News:

Bored?  Looking to kill some time?  Want to chat with other SMF users?  Join us in IRC chat or Discord

Main Menu

SMF 2.0 RC3 Account Authorization Algorithm

Started by SpartanLegends, September 13, 2010, 06:39:41 PM

Previous topic - Next topic

SpartanLegends

Now, I'm sorry for coming here so rapidly on a question that I could probably answer by even peeking at some of the code, but a search provided no insight, and I think this is a bit of a specific question.

What I am looking for is the algorithm used to authorize a login. I know the new version of SMF uses a nice and secure SHA1 with 4 digit salts, but I'm not sure of the algorithm.

As an example, vBulletin uses 'md5(md5($pass).$salt)', but what about SMF?

Apologies if this question is somehow misplaced, silly, or something like that, and thanks to any and all assistance.

Oya

to authorize a login or check the password

the salt isnt used for the username/password check
its sha1(strtolower($username).$pass) in the main db


as for authorizing a login it looks like
sha1($pass.$salt)

SpartanLegends

#2
Although at the time I must have not made it clear, probably because I didn't think on that part of it, but I was looking for as many of the generic algorithms used. The only thing I needed to know was to confirm that the input password was the correct password, and you seem to have helped. Thanks.

The part I was looking for.
Quote from: Oya on September 13, 2010, 06:54:18 PM
sha1($pass.$salt)


Ok, uhm, new problem. I'm not able to duplicate the hash properly, and it seems to reject the password with the proper hash and salt. Hrmf.
Nevermind, ok, I finally got it to work, now I can use it properly. Thanks! :D

Advertisement: