Received: from localhost (maia-2.hub.org [200.46.204.187]) by postgresql.org (Postfix) with ESMTP id B26379FBA1C for ; Tue, 5 Jun 2007 10:35:27 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.187]) (amavisd-maia, port 10024) with ESMTP id 78219-01-5 for ; Tue, 5 Jun 2007 10:35:12 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4 Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.178]) by postgresql.org (Postfix) with ESMTP id 912089F9A3C for ; Tue, 5 Jun 2007 10:31:05 -0300 (ADT) Received: by py-out-1112.google.com with SMTP id p76so3563665pyb for ; Tue, 05 Jun 2007 06:31:03 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=VRIyw/84WZxOi+hAiwqhIIvbNrfwNjzcvB1ISMANbo2LDvF8RSi6WGraUQ9J8yNCaHIX4yMm8IwCzLEMa/AeRQpvXDzn6uN0YN5vdKGGvc3VDJbRV1/83e8LKNOBkNujpPZp1eZGr5ZjRCMgifjfH3WFlu8UzYqSBvHSZ/FLr/Y= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=MCnm2nZNx7q7lS2EFkJR3FzqRtN/VtSUeSpE1jPMcGLoPe6dfsUWWuFBkkP3QR2lEuuJxkhRLDERAGmp2R+l3udUW8K8yyYiXK0jtiLNOokhgC100r6wz7oLdJmow8zgATRB3EAX+gk036/BTFGbVom/YRGUDu8K23qi7fnkEgw= Received: by 10.65.132.13 with SMTP id j13mr9036634qbn.1181050262854; Tue, 05 Jun 2007 06:31:02 -0700 (PDT) Received: by 10.65.253.17 with HTTP; Tue, 5 Jun 2007 06:31:02 -0700 (PDT) Message-ID: <183c528b0706050631q63c64a43t3981002ad822632d@mail.gmail.com> Date: Tue, 5 Jun 2007 09:31:02 -0400 From: "Brian Mathis" To: "Tino Wildenhain" Subject: Re: Encrypted column Cc: "Ranieri Mazili" , pgsql-general@postgresql.org, pgsql-sql@postgresql.org In-Reply-To: <4665161F.9090009@wildenhain.de> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/388 X-Sequence-Number: 115211 On 6/5/07, Tino Wildenhain wrote: > Ranieri Mazili schrieb: > > Hello, > > > > I need to store users and passwords on a table and I want to store it > > encrypted, but I don't found documentation about it, how can I create a > > table with columns "user" and "password" with column "password" > > encrypted and how can I check if "user" and "password" are correct using > > a sql query ? > > Passwords are usually not encrypted but hashed instead. A common hash > function is available in postgres w/o any additional extension: > > md5() > > The rule is, if two hashes compare equal, then the original data must > be equal (yes, there are chances for collisions, but practically very > low. See also sha1 and friends in the pgcrypto contrib module) > > Regards > Tino > Remember, you would also want to add some sort of salt before you ran the hash, otherwise your password list is vulnerable to a simple brute-force attack.