I'm new to mojoPortal and password hashing procedures.  I have some questions about how passwords are hashed and the possible values outlined in the mojoMembershipProvider.cs/WebConfigSettings.cs files.

My first question:  in researching what type of hashing is used as a default in mojoPortal, I found a post saying it is MD5x3.  I found the MD5 procedure, but what designates that it is x3?  In stepping through the code, it only runs through the hash procedure once as far as I can tell.  Where is the loop or is it not x3?

Second question:  In the mojoMembershipProvider.cs file, code exists for using SHA512 hashing, which is what we'd like to use, but this option is commented out with a note saying, 'TODO: we can't currently use SHA256 or SHA512 because the password field in the db is not big enough to store the hash.'   Another comment on the WebConfigSettings.cs file says, 'possible values, MD5 (default), SHA256, SHA512 for future use currently we can only use MD5 because the password field in the db is only nvarchar(128) SHA256 requires 256 bits and SHA512 requires 512 bits we will need to change to ntext (to support SQL 2000).'

In checking dbo.mp_Users, the Pwd field is nvarchar(1000), and in testing hashed passwords using the SHA512 code in my development environment, everything worked.  Was the field size increased for this field but not updated in the documentation?  I'd like to verify this before a decision is made to publish the modifications to the web site.

Thanks,

Leslie

Thanks for the fast response Joe.  What about the x3 question?  Is the default MD5 run x3?

Leslie

Here's the link where it references the x3:  https://www.mojoportal.com/Forums/Thread.aspx?pageid=5&mid=34&ItemID=9&thread=4715&postid=19838 (I did a search on 'hash').

Thanks again Joe!