Tough security question using System.Security .Cryptography.R ijndaelManaged.

[Andrzej]

Hi,

I have to figure out why we have a problem with special characters in
encrypted usernames and passwords.

Case:

Username: r&bgeorge
Password: tigger

We allow users to create usernames and passwords with special
characters on the website. When we log them in, they have the option
to save their login credentials for future logins.

User logs in and checks off the "remember your password" option. Then
the user closes his browser and opens a new browser window for the
application. The user is not logged in and the username field
contains "r" only, which the letter before the special character.
That's where it breaks I assume. The password field is empty.

Code:

This is the class that does the encryption (method:EncodeS tring()):

Imports System.Security
Imports System.IO
Imports System.Text
Imports Microsoft.Visua lBasic

Public Class wwCrypto

'Set up the keys, these are used for both encryption and
decryption
Private keyb() As Byte = {1, 253, 5, 50, 52, 91, 193, 133, 193,
121, 221, 164, 57, 128, 91, 91, 19, 39, 111, 197, 125, 98, 89, 48, 97,
154, 83, 187, 222, 167, 171, 74}
Private ivb() As Byte = {10, 61, 235, 120, 122, 120, 80, 248, 13,
182, 196, 212, 176, 46, 23, 85}

Public Function EncodeString(By Val str As String) As String
Dim outStr As String

' Set up the streams and stuff
Dim ms As New MemoryStream()
Dim rv As New System.Security .Cryptography.R ijndaelManaged( )
Dim cs As New Cryptography.Cr yptoStream(ms,
rv.CreateEncryp tor(keyb, ivb),
System.Security .Cryptography.C ryptoStreamMode .Write)
Dim p() As Byte = Encoding.ASCII. GetBytes(str.To CharArray())
Dim encodedBytes() As Byte

Try
cs.Write(p, 0, p.Length) ' write to stream as
encrypted data
cs.FlushFinalBl ock()
encodedBytes = ms.ToArray ' Convert the stream
to something we can use
Catch ex As Exception
Finally
ms.Close()
cs.Close()
End Try

outStr = Convert.ToBase6 4String(encoded Bytes)

Return outStr
End Function

Public Function DecodeString(By Val str As String) As String
Dim outStr As String

Dim p() As Byte = Convert.FromBas e64String(str)
Dim initialText(p.L ength) As Byte
Dim rv As New System.Security .Cryptography.R ijndaelManaged( )
Dim ms As New MemoryStream(p)
Dim cs As New Cryptography.Cr yptoStream(ms,
rv.CreateDecryp tor(keyb, ivb),
System.Security .Cryptography.C ryptoStreamMode .Read)

Try
cs.Read(initial Text, 0, initialText.Len gth)
cs.FlushFinalBl ock()
Catch ex As Exception
Finally
ms.Close()
cs.Close()
End Try

Dim sb As New StringBuilder()
Dim i As Integer

Dim b As Byte
For i = 0 To initialText.Len gth() - 1
b = initialText(i)
If (b = 0) Then ' The encryption pads with NULLs,
break so the aren't added to the string!
Exit For
End If
sb.Append(Conve rt.ToChar(b))
Next
Return sb.ToString()
End Function

End Class

Then we add this to the cookie.

Questions:

1. Is my reasoning correct and is the encryption mechanism preventing
auto login for users with special characters?
2. What would be the possible solution? How can I encrypt special
characters so they work?

Thanks.

Andrzej