0

I currently use SMF as my forum software but i'm currently building a my own customized forum software and i would need to import the entries from my SMF database into my new database. I noticed that Mysql uses a sha1 way of encoding passwords which i also incorporated into my own database table password field. I came across a website where i was able to decode the hash code from my table but when i tried to do that of the SMF table, it wasn't working. I'm thinking that it's not entirely a sha1 and that it's probably mixed with someone. That could be why it's not converting. I kinda think it has something to do with the password salt stuff which i'm still trying to wrap my head around.

Pls, is anyone familiar with the password field in the SMF Mysql membership table? I just hope it's possible to import my membership list into my new table cos if i can't, i may have wasted my time building a new application.

fmendez
  • 7,250
  • 5
  • 36
  • 35
Afam
  • 29
  • 1
  • 8
  • By Default SMF passwords are encrypted. You will likely not be able to reverse hash these as it was intended to prevent this very thing I presume they are using an MD5 Hash in the database and that isn't something i think you can get around easily. – Silvertiger Apr 20 '13 at 22:29
  • I assumed that ordinarily it won't be possible to decode it. But since it's md5, can i change the sha1 that i have for my new customized forum to md5 and then copy the md5 hash on smf onto the new password field. Will it match when the user wants to login? I hope i'm making sense. – Afam Apr 20 '13 at 22:37
  • I would presume that it is possible as I have been able to manually recreate MD5 hashes I wanted outside MySQL and then paste them into a current MD5 encrypted field within MySQL and have them work properly for authentication purposes – Silvertiger Apr 20 '13 at 22:40
  • I hope it works cos my only worry is that after importing it to the new table, members may not be able to login. I hope i'm wrong. I guess i'll have to try it by trying to login with my admin user name and see if it works. Thanks my Man. – Afam Apr 20 '13 at 22:44

2 Answers2

1

SMF 1.1 and later (practically everything in existence) uses sha1(strtolower('username') . 'password'); to encode the password. That's a form of salted password so breaking it fairly impossible.

chx
  • 11,270
  • 7
  • 55
  • 129
0

If it's md5 hashes, then you won't be able to (easily) reverse them - but you can re-use them by getting your own forum software to compare the md5 hash of the user input with the hash in the database, just like your old forum software did.

If you want to use sha1 for your new forum, then just check at login time what sort of data is stored in the db for a particular user and compare hashes as appropriate; both md5 hashes and sha1 have set lengths so checking type is trivial.

Rob Redpath
  • 106
  • 1
  • 4