From mark.dingee@cox.net Tue Nov  1 19:38:10 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id C5E31DB000
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 15:38:10 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 82935-09
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 19:38:07 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.201])
	by svr1.postgresql.org (Postfix) with ESMTP id 51EB7DAEC6
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 15:38:07 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA1Jc750019362
	for <pgsql-sql@postgresql.org>; Tue, 1 Nov 2005 14:38:07 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA1Jc7SJ019361
	for pgsql-sql@postgresql.org; Tue, 1 Nov 2005 14:38:07 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: pgsql-sql@postgresql.org
Subject: PGSQL encryption functions
Date: Tue, 1 Nov 2005 14:38:05 -0500
User-Agent: KMail/1.8.2
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="Boundary-00=_eQ8ZDcQBMpdoyuZ"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511011438.06610.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.044 required=5 tests=[AWL=0.043,
 HTML_MESSAGE=0.001]
X-Spam-Score: 0.044
X-Spam-Level: 
X-Archive-Number: 200511/7
X-Sequence-Number: 23259

--Boundary-00=_eQ8ZDcQBMpdoyuZ
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit

Everyone,

I'm in need of a one-way pgsql script that will take a plain-text string and return an ecrypted string (preferably 32 character) .  I've been using md5('string'), but I'm concerned it's too weak for my needs.  Does anyone have any recommendations?

Thanks,
Mark
--Boundary-00=_eQ8ZDcQBMpdoyuZ
Content-Type: text/html;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit

<html><head><meta name="qrichtext" content="1" /></head><body style="font-size:10pt;font-family:Sans">
<p>Everyone,</p>
<p></p>
<p>I'm in need of a one-way pgsql script that will take a plain-text string and return an ecrypted string (preferably 32 character) .  I've been using md5('string'), but I'm concerned it's too weak for my needs.  Does anyone have any recommendations?</p>
<p></p>
<p>Thanks,</p>
<p>Mark</p>
</body></html>
--Boundary-00=_eQ8ZDcQBMpdoyuZ--



From josh@agliodbs.com Tue Nov  1 19:44:53 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id C25BEDB655
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 15:44:53 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 90197-07
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 19:44:51 +0000 (GMT)
Received: from davinci.ethosmedia.com (server227.ethosmedia.com
	[209.128.84.227])
	by svr1.postgresql.org (Postfix) with ESMTP id 9121ADB10A
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 15:44:52 -0400 (AST)
X-EthosMedia-Virus-Scanned: no infections found
Received: from [64.81.245.111] (account josh@agliodbs.com HELO [192.168.2.3])
	by davinci.ethosmedia.com (CommuniGate Pro SMTP 4.1.8)
	with ESMTP id 8398954; Tue, 01 Nov 2005 11:47:23 -0800
From: Josh Berkus <josh@agliodbs.com>
Reply-To: josh@agliodbs.com
Organization: Aglio Database Solutions
To: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Date: Tue, 1 Nov 2005 11:49:04 -0800
User-Agent: KMail/1.8
Cc: "Mark R. Dingee" <mark.dingee@cox.net>
References: <200511011438.06610.mark.dingee@cox.net>
In-Reply-To: <200511011438.06610.mark.dingee@cox.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511011149.05118.josh@agliodbs.com>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.019 required=5 tests=[AWL=0.019]
X-Spam-Score: 0.019
X-Spam-Level: 
X-Archive-Number: 200511/8
X-Sequence-Number: 23260

Mark,

> I'm in need of a one-way pgsql script that will take a plain-text string
> and return an ecrypted string (preferably 32 character) .  I've been
> using md5('string'), but I'm concerned it's too weak for my needs.  Does
> anyone have any recommendations?

You check out pgcrypto in /contrib in the PostgreSQL source?

-- 
--Josh

Josh Berkus
Aglio Database Solutions
San Francisco



From bruno@wolff.to Tue Nov  1 21:26:37 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 6F089DB1B9
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 17:26:37 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 41267-09
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 21:26:35 +0000 (GMT)
Received: from wolff.to (wolff.to [66.93.197.194])
	by svr1.postgresql.org (Postfix) with SMTP id DDF00DA9C4
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 17:26:35 -0400 (AST)
Received: (qmail 29665 invoked by uid 500); 1 Nov 2005 21:28:44 -0000
Date: Tue, 1 Nov 2005 15:28:44 -0600
From: Bruno Wolff III <bruno@wolff.to>
To: "Mark R. Dingee" <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Message-ID: <20051101212844.GA24861@wolff.to>
Mail-Followup-To: Bruno Wolff III <bruno@wolff.to>,
	"Mark R. Dingee" <mark.dingee@cox.net>, pgsql-sql@postgresql.org
References: <200511011438.06610.mark.dingee@cox.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200511011438.06610.mark.dingee@cox.net>
User-Agent: Mutt/1.4.2.1i
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006]
X-Spam-Score: 0.006
X-Spam-Level: 
X-Archive-Number: 200511/10
X-Sequence-Number: 23262

On Tue, Nov 01, 2005 at 14:38:05 -0500,
  "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> Everyone,
> 
> I'm in need of a one-way pgsql script that will take a plain-text string and return an ecrypted string (preferably 32 character) .  I've been using md5('string'), but I'm concerned it's too weak for my needs.  Does anyone have any recommendations?

What are your needs?



From mark.dingee@cox.net Tue Nov  1 21:30:55 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 4A720DB734
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 17:30:55 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 45376-02
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 21:30:52 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.201])
	by svr1.postgresql.org (Postfix) with ESMTP id 67246DB72E
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 17:30:53 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA1LUrRs020361;
	Tue, 1 Nov 2005 16:30:53 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA1LUqf3020360;
	Tue, 1 Nov 2005 16:30:53 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: josh@agliodbs.com
Subject: Re: PGSQL encryption functions
Date: Tue, 1 Nov 2005 16:30:51 -0500
User-Agent: KMail/1.8.2
Cc: pgsql-sql@postgresql.org
References: <200511011438.06610.mark.dingee@cox.net>
	<200511011149.05118.josh@agliodbs.com>
In-Reply-To: <200511011149.05118.josh@agliodbs.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511011630.52140.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.035 required=5 tests=[AWL=0.035]
X-Spam-Score: 0.035
X-Spam-Level: 
X-Archive-Number: 200511/11
X-Sequence-Number: 23263

I'll check it out.  Thanks, Josh

On Tuesday 01 November 2005 02:49 pm, Josh Berkus wrote:
> Mark,
>
> > I'm in need of a one-way pgsql script that will take a plain-text string
> > and return an ecrypted string (preferably 32 character) .  I've been
> > using md5('string'), but I'm concerned it's too weak for my needs.  Does
> > anyone have any recommendations?
>
> You check out pgcrypto in /contrib in the PostgreSQL source?





From mark.dingee@cox.net Tue Nov  1 22:00:51 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 1727FDB716
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 18:00:51 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 57269-03
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 22:00:47 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.97])
	by svr1.postgresql.org (Postfix) with ESMTP id 34282DB6CB
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 18:00:48 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA1M0pLG020658;
	Tue, 1 Nov 2005 17:00:51 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA1M0pOi020657;
	Tue, 1 Nov 2005 17:00:51 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Date: Tue, 1 Nov 2005 17:00:50 -0500
User-Agent: KMail/1.8.2
Cc: Bruno Wolff III <bruno@wolff.to>
References: <200511011438.06610.mark.dingee@cox.net>
	<20051101212844.GA24861@wolff.to>
In-Reply-To: <20051101212844.GA24861@wolff.to>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511011700.50776.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.029 required=5 tests=[AWL=0.029]
X-Spam-Score: 0.029
X-Spam-Level: 
X-Archive-Number: 200511/13
X-Sequence-Number: 23265

Bruno,

I use an authenticate() function as a part of state maintenance in a PHP web 
app.  In the function, I generate an encrypted token that is then used in the 
validation process on subsequent pages.  md5 works, but I've been able to 
brute-force crack it very quickly, so I'm looking for an alternative.  Any 
thoughts would be greatly appreciated.

