pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Daniel Struck <struck.d@retrovirology.lu>
To: Greg Stark <gsstark@mit.edu>
Cc: Bruno Wolff III <bruno@wolff.to>
Cc: Mitch Pirtle <mitchy@spacemonkeylabs.com>
Cc: pgsql-php@postgresql.org
Subject: Re: [ADMIN] Secure DB Systems - How to
Date: Thu, 29 Jul 2004 11:16:08 +0200
Message-ID: <20040729111608.0ef34e4b@gentoo> (raw)
In-Reply-To: <87brhzsx9x.fsf@stark.xeocode.com>
References: <ccjra4$pgl$1@sea.gmane.org>
	<20040709152722.GA20935@wolff.to>
	<20040713113557.31e9d6dc@localhost>
	<20040713123817.GB3710@wolff.to>
	<20040713151838.0004cb8e@localhost>
	<40F3EC4A.1060101@spacemonkeylabs.com>
	<20040727134133.676ab9cf@localhost>
	<20040727194905.GA20499@wolff.to>
	<87brhzsx9x.fsf@stark.xeocode.com>

> If searching for exact matches works then you're using a naive encryption
> system. The problem is that it also means your database is vulnerable to
> dictionary attacks. Good encryption systems will include random padding to
> ensure that you can't attack it by merely guessing many possible plaintexts
> and verifying to see if any match.

To prevent this, I use in my implementation for every encrypted value a corresponding IV to prevent that the same value will give the same crypted text.

This is a reason, why I must do pattern searches in postgresql itself, because I do need to include the IV-column in the sql statement.


Daniel


-- 
Retrovirology Laboratory Luxembourg
Centre Hospitalier de Luxembourg
4, rue E. Barblé
L-1210 Luxembourg

phone: +352-44116105
fax:   +352-44116113
web: http://www.retrovirology.lu
e-mail: struck.d@retrovirology.lu



view thread (17+ messages)  latest in thread

Message-ID: <20040729111608.0ef34e4b@gentoo>
Permalink:  ../20040729111608.0ef34e4b@gentoo/
Also on:    postgresql.org/message-id/20040729111608.0ef34e4b@gentoo

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: struck.d@retrovirology.lu, gsstark@mit.edu, bruno@wolff.to, mitchy@spacemonkeylabs.com, pgsql-php@postgresql.org
  Subject: Re: [ADMIN] Secure DB Systems - How to
  In-Reply-To: <20040729111608.0ef34e4b@gentoo>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox