From: Bruno Wolff III <bruno@wolff.to>
To: Mark R. Dingee <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: PGSQL encryption functions
Date: Wed, 2 Nov 2005 15:14:45 -0600
Message-ID: <20051102211445.GA27686@wolff.to> (raw)
In-Reply-To: <200511021601.20138.mark.dingee@cox.net>
References: <200511011438.06610.mark.dingee@cox.net>
<200511011700.50776.mark.dingee@cox.net>
<20051102185930.GA10108@wolff.to>
<200511021601.20138.mark.dingee@cox.net>
On Wed, Nov 02, 2005 at 16:01:19 -0500,
"Mark R. Dingee" <mark.dingee@cox.net> wrote:
> Thanks Bruno. I'm using a hash so I can merge info available in the HTTPS
> header with data I store on the server so that the hash can be reconstructed
> during the validation process from the raw elements. Tom Lane reminded me of
> using random seeds similar to what you are suggesting. I think I will try to
> incorporate that into the process. Perhaps a segment from the initial
> SSL_SESSION_ID may work without generating too much overhead.
Why do you need any more than the session id and the random number? Once you
switch to including some random data, it seems like it would be simpler to
just use random data/
>
> You're right, sniffing isn't a real concern for me in this application. My
> biggest concern is internal users playing around trying to find a backdoor
> into sensitive data.
If they have privileged accounts on the web server you may need to worry about
this.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: bruno@wolff.to, mark.dingee@cox.net
Subject: Re: PGSQL encryption functions
In-Reply-To: <20051102211445.GA27686@wolff.to>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox