Switching from custom system

[Kaitlyn2004]

Alright...

I currently have a member system that I want to change and use the vBulletin user system for instead... so usernames are seamless between accounts/forum accounts.

My problem is, my passwords are MD5 encrypted and I believe vBulletin's algorithm is something like md5(md5(pass . salt))

Does anyone have any suggestions to ease in the migration of my current userbase?

[Jake Bunce]

Not quite. It is:

md5(md5(pass) . salt)

You can import your existing passwords by salting the hash and hashing again. If your current userbase is from a common forum program then you might be able to use ImpEx. Otherwise this would be a custom import.

[njkhatri]

I understand that the password is the string user entered during the authentication.

However, how do you get the salt?

[Jake Bunce]

You need to generate the salt. vBulletin and ImpEx does this automatically.

[njkhatri]

How do you generate the salt?

I am investigating the possibility of using the vBulletin user registrations for my custom application that will be written in Java.

For that I need to do whatever vBulletin does for the encrypton.
md5(md5(pass).salt)

Obviously, I am not looking for Java help here. But I need to know how vBulletin generates the salt so that I can do the same thing so that my system can authenticate the users against vBulletin users.

Before I write a first line of code to do this, I would need to know the mechanism/algorithm for this.

[Cool Matty]

It is randomly generated and stored in the user's table on the database, right next to their hashed hash+salt password. Once their salt is generated upon registration you can just grab the salt value from the database.

[Jake Bunce]

That gets into custom code. www.vbulletin.org is the best place for help with this.