Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tTMxG-0055jK-7Y for pgsql-hackers@arkaria.postgresql.org; Thu, 02 Jan 2025 15:17:47 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1tTMxF-00G6QS-Gk for pgsql-hackers@arkaria.postgresql.org; Thu, 02 Jan 2025 15:17:45 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tTMxF-00G6QK-5F for pgsql-hackers@lists.postgresql.org; Thu, 02 Jan 2025 15:17:44 +0000 Received: from dd48506.kasserver.com ([85.13.164.188]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tTMxC-002qIs-Gt for pgsql-hackers@postgresql.org; Thu, 02 Jan 2025 15:17:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oopsware.de; s=kas202409031116; t=1735831061; bh=ngxO5wlDTcB3h/y070V4k1lHrz5LI4AokDTHzHPA2h4=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=DocEsrvc4w1wVSWBFaYSlJx7evNdwaCectPRnEm10ldAUa6sc28vEpKEoNH5pOf1b Bz0kCjPJBzkJNAjSXlghC0WtQIOqRIukPx40TG/bC74nQ+sVKMZYdeBizESm/gvXdl A8lNed32ex9gl0/1UHmnFoaF3s9je93nMiuZY2xS4vQIzUV2HvpXibGgKYNf0WL1+X 1HIA69z9Y+fg8I5FUWWyW4EIUS7omwR5IufwI5ni5Xf293u4CrPTudn+My60jnbvhe PyBI+Rsa246mJHbRX1CZSaiKVEwvAbwXJHrsMF8iZf1sg4i1dhLqdbO5mBcBGeYb+r x7BcTmueDhqug== Received: from sethos.at.struktu.ro (sethos.at.struktu.ro [46.4.183.126]) by dd48506.kasserver.com (Postfix) with ESMTPSA id BB4818664858; Thu, 2 Jan 2025 16:17:41 +0100 (CET) Received: from chufu.bluecherstrasse.oopsware.lan (i5C750954.versanet.de [92.117.9.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sethos.at.struktu.ro (Postfix) with ESMTPSA id 5F280417110C; Thu, 2 Jan 2025 16:17:41 +0100 (CET) Message-ID: Subject: Re: Modern SHA2- based password hashes for pgcrypto From: Bernd Helmle To: Daniel Gustafsson Cc: PostgreSQL Hackers Date: Thu, 02 Jan 2025 16:17:40 +0100 In-Reply-To: References: Autocrypt: addr=mailings@oopsware.de; prefer-encrypt=mutual; keydata=mQGiBEIM4dYRBACEnxQZ/CfR1xbCJzGOIjvh3fZpLALMm+tt237QlZm9nlLaEwCn317sT 1khPAJwhyBHSHbNFbH+LOL6ezYrg4V2Q9KHyYJDStJtC8c+D7vHVB5Jfslynx89DnCH6jb3H0j+U0 iNYmRmT18PWTZhD5RuXT+Toyz/0hH4YnJzha4VUwCggikXRuhIQ0KIzrps7/PsvasTPjUD/1aoEHR wVyk2C2hXh6GWJYq+1l+sB2d0TOnFJf2xy3Xo03Hi+BEJJdYGqJKqzd0KfsFyJYhO2GIGScSEj1hs TqAiY8OZeRqRGHe69OQEguUSVXp/jPaqU8fel8dbDDMnXkgULq8oO4T9e4GJSFqIvrlx0sJqSMFdi ihV+xCzDS40BACBrTq9tyXmyxJWzQ1/0Hx9S4sU+yeR8ztZH9xgWi1wksfHpEgZBdAkQynlI80/bC tgxfVu+LKgxeqGfMSnT9t8agpr1IGcmSbDntbn/K+3EmCze0jq8EQrZHJWiwCqraM8mnmILSEl5zn aoVoBIF062b60zZicuNeYaVgEKSHfirQgQmVybmQgSGVsbWxlIDxiZXJuZEBvb3Bzd2FyZS5kZT6I XgQTEQIAHgUCQhyP2gIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRBRdc2OhdlKzMm4AJ9mW1np2 RXi66WzEvcIanaJkDT+xgCfZmXG/Sziz5FchI3OjXfXDZfwnNm0J0Jlcm5kIEhlbG1sZSA8YmVybm QuaGVsbWxlQG9vcHN3YXJlLmRlPoheBBMRAgAeBQJCDOHWAhsDBgsJCAcDAgMVAgMDFgIBAh4BAhe AAAoJEFF1zY6F2UrMWZgAn3MVwDBzRS5dZu1yjx7WU3E3JSheAJ41CUYMIkX/oYfWssUVYnOuedgn 8LQlQmVybmQgSGVsbWxlIDxiaEBzY2huYWVwcGNoZW5qYWdkLmRlPoheBBMRAgAeBQJCHI+pAhsDB gsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEFF1zY6F2UrMYMUAn0rk8fEEY2tHGSUD7PNbk+Fwkd7MAJ 4wMfOerrvsKTrB9xmFnZ2ZUy67w7QjQmVybmQgSGVsbWxlIDxtYWlsaW5nc0Bvb3Bzd2FyZS5kZT6 IXgQTEQIAHgUCQhyPxgIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRBRdc2OhdlKzOhrAJ4w+A3H cjTJb54lUDpyyQu6Y5dlVQCeJCFKygOVbpn4HSp4Z+R6+s4Rul60J0Jlcm5kIEhlbG1sZSA8YmVyb mQuaGVsbWxlQGN5YmVydGVjLmF0Poh4BBMRAgA4FiEEcLVWcrwQIdBqHtvMUXXNjoXZSswFAmDe1D kCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQUXXNjoXZSszs9QCfbbpKT0/Mh4PhfS6rRbm NNQC1zS8An2x1PLHPS6649DRkiYOMWTXzAlSE Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.54.2 (3.54.2-1.fc41) MIME-Version: 1.0 X-Spamd-Bar: / List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk Am Donnerstag, dem 02.01.2025 um 15:57 +0100 schrieb Daniel Gustafsson: > > I adapted the code from the publicly available reference > > implementation > > at [1]. It's based on our existing OpenSSL infrastructure in > > pgcrypto > > and produces compatible password hashes with crypt() and "openssl > > passwd" with "-5" and "-6" switches. >=20 > Potentially daft question, but since we require OpenSSL to build > pgcrypto, why > do we need to include sha2 code instead of using the sha2 > implementation in > libcrypto? How complicated would it be to use the OpenSSL API > instead? Not sure i got you, but i use OpenSSL and the SHA2 implementation there. See the pgcrypto px_* API (px.h and openssl.c respectively) i am using to create the digests. Thanks, Bernd