Received: from localhost (maia-3.hub.org [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id 1E7B69FA2BC for ; Tue, 5 Jun 2007 11:26:18 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 01887-02-6 for ; Tue, 5 Jun 2007 11:26:01 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from qb-out-0506.google.com (qb-out-0506.google.com [72.14.204.236]) by postgresql.org (Postfix) with ESMTP id 7F0E69FBDCF for ; Tue, 5 Jun 2007 11:26:10 -0300 (ADT) Received: by qb-out-0506.google.com with SMTP id e11so1441450qbe for ; Tue, 05 Jun 2007 07:26:08 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=lmD08ajUbbTjHYE+2ldGhiB17PJ+RUPSvwS0Vbrba4pegLjg3lVIVji1fTEY4q9GdVnAOkYjFIqrl/ZJ4BzU32gl+pkmvCUuTUiQ7FPbhnOhhRgg0FMT8J4qVsU5Ryb8oidquq9YPPp1bl4pKpN8Z5h46hgL54bZlPrLN3MrgiY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=UDYF55NZOarZhDOE8vsgAIMCIidg+5JZESgjBr9OAJC2m5GUQK7Rv39/kX9g5I8JxWCG9cFZLC1CMZWdfWVC4O3PKSQ1+/z+hvNQo62NP9iZSzNnK+i/AgocVLmxINuQMdZk1ACxyZsRJSVb28RCMd5tsqvTBemehw5FCr9FSjc= Received: by 10.65.84.5 with SMTP id m5mr9199060qbl.1181053568580; Tue, 05 Jun 2007 07:26:08 -0700 (PDT) Received: by 10.65.253.17 with HTTP; Tue, 5 Jun 2007 07:26:08 -0700 (PDT) Message-ID: <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> Date: Tue, 5 Jun 2007 10:26:08 -0400 From: "Brian Mathis" To: "Marko Kreen" Subject: Re: Encrypted column Cc: "Tino Wildenhain" , "Ranieri Mazili" , pgsql-general@postgresql.org, pgsql-sql@postgresql.org In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/398 X-Sequence-Number: 115221 On 6/5/07, Marko Kreen wrote: > On 6/5/07, Tino Wildenhain wrote: > > Ranieri Mazili schrieb: > > > Hello, > > > > > > I need to store users and passwords on a table and I want to store it > > > encrypted, but I don't found documentation about it, how can I create a > > > table with columns "user" and "password" with column "password" > > > encrypted and how can I check if "user" and "password" are correct using > > > a sql query ? > > > > Passwords are usually not encrypted but hashed instead. A common hash > > function is available in postgres w/o any additional extension: > > > > md5() > > > > The rule is, if two hashes compare equal, then the original data must > > be equal (yes, there are chances for collisions, but practically very > > low. See also sha1 and friends in the pgcrypto contrib module) > > Both md5 and sha1 are bad for passwords, no salt and easy to > bruteforce - due to the tiny amount of data in passwords. > > Proper ways is to use crypt() function from pgcrypto module. > Due to historical accident is has bad name which hints at > encryption, actually its only purpose is to hash passwords. > Read more in pgcrypto doc. > > -- > marko > If you salt them yourself, there's no problem with md5 or sha1, and they are arguably more secure than the old "crypt" call. Most modern linuxes use md5 for password storage.