X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org
Received: from localhost (av.hub.org [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 1727FDB716
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 18:00:51 -0400 (AST)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 57269-03
	for <pgsql-sql-postgresql.org@localhost.postgresql.org>;
	Tue,  1 Nov 2005 22:00:47 +0000 (GMT)
Received: from localhost.localdomain (unknown [12.31.43.97])
	by svr1.postgresql.org (Postfix) with ESMTP id 34282DB6CB
	for <pgsql-sql@postgresql.org>; Tue,  1 Nov 2005 18:00:48 -0400 (AST)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by localhost.localdomain (8.13.4/8.13.4) with ESMTP id jA1M0pLG020658;
	Tue, 1 Nov 2005 17:00:51 -0500
Received: from localhost (localhost [[UNIX: localhost]])
	by localhost.localdomain (8.13.4/8.13.4/Submit) id jA1M0pOi020657;
	Tue, 1 Nov 2005 17:00:51 -0500
From: "Mark R. Dingee" <mark.dingee@cox.net>
To: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Date: Tue, 1 Nov 2005 17:00:50 -0500
User-Agent: KMail/1.8.2
Cc: Bruno Wolff III <bruno@wolff.to>
References: <200511011438.06610.mark.dingee@cox.net>
	<20051101212844.GA24861@wolff.to>
In-Reply-To: <20051101212844.GA24861@wolff.to>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200511011700.50776.mark.dingee@cox.net>
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, score=0.029 required=5 tests=[AWL=0.029]
X-Spam-Score: 0.029
X-Spam-Level: 
X-Archive-Number: 200511/13
X-Sequence-Number: 23265

Bruno,

I use an authenticate() function as a part of state maintenance in a PHP web 
app.  In the function, I generate an encrypted token that is then used in the 
validation process on subsequent pages.  md5 works, but I've been able to 
brute-force crack it very quickly, so I'm looking for an alternative.  Any 
thoughts would be greatly appreciated.

Thanks,
Mark

On Tuesday 01 November 2005 04:28 pm, Bruno Wolff III wrote:
> On Tue, Nov 01, 2005 at 14:38:05 -0500,
>
>   "Mark R. Dingee" <mark.dingee@cox.net> wrote:
> > Everyone,
> >
> > I'm in need of a one-way pgsql script that will take a plain-text string
> > and return an ecrypted string (preferably 32 character) .  I've been
> > using md5('string'), but I'm concerned it's too weak for my needs.  Does
> > anyone have any recommendations?
>
> What are your needs?
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
>                http://archives.postgresql.org