How does vBulletin encrypt passwords?

[HabboHut]

I'm mucking around with AJAX at the moment, and want to make a quick register tool. Only thing is, I don't know how vB encrypts passwords. I'm assuming it would be using MD5, but I don't know if salts are involved >_> Any light shed on this mystery would be helpful!

Thanks!

[Adrian Schneider]

The password would be represented like this in MySQL:

PHP Code:

md5(concat(md5('password'), user.salt); 


[HabboHut]

Ah, thought there might be a salt involved... Trouble is, where is it defined?

[Adrian Schneider]

user table, salt column

[Chris M]

Each user has their own individual salt - This is created when they register and is stored in the user table in the database

Chris

[HabboHut]

Oh ok! So, if I first generate a random string (an equal length to the normal salt), apply it to the MD5 function, and then insert both the password and the generated salt into the database, will everything work ok?

[Michael Morris]

Client side you simply md5 it. Salting is applied server side. If you are replacing the vb registration routine the formula is

md5(md5(originalPasswordString) + salt)

That's what is stored in the database, along with the salt.

[Marco van Herwaarden]

Just use the DataManager to create the user. Salt will be created automatically.