Tripcode

Tripcodes are a method of authentication that does not require registration. They are most often used in 2channel-style message boards or Futaba Channel-style imageboards. A tripcode is a hashed password by which a person can be identified by others.

A tripcode is the result of input to a cryptographic hash function on the message board server, usually entered in the same field as the name. Using the common 2channel format, name#tripcode when entered as a username becomes name!3GqYIJ3Obs when displayed in the post. The ! is the separator between name and tripcode; on some boards it is replaced with ◆.

Readers of the board can identify postings made by the same user by comparing tripcodes. If two people use the same user name, they can be told apart because they, presumably, don't know each other's passwords that generate the different tripcodes. This way, the names and passwords don't have to be stored in a database. As many boards use the same algorithm, tripcodes are usually consistent.

Description of the algorithm

The tripcode function works as follows:
# Convert the input to Shift JIS.
# Replace the characters &, <, >, ", and ' with &, <, >, ", and ' respectively. Some implementations replace other characters as well, these are the most common ones.
# Generate the salt as follows:
## Take the second and third characters of the input with H. appended to it.
## Replace any characters not between . and z with ..
## Replace any of the characters in :;<=>?@ [\] ^_` with the corresponding character from ABCDEFGabcdef.
# Call the crypt() function with the input and salt.
# Return the last 10 characters.

Some buggy implementations don't convert to Shift JIS. The original implementation of tripcodes only used the last 8 characters.

Secure tripcodes

Tripcodes are not a very secure authentication method. Since the keyspace of 2channel-style tripcodes is not very large (2⁵⁴) some boards implement a "secure tripcode" along with normal tripcodes. In their case another hash is used that takes a second input (typically in the form of name#tripcode#securetripcode) and uses a secret salt stored on the server. As this salt is secret and site specific one cannot use a pre-computed preimage attack such as rainbow tables.

One of the drawbacks of secure tripcodes is that they are specific to a single imageboard or discussion board. Because of this, a user cannot verify his or her identity across multiple boards or websites unless each board happens to use the same secret salt as well as the same method of generating and displaying secure tripcodes. Coupled with the fact that it is fairly rare that a user goes through the trouble of discovering another user's tripcode string, many users opt to use normal tripcodes.

External links

* [http://wakaba.c3.cx/soc/kareha.pl/1100499906/ Discussion of tripcodes and English searchers]
* [http://utilitymill.com/utility/Tripcode_Generator Online tool to generate 4-ch or 4chan style tripcode from a password]