05 January 2016, 6:09

Hello to everybody,

I need to know which algorithm is used by Mahara to encrypt user passwords. My version of Mahara is 15.10

Thanks in advance

Oronzo Lezzi

15 January 2016, 13:51

Hi,

If you're using the default "internal" authentication method (which stores usernames & passwords directly in Mahara's own database), that stores the passwords as a salted hash. It uses the PHP "crypt()" function, and the salting algorithm is either SHA512 or bcrypt, depending on your system specifics.

Here's the code that does it: https://git.mahara.org/mahara/mahara/blob/15.10_STABLE/htdocs/auth/internal/lib.php#L192

Cheers,

Aaron