Password in SQL

Hi,
Is there a way I can store password in SQL table as
encrypted using SQL table defintion instead of writing code
to do encrypt and decrypt?
Thanks.
Hi
Not with SQL Server 2000. SQL Server 2005 supports this.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"dbc user" <anonymous@.discussions.microsoft.com> wrote in message
news:07b101c5191b$0ee24b50$a601280a@.phx.gbl...
> Hi,
> Is there a way I can store password in SQL table as
> encrypted using SQL table defintion instead of writing code
> to do encrypt and decrypt?
> Thanks.
|||Ok. Thanks
>--Original Message--
>Hi
>Not with SQL Server 2000. SQL Server 2005 supports this.
>Regards
>--
>Mike Epprecht, Microsoft SQL Server MVP
>Zurich, Switzerland
>IM: mike@.epprecht.net
>MVP Program: http://www.microsoft.com/mvp
>Blog: http://www.msmvps.com/epprecht/
>"dbc user" <anonymous@.discussions.microsoft.com> wrote in
message
>news:07b101c5191b$0ee24b50$a601280a@.phx.gbl...
>
>.
>

Password Encryption in XML File

I am unable to encrypt password of sqlserver database in XML file by Package Configuration in SSIS.

I think that is not possible (though it might be possible if you develop something). According to the SSIS help you can either save the config file in SQL Server or use Windows access control lists to protect access to your config file. See ms-help://MS.VSCC.v80/MS.VSIPCC.v80/MS.SQLSVR.v9.de/extran9/html/2e3ddea9-5289-4289-a70e-11c018f34977.htm|||Yes in config file i have to put the password manually in config file.If i choose only connection string property in configuration wizard then it is working fine.But When i reset the server password then it fails.So i have to give the password.But unable to encrypt it for security reasons.

password encryption

Hi all Im used to work on mysql and in that Db you can call the password function to encrypt password, so that people browsing directly the db can't see others password.

What is the best way to do this in sqlserver ?

You may use these two undocumented SQL Server functions.

PWDEncrypt and PWDCompare

How to use them?
http://msmvps.com/blogs/gladchenko/archive/2005/04/06/41083.aspx

Pwdencrypt() Weakness
http://www.sqlteam.com/article/pwdencrypt-weakness

Good luck.

|||

so as I see it. It seems easy to hack, So I will ask an other question to you. How do you procede to encrypt password? do you encrypt in code instead of in the db?|||

Frist thing you need to make Password column as VarBinary.

It will save in encrypted format. If you dont wanna use builtin function then make some function which will add some values and then subtract some values.

Hope this will help you.

DBMaster

My Blog

|||

You could use varbinary, you could also use binary, since the results will always be the same lengh.

Public Function MD5(s as string) as byte()

Dim encoder as New UTF8Encoding()
Dim md5Hasher as NewSystem.Security.Cryptography.MD5CryptoServiceProvider

return md5Hasher.ComputeHash(encoder.GetBytes(s))

end function

dim cmd as new SqlCommand("INSERT INTO Users(UserName,Password) VALUES (@.UserName,@.Password)",conn)

with cmd.parameters

.add("@.UserName",sqldbtype.varchar).value=txtUsername.text

.add("@.Password",sqldbtype.varBinary).value=md5(txtPassword.text)

end cmd

...

dim cmd as new SqlCommand("SELECT COUNT(*) FROM Users WHEREUserName=@.UserName ANDPassword=@.Password",conn)

with cmd.parameters

.add("@.UserName",sqldbtype.varchar).value=txtUsername.text

.add("@.Password",sqldbtype.varBinary).value=md5(txtPassword.text)

end cmd

if cmd.executescalar<>1 then

throw new applicationexception("Bad password")

endif

Password Encryption

Hi

I want to encrypt the password. Can u suggest some Encryption algorithms for Password protection?

Thanks

There are several option based on the SQL Server Version you are using, SQL 2k5 has built in ecrypting mechanisms, SQL Server 2000 does not. What are you using ?

HTH, Jens K. Suessmeyer.

http.//www.sqlserver2005.de|||

Hi

Thank u for ur reply.

I'm using SQL Server 2000

Thanks

|||Sorry, which password are you referring to ? I guess you mean a password within the database. Then you either will have to do it within your application logic or seach for a vendor that wote an extended procedure to do this.

HTH, jens K. Suessmeyer.

http://www.sqlserver2005.de