//byte[] textbytes = System.Text.Encoding.Default.GetBytes(password);
////creates hash object
//System.Security.Cryptography.MD5 hash = System.Security.Cryptography.MD5.Create();
////gets hashed text as a string
//returnText = System.Text.Encoding.Default.GetString(hash.ComputeHash(textbytes));
////cleans up
//hash.Dispose();
////returns holder for hashed text
//return returnText;
#endregion
}
catch (Exception e)
{
Console.WriteLine(e.Message);
return null;
}
}
/// <summary>
/// Computes the PBKDF2-SHA1 hash of a password.
/// </summary>
/// <param name="password">The password to hash.</param>
/// <param name="salt">The salt.</param>
/// <param name="iterations">The PBKDF2 iteration count.</param>
/// <param name="outputBytes">The length of the hash to generate, in bytes.</param>
/// <returns>A hash of the password.</returns>
private static byte[] PBKDF2(string password, byte[] salt, int iterations, int outputBytes)
{
Rfc2898DeriveBytes pbkdf2 = new Rfc2898DeriveBytes(password, salt);
pbkdf2.IterationCount = iterations;
byte[] rtn = pbkdf2.GetBytes(outputBytes);
pbkdf2.Dispose();
return rtn;
}
