如何正确散列密码

Question

I want to re-create the MyBB hashing process so I can use its database to authenticate users on a 3rd party app (written on C#).

MyBB uses:

md5(md5($salt).password)

My problem is that the result I get on C# is nowhere similar to the one MyBB gets.

What I've done on C#:

public string HashPass(string password, string salt)
{
    MD5 md5 = new MD5CryptoServiceProvider();

    byte[] saltHash =md5.ComputeHash(System.Text.Encoding.ASCII.GetBytes(salt));

    string passwordAndSalt = password + System.Text.Encoding.ASCII.GetString(saltHash);

    byte[] finalHash = md5.ComputeHash(System.Text.Encoding.ASCII.GetBytes(passwordAndSalt));

    string final = System.Text.Encoding.ASCII.GetString(finalHash);
    return final;
}

The result I get from using that function for password "Test123" and salt "0fYR6mEE" (gathered from MyBB db) is: "??R?????s??" while the actual result should look like "VaHffsyzJeEa4dB3bbMWeUlJObAfN5I9rf1CuNRXCa6xPJTzXL".

Most likely I'm missing something obvious, sorry about that.

Answer 1

There are unknowns here. Which encoding does MyBB use to the password bytes? It could be ASCII, ANSI, or UTF8 or it could get the string bytes directly, ie, without encoding. So I will write it partly as pseudo code

byte[] passwordBytes = GetBytes(password); // Where you have to define GetBytes
byte[] saltBytes = System.Convert.FromBase64String(salt); // Assuming it is given as base64

// Merge the password bytes and the salt bytes
var mergedBytes = new byte[passwordBytes.Length + saltBytes.Length];
Array.Copy(passwordBytes, mergedBytes, passwordBytes.Length);
Array.Copy(saltBytes, 0, mergedBytes, passwordBytes.Length, saltBytes.Length);

var md5 = new MD5CryptoServiceProvider();
byte[] finalHash = md5.ComputeHash(mergedBytes);
string final = System.Convert.ToBase64String(finalHash);        

Note that I'm merging the password bytes and the salt bytes, not the password string and the salt string. Then the MD5 it taken only once from these merged bytes.

But I'm not sure what md5(md5($salt).password) does. Is md5() returning the the hash as base64 string already? Maybe you would have to convert the salt from base64 to bytes[] , then get the MD% hash, convert it into a base64 string and then concatenate it with the password string. Then get the bytes from this combined string, do the hash again and convert the result to a base64 string again.

You would have to dig deeper into the source code of MyBB to be sure.