I have 2 websites: one written in classic asp and another written in ASP.NET (1.1 framework). Both applications use a login mechanism to validate user credentials based on a shared database table. Up to now passwords are stored in a 1-way MD5 hash, meaning people must be given a new generated password if they lose the old one. I now want to change this and make the passwords decryptable.
I found this Rijndael code to use with classic asp: http://www.frez.co.uk/freecode.htm#rijndael
But I cannot find the same solution for ASP.NET. I tried this, but it gives me different encryption and decryption results between the classic asp and ASP.NET code:
If Not String.IsNullOrEmpty(TextBox1.Text) And Not String.IsNullOrEmpty(TextBox2.Text) Then
Dim password = TextBox1.Text
Dim key = TextBox2.Text
Dim keyGenerator = New Rfc2898DeriveBytes(key, 8)
Dim r = New RijndaelManaged
r.Mode = CipherMode.CBC
r.Padding = PaddingMode.Zeros
r.BlockSize = 256
r.KeySize = 256
r.FeedbackSize = 256
r.IV = keyGenerator.GetBytes(CType(r.BlockSize / 8, Integer))
r.Key = keyGenerator.GetBytes(CType(r.KeySize / 8, Integer))
Dim transform As ICryptoTransform = r.CreateEncryptor()
Dim encoded As Byte() = Encoding.ASCII.GetBytes(password)
Dim target As Byte() = transform.TransformFinalBlock(encoded, 0, encoded.Length)
TextBox3.Text = Encoding.ASCII.GetString(target)
End If
I think I'm doing something wrong with generating the key or iv, but I can't find a solution.