Trying to Understand SALT and the New Password system

[Xenon]

hmm, i think just the administrators have a special salt as well.
At least the upgradescript said something about salting administrators passwords.

Truly a bit confusing, we might sum up such things in a modification tutorial ^^

[korny]

Originally Posted by Link14716

In vB 2.0.x and below, passwords were stored as $password.

In vB 2.2.0 through 2.3.4, passwords were stored as md5($password).

In vB3, passwords are stored two sperate ways. In the database, passwords are store as md5(md5($password) . $salt)) In cookies, I believe they are stored as md5(md5(md5($password) . $salt) . $licensenumber))), although I'm not quite sure on that.

I am trying to write a script for my site that is integrated with VB3. I, however, can not get a user logged into my main page using the VB3 cookie. If the above quote is correct, then the following code should work:

$userPassword = md5(mysql_result($result, 0, "password")."#####");

The ##### is my license number. Providing my license number is correct (which it is.), the login should work. This code, however, returns a totally different hash than what is stored in the cookie. Is there an error in my code, or is the above quote incorrect?

[Elrum]

There's a new field in the table 'user' named 'salt'.

I solved it like this:

//Query:
SELECT password,salt FROM user WHERE username = '".$username."'

Login is correct if

$password = md5(md5($Input_PW_from_User) . $SALT_Value_from_Table_User)

[korny]

OK... im still getting two different hashes. What you are saying is i should apply the code you provided to the hash in the cookie?

OK... so I tried this (minus some obvious stuff, but you should get the point):

$bbuserid = $HTTP_COOKIE_VARS["bbuserid"];
$bbpassword = $HTTP_COOKIE_VARS["bbpassword"];

$query = "SELECT password, salt FROM user WHERE userid = '$bbuserid'";
$result = mysql_query($query, $connection);

$salt = mysql_result($result, 0, "salt");
$password = mysql_result($result, 0, "password");

$bbpassword = md5(md5($bbpassword).$salt);

But this still doesn't work... $password (from the db) and $bbpassword (from the cookie) still do not match. I even tried switching it around and applying what you have told me to the hash in the DB, but still no luck.

It seems VB has made their product more secure, must much less customizable since no one at VB will answer this question. It may just be time to switch to different software.

[Elrum]

Originally Posted by korny

$bbpassword = md5(md5($bbpassword).$salt);

The password stored in the cookie is already crypted.

In your code "$bbpassword" must be equal to "md5(md5($password.$salt))".

[korny]

As I said I tried it to both passwords but I had the salt only in the 2nd hash of the operation... "md5(md5($password).$salt)". But even after I fixed it... meaning I did not rehash the cookie password, and applied what you have said to the db password, it still doesn't work! Heres the script I'm using just to see if i can get the hashes to match:

$bbuserid = $HTTP_COOKIE_VARS["bbuserid"];
$bbpassword = $HTTP_COOKIE_VARS["bbpassword"];

$query = "SELECT password, salt FROM user WHERE userid = '$bbuserid'";
$result = mysql_query($query, $connection);

$salt = mysql_result($result, 0, "salt");
$password = mysql_result($result, 0, "password");

$password = md5(md5($password.$salt));

echo "$bbpassword (cookie)<br>";
echo "$password (db)<br>";
echo "$salt (salt)<br>";

I did this so I can actually see whats going on.... I am getting the correct salt out of the dB, but the hashes still do not match.

Also... I appreciate the help very much... I've been waiting for an answer for a while here... my whole site is shut down and I'm losing valuable traffic everyday. Thank you very much.

[steve@dvdlard]

Hi,

I'm not sure if it helps but I've been trying to do something similar but instead of pulling from a cookie I was checking the password from a form field. It took a long time to work out but the actual code I needed was:

$bbpassword = md5(md5($bbpassword).$salt); - Note where the brackets are.

[korny]

Thats what I'm working on now... I've given up on getting an answer from anyone at VB, and I've lost too much traffic. I'll tell you this is the last time I'm using VB...

Thanks for the info!