Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtp (Exim 4.84_2)
	(envelope-from
 <pgsql-admin-owner+M45407=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
	id 1az4L5-0003Gq-P8
	for pgsql-admin@arkaria.postgresql.org; Sat, 07 May 2016 15:40:20 +0000
Received: from localhost ([127.0.0.1] helo=postgresql.org)
	by malur.postgresql.org with smtp (Exim 4.84_2)
	(envelope-from
 <pgsql-admin-owner+M45407=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
	id 1az4L4-0000y1-V4
	for pgsql-admin@arkaria.postgresql.org; Sat, 07 May 2016 15:40:19 +0000
Received: from makus.postgresql.org ([2001:4800:1501:1::229])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.84_2)
	(envelope-from <gandalf@shopzeus.com>)
	id 1az4JN-0007RI-8R
	for pgsql-admin@postgresql.org; Sat, 07 May 2016 15:38:33 +0000
Received: from shopzeus.com ([87.229.70.149])
	by makus.postgresql.org with esmtp (Exim 4.84_2)
	(envelope-from <gandalf@shopzeus.com>)
	id 1az4JJ-0001IR-Sz
	for pgsql-admin@postgresql.org; Sat, 07 May 2016 15:38:31 +0000
Received: from [127.127.127.127] (localhost [127.127.127.127])
	(Authenticated sender: gandalf)
	by shopzeus.com (Postfix) with ESMTPSA id 88F07889C90B
	for <pgsql-admin@postgresql.org>; Sat,  7 May 2016 11:38:26 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shopzeus.com;
	s=shopzeus_com; t=1462635506;
	bh=gEvQ5Z4Ms8ODM+MN/jDakNPCPGRSFvDh34hPUBQZ8/M=;
	h=To:From:Subject:Date:From;
	b=LuaQBvv5u52RY9znFDJ0fmj3OdiEGcGyyFblfB4CyKtASjVXhhaJYv2PjpXviwBON
	 QDQ8ashJMB0Qr/UhtcJ0/32AMvHyG5HE8Q4gO3Q+mgxwo8ksORcd5m9ijVdJPDsCCh
	 l/THe/SORYxlCgeU+WWSCqn+zctcgHwDb9mOg3oOtCri94aMF9KjdolnAv4OwcyPAM
	 XNT0QePfW3VAoAmN2fKIp4amUKk0/LDcWQ2rSXadDinJILz4gNkISs0yEeAn+NmfgK
	 aDHtBxkBV6JlDJXOyH12tmDcN+cGkogjsVS7n6wbPPJpmdAzGBYEnkwzy+EUkSrpQ1
	 euqhd6tYYqIIA==
To: pgsql-admin@postgresql.org
From: =?UTF-8?Q?Nagy_L=c3=a1szl=c3=b3_Zsolt?= <gandalf@shopzeus.com>
Subject: md5 auth procotol - can it be replayed?
Message-ID: <572E0BFE.7040709@shopzeus.com>
Date: Sat, 7 May 2016 17:38:38 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-2
Content-Transfer-Encoding: quoted-printable
X-Pg-Spam-Score: -6.4 (------)
List-Archive: <http://archives.postgresql.org/pgsql-admin>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-admin.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@postgresql.org>
List-Post: <mailto:pgsql-admin@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-admin>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
X-Mailing-List: pgsql-admin
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

How the md5 hashed authentication method works? Is it protected against
replay attacks? Here is what I have in mind:

* If the server stores salted hashed passwords, then I do not see how
the server could authenticate the users without getting the password in
clear text?
* If the server stores (unsalted) password hash values, then basically
there is almost no difference between a clear text password and an md5
hash, because anyone can replay the send the same hash value and log in
again.

Am I missing something?

Thanks,

   Laszlo




--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin