Encrypt / Decrypt help

[WolfShade]

Hello, all.

In the past, I always used HASH to encrypt the password for users; all I needed to do was to check the HASHed value from login and compare to what is in the db - simple.

Now I have a client that would like to add a password retrieval system to the site. I'm having difficulties with the values never being the same. Originally I tried encrypting with BLOWFISH, but that didn't work for decrypt. Here is the code I have, so far:
APPLICATION.CFM:
<cfset request.cryptAlgorithm = "DESEDE">
<cfset request.cryptEncoding = "HEX">
<cfset request.cryptKey = GenerateSecretKey(request.cryptAlgorithm)>
<cfset request.cryptPhrase = "Eightcha">

LOGINACTION.CFM
<cfset session.user.password = URLEncodedFormat(Encrypt("#trim(form.password)#", request.cryptKey, request.cryptAlgorithm)) />
<cfset session.user.SQLpassword = trim(replace(session.user.password,"'","''","all")) />
<cfquery name="checkLogin" dbtype="odbc" datasource="#request.data_source#">
EXEC check_login @Deleted User='#trim(session.user.username)#', @pw='#trim(session.user.SQLpassword)#'
</cfquery>
<cfdump var="#checkLogin#"><cfabort>

I'm dumping the results of the query and aborting to view the values; the password is always changing. How can I keep the value always the same?

Thanks,

^_^

[WolfShade]

Och. That will take some time. I haven't created the user add/edit form, yet. 😞 And I've got other things that have to be finished by tomorrow morning.

I'll get that done ASAP afterwards, though, and let you know if that made any difference.

Thanks, again, for your thoughts and advice.

^_^

[cf_dev2]

Okay. I'll check back later on to see how you made out.

Good luck! 🙂

[mowebdev2]

I came across this error in trying to use encrypt with the BLOWFISH alg using a static key of something like:

<cfset thekey = "mysecretkey"> - this does not work.

<cfset thekey = "mysecretkey2010s"> - this works at a length of 16 characters.  Anything less than 16 did not work.  Neither did 17, 18, or 19.  20 did.

Hope this is helpful to some in the future.

[Steve Sommers]

I'm fairly certain that "theKey" is interpreted as a base-64 encoded binary value and that is why it must have a length evenly divisable by 4.