Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

We've moved the forum!

Please use forum.silverstripe.org for any new questions (announcement).
The forum archive will stick around, but will be read only.

You can also use our Slack channel or StackOverflow to ask for help.
Check out our community overview for more options to contribute.

Migrating a Site to Silverstripe /

What you need to know when migrating your existing site to SilverStripe.

Moderators: martimiz, Sean, Ed, biapar, Willr, Ingo, swaiba

Help on Passowrd Encryption technique


Go to End


4 Posts   2752 Views

Avatar
usman

Community Member, 2 Posts

11 March 2015 at 4:40am

Hi. We have silverstripe installed on our system. We are developing a custom module which will work independently of silver stripe but will use the same DB. The module needs to authenticate users. The user passwords in the DB are encrypted with sha1_v2.4. To authenticate the user we need to encrypt the provided password and compare it with the stored password. However there is little documentation available on how to encrypt a given password using the sha1_v2.4 algorithm. Can someone provide me with an algorithm/pseudocode/code to encrypt a string using the same technique as silverstripe do (using sha1_2.4 and salt).

Avatar
Pyromanik

Community Member, 419 Posts

11 March 2015 at 5:17am

Silverstripe uses Blowfish by default.

And password encryption type can be set per user. You need to check the Member.PasswordEncryption property to check which to use.
This with Member.Salt can be used to calculate and compare with Member.Password

http://api.silverstripe.org/3.1/source-class-Member.html#305
http://api.silverstripe.org/3.1/source-class-PasswordEncryptor_Blowfish.html#249-259

Avatar
usman

Community Member, 2 Posts

11 March 2015 at 8:06am

Thanks for the quick response pyromanic.
I doubt its blow fish. For your info

original password: alvin
Password in DB :f9b0213127225c1c74d6662dee8acca297eff9e0
Password Encryption : sha1_v2.4
salt: 9j1jyse241v7cw0s8okkssgg448wgcogsggoww0

What i want to do is to create the password in DB from original password.

Any hints...

Avatar
Pyromanik

Community Member, 419 Posts

13 March 2015 at 5:03am

Still the same.
$check = $encryption_type($password.$salt) == $password_hash; //in a sort of pseudo-code