Date: Thu, 29 Jul 2004 11:16:08 +0200
From: Daniel Struck <struck.d@retrovirology.lu>
To: Greg Stark <gsstark@mit.edu>
Cc: Bruno Wolff III <bruno@wolff.to>,
	Mitch Pirtle <mitchy@spacemonkeylabs.com>, pgsql-php@postgresql.org
Subject: Re: [ADMIN] Secure DB Systems - How to
Message-Id: <20040729111608.0ef34e4b@gentoo>
In-Reply-To: <87brhzsx9x.fsf@stark.xeocode.com>
References: <ccjra4$pgl$1@sea.gmane.org> <20040709152722.GA20935@wolff.to>
	<20040713113557.31e9d6dc@localhost>
	<20040713123817.GB3710@wolff.to>
	<20040713151838.0004cb8e@localhost>
	<40F3EC4A.1060101@spacemonkeylabs.com>
	<20040727134133.676ab9cf@localhost>
	<20040727194905.GA20499@wolff.to>
	<87brhzsx9x.fsf@stark.xeocode.com>
Organization: gwia.inf.chl.lu
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: quoted-printable

> If searching for exact matches works then you're using a naive encryption
> system. The problem is that it also means your database is vulnerable to
> dictionary attacks. Good encryption systems will include random padding to
> ensure that you can't attack it by merely guessing many possible plaintex=
ts
> and verifying to see if any match.

To prevent this, I use in my implementation for every encrypted value a cor=
responding IV to prevent that the same value will give the same crypted tex=
t.

This is a reason, why I must do pattern searches in postgresql itself, beca=
use I do need to include the IV-column in the sql statement.


Daniel


--=20
Retrovirology Laboratory Luxembourg
Centre Hospitalier de Luxembourg
4, rue E. Barbl=E9
L-1210 Luxembourg

phone: +352-44116105
fax:   +352-44116113
web: http://www.retrovirology.lu
e-mail: struck.d@retrovirology.lu