Thanks,
Mark

On Tuesday 01 November 2005 04:28 pm, Bruno Wolff III wrote:
> On Tue, Nov 01, 2005 at 14:38:05 -0500,
>
>   "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> > Everyone,
> >
> > I'm in need of a one-way pgsql script that will take a plain-text string
> > and return an ecrypted string (preferably 32 character) .  I've been
> > using md5('string'), but I'm concerned it's too weak for my needs.  Does
> > anyone have any recommendations?
>
> What are your needs?
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
>                http://archives.postgresql.org



From tgl@sss.pgh.pa.us Tue Nov  1 22:13:33 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 8F4AADB72E
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 18:13:33 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 56927-10
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 22:13:31 +0000 (GMT)
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by svr1.postgresql.org (Postfix) with ESMTP id F1F67DB71D
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 18:13:31 -0400 (AST)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id jA1MDUZK028739;
	Tue, 1 Nov 2005 17:13:30 -0500 (EST)
To: "Mark R. Dingee" <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org, Bruno Wolff III <bruno@wolff.to>
Subject: Re: PGSQL encryption functions 
In-reply-to: <200511011700.50776.mark.dingee@cox.net> 
References: <200511011438.06610.mark.dingee@cox.net>
	<20051101212844.GA24861@wolff.to>
	<200511011700.50776.mark.dingee@cox.net>
Comments: In-reply-to "Mark R. Dingee" <mark.dingee@cox.net>
	message dated "Tue, 01 Nov 2005 17:00:50 -0500"
Date: Tue, 01 Nov 2005 17:13:30 -0500
Message-ID: <28738.1130883210@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006]
X-Spam-Score: 0.006
X-Spam-Level: 
X-Archive-Number: 200511/14
X-Sequence-Number: 23266

"Mark R. Dingee" <mark.dingee@cox.net> writes:
> md5 works, but I've been able to 
> brute-force crack it very quickly,

Really?  Where's your publication of this remarkable breakthrough?

			regards, tom lane



From mario.splivalo@mobart.hr Wed Nov  2 09:26:32 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id CD70ED6854
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 05:26:32 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 57589-02
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 09:26:29 +0000 (GMT)
Received: from pjetlic.mobart.hr (pjetlic.mobart.hr [80.80.51.10])
	by svr1.postgresql.org (Postfix) with ESMTP id 460B0D6819
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 05:26:30 -0400 (AST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by pjetlic.mobart.hr (Postfix) with ESMTP id 4407E17A0E
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 10:26:27 +0100 (CET)
Received: from pjetlic.mobart.hr ([127.0.0.1])
	by localhost (pjetlic [127.0.0.1]) (amavisd-new, port 10024)
	with LMTP id 27266-01-2 for <pgsql-sql@postgresql.org>;
	Wed, 2 Nov 2005 10:26:27 +0100 (CET)
Received: from mike.mobart.hr (mike.mobart.hr [192.168.10.94])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by pjetlic.mobart.hr (Postfix) with ESMTP id 2943517449
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 10:26:27 +0100 (CET)
Subject: Re: PGSQL encryption functions
From: Mario Splivalo <mario.splivalo@mobart.hr>
Reply-To: mario.splivalo@mobart.hr
To: pgsql-sql@postgresql.org
In-Reply-To: <28738.1130883210@sss.pgh.pa.us>
References: <200511011438.06610.mark.dingee@cox.net>
	<20051101212844.GA24861@wolff.to>
	<200511011700.50776.mark.dingee@cox.net>
	<28738.1130883210@sss.pgh.pa.us>
Content-Type: text/plain
Organization: Mob-Art
Date: Wed, 02 Nov 2005 10:26:27 +0100
Message-Id: <1130923587.7739.11.camel@ekim>
Mime-Version: 1.0
X-Mailer: Evolution 2.4.1 
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by OpenSource AV+AS Mail Server
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.003 required=5 tests=[AWL=0.003]
X-Spam-Score: 0.003
X-Spam-Level: 
X-Archive-Number: 200511/19
X-Sequence-Number: 23271

On Tue, 2005-11-01 at 17:13 -0500, Tom Lane wrote:
> "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > md5 works, but I've been able to 
> > brute-force crack it very quickly,
> 
> Really?  Where's your publication of this remarkable breakthrough?

