XF 1.5 XenForo 1.2+ Password Encryption

[Robust]

Hey,

Trying to port some data over from XenForo into a custom Rails app.

Looks like after XF1.2, XF stopped using sha256(sha256(password) . salt) and started using phpass (0.3), slightly modified. Many versions of this were released, a couple got ported to Ruby, but it's a slight hit and miss.

The hashes generated look a bit like this:

a:1:{s:4:"hash";s:60:"$2a$10$Q6[...]";}

That's the identifier for bcrypt I think ($2a$10, bcrypt ($2a), cost factor 10 ($10). Just confirming this hash is actually bcrypt, since I have no clue on password hashing and whatnot, Been scratching my head with this for a while. It's not explicitly mentioned in the script, so I'm guessing there was no bcrypt function when the script was written.

 

[Chris D]

It is indeed bcrypt.

This is where it was announced:
https://xenforo.com/community/threads/more-assorted-things.50098/

Incidentally, it hasn't changed in XF2, though we do use PHP's default password_hash or password_verify methods if they are available.

 

[Robust]

It is indeed bcrypt.

This is where it was announced:
https://xenforo.com/community/threads/more-assorted-things.50098/

Incidentally, it hasn't changed in XF2, though we do use PHP's default password_hash or password_verify methods if they are available.

Thanks Chris!

Looks like passwords will be compatible with Rails and Devise then, assuming it can properly interpret the different cost factor (devise uses 11 by default).