i is the number of iterations, i <= 0.
j is a number <= -1 .
x is the input data.
0xd is a single byte with the hexadecimal value d.
H(z) is an existing hash function.
All hash operations have a binary output; no string conversation is done.
x*z are z repetitions (concatenations) of x.
- It is recommended not to use i=0.
- P, Q and K are chosen to arbitary data . It can be chosen to a different value, but should not be empty.
- P should never be equal to Q, otherwise, A(i,s,x) could become equal to B(i,s,x).
=> in A(i,s,x) and B(i,s,x), this embedded value H(z) has to be calculated only once.
- If H(x) is compromised, MHA2 (even unsalted) would be still safe.
- If a high value for i is chosen, the hash will be slow.
Therefore, the creation of a rainbow table or brute force attacks will be slow (see runtime section).
On the other hand, a brute force attack could result in a DoS if the CPU of the server is too weak.
- The salt should always be set.
The salt should be a merge of an individual (random unique) user-specific salt, a service-specific salt and server-specific salt.
an attack can be found where A(i,s,x) = B(i,s,x) can be enforced.
-  <iterations> is the number of iterations, e.g. 1987.
-  <salt-base64> is the iterated salt used for MHA2, encoded in Base64.