Actually, it is SHA but it’s like a base64 encoding with {SHA} appended to the front which is just a damn weird way to do things. More details here (are your trackbacks not working?): http://www.shaunhills.com/weblog/?p=270