Decrypt method from encryption function

问题:

I have a method that is used to encrypt the password and store it to database as below :

public static string Md5Encrypted(string password)
        {
            byte[] pass = Encoding.UTF8.GetBytes(password);
            MD5 md5 = new MD5CryptoServiceProvider();
            string strPassword = Encoding.UTF8.GetString(md5.ComputeHash(pass));
            return strPassword;
        } 

Now I want the method that decrypt the password that I get from database which was encrypted by above method while storing it. I don't know how to make it. Anybody can help me please?

回答1:

MD5 is a hash function (not an encryption) and is irreversible. That is, you can't compute the original value from a given hash.

Update: I recommend this article that describes how to store password hashes securely. There's a C# implementation as well.

http://crackstation.net/hashing-security.htm

回答2:

You can't decrypt this, because hashing is a one-way function - you can't take a hashed value and turn it back into the original value.

Since it looks like you're dealing with passwords and I therefore assume this is some kind of logon mechanism, this is (probably) OK. What you need to do is hash the password (as you've done), and store the hashed value when your user registers on your website. When the user returns to your site, you take the password they enter, hash it (using the same method), and compare the hashed value with the value you stored. If the two hashes match, the correct password was entered.

Salts
There's a problem with hashes, in that the same input value always produces the same hashed value (otherwise the above mechanism for logon wouldn't work). Unfortunately this means that generating hash values for, say, a dictionary of common passwords is a trivial exercise. If your database is compromised, an attacker can then compare all the hashed passwords you've got stored against his previously computed values, and if he gets a match then Bazinga! he's got into your data.
To defend against this, what you can do when you do your initial hashing is at the same time generate an extra bit of random data that gets mixed in with the password as it's being hashed. This is called a salt (or less commonly a nonce). Rather than reproducing some code to do this, at this point I'm going to direct you to blowdart's book Beginning ASP.NET Security (Amazon UK | Amazon US), which has discussion of all this stuff - hashing, salting and 'proper' encryption.

回答3:

MD5 hash function is irreversible and cannot be decrypted,If you want to check the Username and password during login then do this..

1.While registering a new user, Hash the password and store it in database.

2.During login,Hash the password entered by the user 

3.Now,Compare the password entered(Hashed ) with password stored in database(Hashed)

4.If both of them are same then allow user to login else display an error