I'd say you can't bruteforce md5, unless you're extremley lucky.
However, md5 is easily broken, you just need to know how to construct
the hashes.

One could switch to SHA for 'increaased' security.

Although I don't think he'd be having problems using MD5 as he described
it. I'd also lilke to see he's example of brute-force 'cracking' the MD5
digest.

	Mike
-- 
Mario Splivalo
Mob-Art
mario.splivalo@mobart.hr

"I can do it quick, I can do it cheap, I can do it well. Pick any two."





From mark.dingee@cox.net Wed Nov  2 13:29:54 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 87C42D6DF5
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 09:29:54 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 48059-04
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 13:29:51 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.34])
	by svr1.postgresql.org (Postfix) with ESMTP id 8D6E7D689B
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 09:29:51 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA2DTrQo029081;
	Wed, 2 Nov 2005 08:29:53 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA2DTnqh029079;
	Wed, 2 Nov 2005 08:29:50 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: pgsql-sql@postgresql.org, mario.splivalo@mobart.hr
Subject: Re: PGSQL encryption functions
Date: Wed, 2 Nov 2005 08:29:47 -0500
User-Agent: KMail/1.8.2
References: <200511011438.06610.mark.dingee@cox.net>
	<28738.1130883210@sss.pgh.pa.us> <1130923587.7739.11.camel@ekim>
In-Reply-To: <1130923587.7739.11.camel@ekim>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511020829.48299.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.025 required=5 tests=[AWL=0.025]
X-Spam-Score: 0.025
X-Spam-Level: 
X-Archive-Number: 200511/20
X-Sequence-Number: 23272

Mike & Tom,

The script I'm using to "break" md5 presumes that the cracker knows the 3 
elements being concatenated together to form the plain-text sting which is 
then passed into md5.  The method I'm using then begins running through 
various permutations.  Do you believe that the methodology is appropriate or 
that I'm being a bit paranoid?

Thanks

On Tuesday 01 November 2005 05:13 pm, Tom Lane wrote:
> "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > md5 works, but I've been able to
> > brute-force crack it very quickly,
>
> Really?  Where's your publication of this remarkable breakthrough?
>
> 			regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 1: if posting/reading through Usenet, please send an appropriate
>        subscribe-nomail command to majordomo@postgresql.org so that your
>        message can get through to the mailing list cleanly

On Wednesday 02 November 2005 04:26 am, Mario Splivalo wrote:
> On Tue, 2005-11-01 at 17:13 -0500, Tom Lane wrote:
> > "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > > md5 works, but I've been able to
> > > brute-force crack it very quickly,
> >
> > Really?  Where's your publication of this remarkable breakthrough?
>
> I'd say you can't bruteforce md5, unless you're extremley lucky.
> However, md5 is easily broken, you just need to know how to construct
> the hashes.
>
> One could switch to SHA for 'increaased' security.
>
> Although I don't think he'd be having problems using MD5 as he described
> it. I'd also lilke to see he's example of brute-force 'cracking' the MD5
> digest.
>
> 	Mike



From n.j.saunders@gmail.com Wed Nov  2 14:04:03 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 15A0FD776B
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 10:04:03 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 61986-01
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 14:03:59 +0000 (GMT)
Received: from xproxy.gmail.com (xproxy.gmail.com [66.249.82.203])
	by svr1.postgresql.org (Postfix) with ESMTP id 82764D7070
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 10:04:01 -0400 (AST)
Received: by xproxy.gmail.com with SMTP id t6so208797wxc
	for <pgsql-sql@postgresql.org>; Wed, 02 Nov 2005 06:04:05 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=JwGyhh1G4VYUQF2szOiOm4WocYQNYlvleZXKwofrMYLjP186fpMIxxzQPKKr6TV29b2MEsW1eaOjTupneffUTD5P+PH7qmNSXFRu6aZZNagL42rSzW2DvXey3v39+WGTnw2SwrIA0XMHQmSkzTN5ERIl2YQLQo+6PzlM/kQ5R34=
Received: by 10.70.44.3 with SMTP id r3mr1223152wxr;
	Wed, 02 Nov 2005 06:04:05 -0800 (PST)
Received: by 10.70.51.8 with HTTP; Wed, 2 Nov 2005 06:04:05 -0800 (PST)
Message-ID: <ddcd549e0511020604g32d6556fo7864f03f2373578e@mail.gmail.com>
Date: Wed, 2 Nov 2005 14:04:05 +0000
From: Neil Saunders <n.j.saunders@gmail.com>
To: "Mark R. Dingee" <mark.dingee@cox.net>
Subject: Re: PGSQL encryption functions
Cc: pgsql-sql@postgresql.org, mario.splivalo@mobart.hr
In-Reply-To: <200511020829.48299.mark.dingee@cox.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <200511011438.06610.mark.dingee@cox.net>
	<28738.1130883210@sss.pgh.pa.us> <1130923587.7739.11.camel@ekim>
	<200511020829.48299.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.861 required=5 tests=[AWL=-0.471,
	RCVD_IN_BL_SPAMCOP_NET=1.332]
X-Spam-Score: 0.861
X-Spam-Level: 
X-Archive-Number: 200511/25
X-Sequence-Number: 23277

