Decrypt string C#

Question

My company is in the process of taking over a members only website from a 3rd party. We have re-written the website and the last step is to import the existing users. We have the database with users and their passwords. We also were given the 'key' and were told that the password field is encrypted with AES encryption.

I need to decrypt the passwords and then re-encrypt them in the new database using my company's encryption key. Using .Net, how can I decrypt the passwords with just the key? All the samples I have seen require information like BlockSize, InitializationVector, KeySize, etc. I don't have that information.

Thanks

Answer 1

BlockSize and KeySize you can play with (they are in multiples of 8 IIRC).

Not sure about the initialization vector. Could be all 0's, but you would need at least 1 correctly decrypted password to verify that.

Good luck. :)

Answer 2

Without knowing the IV it will most likely be impossible to decrypt it, especially since you're dealing with passwords that are most likely less than the blocksize (the AES standard is 128-bit).

Your options are pretty limited here:

• Ask the 3rd party website for the IV
• If you have access to their code, you will probably find the same IV use to encrypt all passwords within the code (though this is not very good practice) since there would be no way for them to authenticate users in the future without either using the same one again and again, or storing the one they used for a specific user somewhere in the database
• Have the users re-register on your new version of the site and use some form of hashing instead of encryption

Answer 3

This just seems wrong... Passwords aren't typically encrypted, they're hashed. If that's the case, then you're not going to be able to retrieve the original passwords.

Is there any way you can look at the original code to see how the passwords were generated?

Answer 4

Why not send each user an email containing a unique link they can click, which takes them to a page where they can reset their password?

Users should change their passwords regularly anyway.