ansaurus

Question

Handling hashed passwords stored as varbinary in SQL Server and classic ASP

Answer 1

+1 A:

I remember the days when I used to bash my head on this kind of thing. I suggest you get an upgrade to ASP.Net, but in the mean time the following code (VBScript) should do what you want:

<%

Dim result

main()

function main()

    Dim userName : userName = "Martin"
    Dim data : data = "4a5e6a8d521ed487b81c91e131cf27e8dae9b783"

    Dim db: Set db = Server.CreateObject("ADODB.Connection")
    db.Open "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=sa;Password=password1;Initial Catalog=Test;Data Source=(local)"

    Dim cmd : Set cmd = Server.CreateObject("ADODB.Command")
    cmd.ActiveConnection = db

    cmd.CommandText = "dbo.[sp_save_user]"
    cmd.CommandType = 4    
    cmd.Parameters.Append cmd.CreateParameter("@UserName", 200, 1, 50, userName)
    Dim bytes : bytes = stringToBinary(data)
    cmd.Parameters.Append cmd.CreateParameter("@Password", 204, 1, LenB(bytes), bytes)
    cmd.Execute()

    db.Close

    result = "done"

end function

function stringToBinary(str)
    dim ahex
    for i=0 to len(str) - 1 step 2
        Dim strDigit1 
        Dim strDigit2
        strDigit1 = Ucase(Mid(str, i+1, 1))
        strDigit2 = Ucase(Mid(str, i+2, 1))

        Dim byteDigit1
        Dim byteDigit2
        byteDigit1 = InStr("0123456789ABCDEF", strDigit1) - 1
        byteDigit2 = InStr("0123456789ABCDEF", strDigit2) - 1

        ahex = ahex & ChrB((byteDigit1 * 16) + byteDigit2)
    next   

    stringToBinary = ahex          
end function
%>
<html>
    <head>
        <title>Test</title>
    </head>
    <body>
        <h1><%= result %></h1>
    </body>
</html>

Martin Brown 2009-04-22 11:29:01

Answer 2

A:

I assume you have scope to change the DB... more specifically the Stored Procedure?

Why not just accept the hash as a string and CAST it to varbinary within the SProc?

Reading further, there is no built-in String -> Varbinary function in SQL Server, but this function has been offered as an easy solution,

CJM 2009-04-22 11:43:40

It is just as easy to do the conversion in VBScript and that way you get to keep your database interface clean for when you upgrade to a newer UI technology.

Martin Brown 2009-04-22 11:59:16

Answer 3

A:

Maybe a bit unrelated, but I'm wondering, if you are salting the hash on the client, how are you exactly keeping the salt secure?

Joost Moesker 2009-10-22 08:24:31

My understanding is that it's not critical to secure the salt - the point of salting passwords it that it will prevent anyone from using a predefined list of hashed passwords. In other words, if someone got my salt, they could then create a NEW dictionary of hashed versions of every possible password + my salt, but that's sufficiently time-consuming as to make it not worth the effort. Of course, I'm not an expert, so take this with a grain of salt. ;-)

mattstuehler 2009-10-22 18:06:40

ansaurus

tags:

views:

answers:

Handling hashed passwords stored as varbinary in SQL Server and classic ASP

related questions