OK, you're not really "breaking" md5. If the attacker already knows
the information being encrypted, then all you're testing is the
concatenation order- Surely the information is more important than the
order? md5 is a one way hash function, and so using an alternate
algorithm will provide no benefit whatsoever; you're just running
through 9 permutations.

Kind Regards,

Neil.

On 11/2/05, Mark R. Dingee <mark.dingee@cox.net> wrote:
> Mike & Tom,
>
> The script I'm using to "break" md5 presumes that the cracker knows the 3
> elements being concatenated together to form the plain-text sting which i=
s
> then passed into md5.  The method I'm using then begins running through
> various permutations.  Do you believe that the methodology is appropriate=
 or
> that I'm being a bit paranoid?
>
> Thanks
>
> On Tuesday 01 November 2005 05:13 pm, Tom Lane wrote:
> > "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > > md5 works, but I've been able to
> > > brute-force crack it very quickly,
> >
> > Really?  Where's your publication of this remarkable breakthrough?
> >
> >                       regards, tom lane
> >
> > ---------------------------(end of broadcast)--------------------------=
-
> > TIP 1: if posting/reading through Usenet, please send an appropriate
> >        subscribe-nomail command to majordomo@postgresql.org so that you=
r
> >        message can get through to the mailing list cleanly
>
> On Wednesday 02 November 2005 04:26 am, Mario Splivalo wrote:
> > On Tue, 2005-11-01 at 17:13 -0500, Tom Lane wrote:
> > > "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > > > md5 works, but I've been able to
> > > > brute-force crack it very quickly,
> > >
> > > Really?  Where's your publication of this remarkable breakthrough?
> >
> > I'd say you can't bruteforce md5, unless you're extremley lucky.
> > However, md5 is easily broken, you just need to know how to construct
> > the hashes.
> >
> > One could switch to SHA for 'increaased' security.
> >
> > Although I don't think he'd be having problems using MD5 as he describe=
d
> > it. I'd also lilke to see he's example of brute-force 'cracking' the MD=
5
> > digest.
> >
> >       Mike
>
> ---------------------------(end of broadcast)---------------------------
> TIP 1: if posting/reading through Usenet, please send an appropriate
>       subscribe-nomail command to majordomo@postgresql.org so that your
>       message can get through to the mailing list cleanly
>



From tgl@sss.pgh.pa.us Wed Nov  2 14:39:55 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 96ECED6899
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 10:39:55 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 70784-05
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 14:39:52 +0000 (GMT)
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by svr1.postgresql.org (Postfix) with ESMTP id 29C49D6896
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 10:39:54 -0400 (AST)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id jA2Edq3s005333;
	Wed, 2 Nov 2005 09:39:52 -0500 (EST)
To: "Mark R. Dingee" <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org, mario.splivalo@mobart.hr
Subject: Re: PGSQL encryption functions 
In-reply-to: <200511020829.48299.mark.dingee@cox.net> 
References: <200511011438.06610.mark.dingee@cox.net>
	<28738.1130883210@sss.pgh.pa.us> <1130923587.7739.11.camel@ekim>
	<200511020829.48299.mark.dingee@cox.net>
Comments: In-reply-to "Mark R. Dingee" <mark.dingee@cox.net>
	message dated "Wed, 02 Nov 2005 08:29:47 -0500"
Date: Wed, 02 Nov 2005 09:39:52 -0500
Message-ID: <5332.1130942392@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006]
X-Spam-Score: 0.006
X-Spam-Level: 
X-Archive-Number: 200511/27
X-Sequence-Number: 23279

