From: Brian Mathis <brian.mathis@gmail.com>
To: Marko Kreen <markokr@gmail.com>
Cc: Tino Wildenhain <tino@wildenhain.de>
Cc: Ranieri Mazili <ranieri.oliveira@terra.com.br>
Cc: pgsql-general@postgresql.org
Cc: pgsql-sql@postgresql.org
Subject: Re: Encrypted column
Date: Tue, 5 Jun 2007 10:26:08 -0400
Message-ID: <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> (raw)
In-Reply-To: <e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
References: <46645B01.6070605@terra.com.br>
<4665161F.9090009@wildenhain.de>
<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
On 6/5/07, Marko Kreen <markokr@gmail.com> wrote:
> On 6/5/07, Tino Wildenhain <tino@wildenhain.de> wrote:
> > Ranieri Mazili schrieb:
> > > Hello,
> > >
> > > I need to store users and passwords on a table and I want to store it
> > > encrypted, but I don't found documentation about it, how can I create a
> > > table with columns "user" and "password" with column "password"
> > > encrypted and how can I check if "user" and "password" are correct using
> > > a sql query ?
> >
> > Passwords are usually not encrypted but hashed instead. A common hash
> > function is available in postgres w/o any additional extension:
> >
> > md5()
> >
> > The rule is, if two hashes compare equal, then the original data must
> > be equal (yes, there are chances for collisions, but practically very
> > low. See also sha1 and friends in the pgcrypto contrib module)
>
> Both md5 and sha1 are bad for passwords, no salt and easy to
> bruteforce - due to the tiny amount of data in passwords.
>
> Proper ways is to use crypt() function from pgcrypto module.
> Due to historical accident is has bad name which hints at
> encryption, actually its only purpose is to hash passwords.
> Read more in pgcrypto doc.
>
> --
> marko
>
If you salt them yourself, there's no problem with md5 or sha1, and
they are arguably more secure than the old "crypt" call. Most modern
linuxes use md5 for password storage.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: brian.mathis@gmail.com, markokr@gmail.com, tino@wildenhain.de, ranieri.oliveira@terra.com.br, pgsql-general@postgresql.org
Subject: Re: Encrypted column
In-Reply-To: <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox