PDA

View Full Version : Question about password hash


monster64
06-22-2007, 04:35 AM
Before I switched to vbulletin, I was using phpbb. I had coded a login system in C++ where the user could enter their forum username and password, and then if they were in a paid subscription group, they could use the software. It used mysql apis to retrieve information from the database. Now phpbb encoded their passwords with an md5 algorithm. Since the algorithm generates the same hash on any programming language, I hashed the password the user typed in from C++, then compared it with the already hashed password stored on the server, and if they matched, the user could log in and continue with the authentication process. Now when I switched to VB, I made some minor changes for the new tables etc, however I can't log in. Looking at the database and then around this forum, I realize that VB doesn't use just an md5 hash to encrypt the password. Does anyone know what algorithm VB uses in addition to md5, and if its available to the public?

If I can't obtain the algorithm they use, could I just make VB encrypt the password with md5 only?

Dismounted
06-22-2007, 06:15 AM
If you only looked around for it......
md5(md5($password) . $salt)

Mac_Cross
06-22-2007, 08:59 AM
is it possible that vb generate the password in the 3.6.7 version different?

--- my fault, you can delete it - sorry

monster64
06-22-2007, 02:43 PM
So it md5s the password, uses the salt function on it, then md5s the whole thing? I got that, but where is the salt function itself?

Dismounted
06-23-2007, 03:15 AM
Look in the user table, there's a field called salt.

monster64
06-23-2007, 02:49 PM
Got it working again, thanks. The salt function vbulletin uses concats the salt to the end of the md5 hashed password, then md5 hashes it again, if anyone is curious.

Dismounted
06-24-2007, 06:07 AM
Which is exactly what I posted a few posts up.
md5(md5($password) . $salt)

monster64
06-26-2007, 09:01 PM
Didn?t know exactly what .$salt did :o

Dismounted
06-27-2007, 09:34 AM
. (dot) is the concatenation character in PHP.