"Mark R. Dingee" <mark.dingee@cox.net> writes:
> The script I'm using to "break" md5 presumes that the cracker knows the 3 
> elements being concatenated together to form the plain-text sting which is 
> then passed into md5.  The method I'm using then begins running through 
> various permutations.  Do you believe that the methodology is appropriate or 
> that I'm being a bit paranoid?

Well, this is a fundamentally insecure way of using *any* crypto hash method.
You're blaming MD5 for the fact that you're misusing it.

There has to be some component of the hash input that the attacker
doesn't know and can't trivially guess.  Adding a randomly chosen "salt"
string is one common way to do that.

			regards, tom lane



From bruno@wolff.to Wed Nov  2 18:57:22 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 983E1D79ED
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 14:57:22 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 82189-04
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 18:57:20 +0000 (GMT)
Received: from wolff.to (wolff.to [66.93.197.194])
	by svr1.postgresql.org (Postfix) with SMTP id F2747D688B
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 14:57:19 -0400 (AST)
Received: (qmail 11250 invoked by uid 500); 2 Nov 2005 18:59:30 -0000
Date: Wed, 2 Nov 2005 12:59:30 -0600
From: Bruno Wolff III <bruno@wolff.to>
To: "Mark R. Dingee" <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Message-ID: <20051102185930.GA10108@wolff.to>
Mail-Followup-To: Bruno Wolff III <bruno@wolff.to>,
	"Mark R. Dingee" <mark.dingee@cox.net>, pgsql-sql@postgresql.org
References: <200511011438.06610.mark.dingee@cox.net>
	<20051101212844.GA24861@wolff.to>
	<200511011700.50776.mark.dingee@cox.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200511011700.50776.mark.dingee@cox.net>
User-Agent: Mutt/1.4.2.1i
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006]
X-Spam-Score: 0.006
X-Spam-Level: 
X-Archive-Number: 200511/30
X-Sequence-Number: 23282

On Tue, Nov 01, 2005 at 17:00:50 -0500,
  "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> Bruno,
> 
> I use an authenticate() function as a part of state maintenance in a PHP web 
> app.  In the function, I generate an encrypted token that is then used in the 
> validation process on subsequent pages.  md5 works, but I've been able to 
> brute-force crack it very quickly, so I'm looking for an alternative.  Any 
> thoughts would be greatly appreciated.

This isn't a problem with MD5. While MD5 does have some theoretical weaknesses,
they aren't really an issue in this case.

Why are you using a hash at all? If you are using the hash as a key, why not
just use a random string instead? The web browser could be handed a session id
and random string and on the server you would have a table indexed by session
ids that includes the random string.

On many systems you can use /dev/urandom as a source of random data. Since
you don't seem to be concerned about sniffing, /dev/random is probably overkill
and having it block when low on entropy would probably be a problem for you.



From mark.dingee@cox.net Wed Nov  2 21:01:24 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 90CE3D97AE
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 17:01:24 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 67860-01
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 21:01:19 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.201])
	by svr1.postgresql.org (Postfix) with ESMTP id 8C342D9644
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 17:01:20 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA2L1NFS000523;
	Wed, 2 Nov 2005 16:01:23 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA2L1Kef000522;
	Wed, 2 Nov 2005 16:01:20 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Date: Wed, 2 Nov 2005 16:01:19 -0500
User-Agent: KMail/1.8.2
Cc: Bruno Wolff III <bruno@wolff.to>
References: <200511011438.06610.mark.dingee@cox.net>
	<200511011700.50776.mark.dingee@cox.net>
	<20051102185930.GA10108@wolff.to>
In-Reply-To: <20051102185930.GA10108@wolff.to>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511021601.20138.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.022 required=5 tests=[AWL=0.022]
X-Spam-Score: 0.022
X-Spam-Level: 
X-Archive-Number: 200511/33
X-Sequence-Number: 23285

Thanks Bruno.  I'm using a hash so I can merge info available in the HTTPS 
header with data I store on the server so that the hash can be reconstructed 
during the validation process from the raw elements.  Tom Lane reminded me of 
using random seeds similar to what you are suggesting.  I think I will try to 
incorporate that into the process.  Perhaps a segment from the initial 
SSL_SESSION_ID may work without generating too much overhead.

You're right, sniffing isn't a real concern for me in this application.  My 
biggest concern is internal users playing around trying to find a backdoor 
into sensitive data.

Thanks
Mark

On Wednesday 02 November 2005 01:59 pm, Bruno Wolff III wrote:
> On Tue, Nov 01, 2005 at 17:00:50 -0500,
>
>   "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> > Bruno,
> >
> > I use an authenticate() function as a part of state maintenance in a PHP
> > web app.  In the function, I generate an encrypted token that is then
> > used in the validation process on subsequent pages.  md5 works, but I've
> > been able to brute-force crack it very quickly, so I'm looking for an
> > alternative.  Any thoughts would be greatly appreciated.
>
> This isn't a problem with MD5. While MD5 does have some theoretical
> weaknesses, they aren't really an issue in this case.
>
> Why are you using a hash at all? If you are using the hash as a key, why
> not just use a random string instead? The web browser could be handed a
> session id and random string and on the server you would have a table
> indexed by session ids that includes the random string.
>
> On many systems you can use /dev/urandom as a source of random data. Since
> you don't seem to be concerned about sniffing, /dev/random is probably
> overkill and having it block when low on entropy would probably be a
> problem for you.
>
> ---------------------------(end of broadcast)---------------------------
> TIP 6: explain analyze is your friend



From bruno@wolff.to Wed Nov  2 21:12:35 2005
X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 7F746D91E9
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 17:12:35 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 63696-10
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Wed,  2 Nov 2005 21:12:33 +0000 (GMT)
Received: from wolff.to (wolff.to [66.93.197.194])
	by svr1.postgresql.org (Postfix) with SMTP id 97A06D83C3
	for <pgsql-sql@postgresql.org>; Wed,  2 Nov 2005 17:12:33 -0400 (AST)
Received: (qmail 28332 invoked by uid 500); 2 Nov 2005 21:14:45 -0000
Date: Wed, 2 Nov 2005 15:14:45 -0600
From: Bruno Wolff III <bruno@wolff.to>
To: "Mark R. Dingee" <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Message-ID: <20051102211445.GA27686@wolff.to>
Mail-Followup-To: Bruno Wolff III <bruno@wolff.to>,
	"Mark R. Dingee" <mark.dingee@cox.net>, pgsql-sql@postgresql.org
References: <200511011438.06610.mark.dingee@cox.net>
	<200511011700.50776.mark.dingee@cox.net>
	<20051102185930.GA10108@wolff.to>
	<200511021601.20138.mark.dingee@cox.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200511021601.20138.mark.dingee@cox.net>
User-Agent: Mutt/1.4.2.1i
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006]
X-Spam-Score: 0.006
X-Spam-Level: 
X-Archive-Number: 200511/34
X-Sequence-Number: 23286

On Wed, Nov 02, 2005 at 16:01:19 -0500,
  "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> Thanks Bruno.  I'm using a hash so I can merge info available in the HTTPS 
> header with data I store on the server so that the hash can be reconstructed 
> during the validation process from the raw elements.  Tom Lane reminded me of 
> using random seeds similar to what you are suggesting.  I think I will try to 
> incorporate that into the process.  Perhaps a segment from the initial 
> SSL_SESSION_ID may work without generating too much overhead.

Why do you need any more than the session id and the random number? Once you
switch to including some random data, it seems like it would be simpler to
just use random data/

> 
> You're right, sniffing isn't a real concern for me in this application.  My 
> biggest concern is internal users playing around trying to find a backdoor 
> into sensitive data.

If they have privileged accounts on the web server you may need to worry about
this.