Trying to Understand SALT and the New Password system

[ManagerJosh]

Okay I'm trying to integrate vBulletin with another php app right now and it uses a traditional MD5 hash.

But I'm really confused on what's going on here because I see evidence of double MD5 and single MD5 with salts.

Could someone explain to me what's going on and what's happened? I understand the general concept of salt and that's to randomize the password even further.

Any information would be nice... (and some directions on pointing me to the right direction would be nice as well )

[Xenon]

hmm, the easy way to explain:

$password -> the real password
md5($password) -> password in vb2
md5(md5($password) . 'licensenr') -> password in vb3

this is to make all hashe differ on different boards, so even if the real password is identical, the hashes on two different boards aren't

[ManagerJosh]

Originally Posted by Xenon

hmm, the easy way to explain:

$password -> the real password
md5($password) -> password in vb2
md5(md5($password) . 'licensenr') -> password in vb3

this is to make all hashe differ on different boards, so even if the real password is identical, the hashes on two different boards aren't

so if I just took this..

PHP Code:

$hashedpassword = md5($_POST['password_md5']); 


it would give me the exact same MD5 hash as in vB2.x?

[Xenon]

nope, $_POST['password_md5'] is already md5'ed (AFAIK) and therefore it already contains the vb2 pw hash

[ManagerJosh]

Originally Posted by Xenon

nope, $_POST['password_md5'] is already md5'ed (AFAIK) and therefore it already contains the vb2 pw hash

How confident are you that $_POST['password_md5'] is already MD5ed?

[Xenon]

i'm 99% sure as the _md5 tells me, it is alreay md5ed

but as the md5ed value is done per JS, you might think of those user which doesn't have JS enabled

[ManagerJosh]

I'm trying to make sure these are the variables I think they are...

In profile.php,

is:

$currentpassword_md5
$newpassword_md5

the equalvent of text md5 hashed already too??

[Xenon]

yes, _md5 means it has been md5ed one times

[ManagerJosh]

Originally Posted by Xenon

yes, _md5 means it has been md5ed one times

Thanks for taking the time out of your schedule to answer my questions Stefan

[Link14716]

Originally Posted by ManagerJosh

Thanks for taking the time out of your schedule to answer my questions Stefan

In vB 2.0.x and below, passwords were stored as $password.

In vB 2.2.0 through 2.3.4, passwords were stored as md5($password).

In vB3, passwords are stored two sperate ways. In the database, passwords are store as md5(md5($password) . $salt)) In cookies, I believe they are stored as md5(md5(md5($password) . $salt) . $licensenumber))), although I'm not quite sure on that.