From: Craig Ringer <ringerc@ringerc.id.au>
To: lst_hoe02@kwsoft.de
Cc: pgsql-admin@postgresql.org
Subject: Re: User password encryption using a stronger hashing function?
Date: Fri, 23 Dec 2011 11:18:48 +0800
Message-ID: <4EF3F318.8080706@ringerc.id.au> (raw)
In-Reply-To: <20111222104153.10445qh7dzbv35s0@webmail.kwsoft.de>
References: <47AB18AC0F23934383F2BBA7EE3D8D742281BB698C@DC-US1MBEX4.global.avaya.com>
<47AB18AC0F23934383F2BBA7EE3D8D742281EB9415@DC-US1MBEX4.global.avaya.com>
<20111222104153.10445qh7dzbv35s0@webmail.kwsoft.de>
On 22/12/2011 5:41 PM, lst_hoe02@kwsoft.de wrote:
> Zitat von "Liu, Jianli (Jianli)" <jlliu@avaya.com>:
>
>> No one has responded to my questions. I am wondering if anyone can
>> point me to where in postgresql source code I can further look into
>> the issue and explore the possibility of this change? Thanks.
>
> I was already looking for the same topic but could not find anything
> useful. Maybe no one is using the build-in password encryption, but
> does it at application level with transparent data access?
>
> Maybe one of the developers can explain why the choices for build-in
> password encryption are that limited.
>
I'm not a Pg dev, but I won't be surprised if the v3 protocol doesn't
support other hash functions. I haven't looked into it. If you'd like to
know more I suggest you search for things like "md5", "sha1", "sha256",
"stronger hash" etc on the pogsql-hackers mailing list archives.
The main downside of md5 as a password hash function is that the result
is small and quick to compute the standard of today's hashes, so rainbow
tables are easier to build and can have better coverage. Brute-force
cracking is also faster but there's not as much difference there.
If you have a need for stronger hashing functions you might want to
contact one of the consultants who does contract work on PostgreSQL
development and find out what'd be involved in funding the development
of the feature. Think about why you need it first, though; what
threat(s) are you trying to protect from?
--
Craig Ringer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ringerc@ringerc.id.au, lst_hoe02@kwsoft.de
Subject: Re: User password encryption using a stronger hashing function?
In-Reply-To: <4EF3F318.8080706@ringerc.id.au>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox