Received: from localhost (maia-3.hub.org [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id 932AD9FB32E for ; Tue, 5 Jun 2007 12:22:16 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-maia, port 10024) with ESMTP id 55748-03-2 for ; Tue, 5 Jun 2007 12:22:08 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.177]) by postgresql.org (Postfix) with ESMTP id 646959FB34E for ; Tue, 5 Jun 2007 12:22:08 -0300 (ADT) Received: by py-out-1112.google.com with SMTP id p76so3636072pyb for ; Tue, 05 Jun 2007 08:22:04 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=PC4V7h+JKOSmKOPqmyM8GIvLcQJ0FihB6oEvG/zy6+tqLI2rFmAiRoSo1u1qGvsQUkn16+ey9AOekcNlBEg6dg3LZphsEIN1lK1/svKyPGkUgTjxRY7umojPY6yX0obIJun9XCQuRvm2/KG9XzqUPqLAqBWLX3Fu4D4gao6im2Y= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=k01AXrwPrg+yWhF7WsehhIVzBdwJEifBrcKB5ZM3R5bV051fiF/rvzcVIwMCj+T647F841/4oxkERVMiQMjj0BfuOhcdm4dM8fMoIjsH+bu0AI82QDLp/c2guGqY7W4eT31xE7D3XlkXeuCIjP7YhUqfkVBRIY1FCD+G622dRDk= Received: by 10.64.131.4 with SMTP id e4mr7426064qbd.1181056924358; Tue, 05 Jun 2007 08:22:04 -0700 (PDT) Received: by 10.65.253.17 with HTTP; Tue, 5 Jun 2007 08:22:04 -0700 (PDT) Message-ID: <183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com> Date: Tue, 5 Jun 2007 11:22:04 -0400 From: "Brian Mathis" To: "Marko Kreen" Subject: Re: Encrypted column Cc: "Tino Wildenhain" , "Ranieri Mazili" , pgsql-general@postgresql.org, pgsql-sql@postgresql.org In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de> <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/410 X-Sequence-Number: 115233 On 6/5/07, Marko Kreen wrote: > On 6/5/07, Marko Kreen wrote: > > both md5 and sha1 are actually easier to bruteforce than > > the old DES-based crypt. > > If this statement seems weird - the problem is the speed. > MD5 and SHA1 are just faster algorithms than des-crypt. > > And there's nothing wrong with fast general-purpose algorithms, > as long their cryptographic properties hold. Starting from > 20-30 bytes the bruteforce is really not an option. > > But if you have under 10 bytes (let be honest - you have > 6 bytes...) the speed start to matter, because it is possible > on random laptop to simply try all combinations. > > -- > marko > pgcrypto also supports md5, so I'm not sure what you're referring to here. As I already mentioned, *salting* before you hash is a very important step. I'm not sure if you saw that in my post. Without a salt, it's trivial to generate a list of all combinations of md5'd strings and their results, up to reasonable lengths. Then it would be very simple to look up each hash and get the original text. With a salt, you need to generate all possible md5s for all possible salts -- a much harder task. In any case, pgcrypto seems to be a nice and full featured tool, so one should use that instead of rolling their own.