title: Inserting encrypted password using RSACryptoServiceProvider class into DB?
body: <p>I have WCF service that being used by clients, and the following is my current implementation for user authentication, I want a recommendation to enhance it or better mechanism.</p>
  
  <ul>
  <li><p>I am using RSACryptoServiceProvider
  class (RSA implementation) to save encrypted user passwords into database</p></li>
  <li><p>The client should encrypt password every log-in using public key (stored in file) and send it to logging method with user name</p></li>
  <li><p>On the server side the log-in method 
  select the encrypted password for the
  supplied user name and compare decrypted passwords (sent by user and db one) using private key</p>
  
  <p>Note: every time you encrypt the
  string using RSA with the same public
  key a new encrypted bytes generated,
  so I can not compare encrypted
  passwords and I have to decrypt them to compare</p></li>
  </ul>
  
  <p>P.S
  The answers say "For authentication purposes you should avoid storing the passwords using reversible encryption"</p>
  
  <p>I am asking if no one can decrypt the password except if he has the private key, so what is the problem, even the hashing is not reversible but it is broken!!</p>