pg.ddx.io pgsql-sql@postgresql.org mailing list archive
help / color / mirror / Atom feedSHA-1 vs MD5
11+ messages / 4 participants
[nested] [flat]
* SHA-1 vs MD5
@ 2007-03-07 20:04 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
0 siblings, 2 replies; 11+ messages in thread
From: Ezequias Rodrigues da Rocha @ 2007-03-07 20:04 UTC (permalink / raw)
To: pgsql-sql
Hi list,
I know that there is a md5 internal function on postgresql, but I noticed
that it isn't the more secure today. I would like to know if there is a
SHA-1 function implemented yet of, if not, if the team has plan to introduce
it on PostgreSQL.
Regards ...
--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox:http://br.mozdev.org/firefox/
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-07 20:17 Andrew Sullivan <ajs@crankycanuck.ca>
parent: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
1 sibling, 1 reply; 11+ messages in thread
From: Andrew Sullivan @ 2007-03-07 20:17 UTC (permalink / raw)
To: pgsql-sql
On Wed, Mar 07, 2007 at 05:04:18PM -0300, Ezequias Rodrigues da Rocha wrote:
> Hi list,
>
> I know that there is a md5 internal function on postgresql, but I noticed
> that it isn't the more secure today. I would like to know if there is a
> SHA-1 function implemented yet of, if not, if the team has plan to introduce
> it on PostgreSQL.
What is the problem you're trying to solve? Md5 is probably good
enough for many cases, but for long-term use, you're right that sha-1
is what you need. Actually, you need sha-256, quite frankly.
a
--
Andrew Sullivan | ajs@crankycanuck.ca
I remember when computers were frustrating because they *did* exactly what
you told them to. That actually seems sort of quaint now.
--J.D. Baldwin
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-07 20:31 Andrej Ricnik-Bay <andrej.groups@gmail.com>
parent: Andrew Sullivan <ajs@crankycanuck.ca>
0 siblings, 0 replies; 11+ messages in thread
From: Andrej Ricnik-Bay @ 2007-03-07 20:31 UTC (permalink / raw)
To: Andrew Sullivan <ajs@crankycanuck.ca>; +Cc: pgsql-sql
On 3/8/07, Andrew Sullivan <ajs@crankycanuck.ca> wrote:
> What is the problem you're trying to solve? Md5 is probably good
> enough for many cases, but for long-term use, you're right that sha-1
> is what you need. Actually, you need sha-256, quite frankly.
Looking at his last mail he's after a password hash.
To the OP:
Currently there's no support in pg for sha algorithms, but you
could always implement those in your application and store
the hash in pg that way.
Cheers,
Andrej
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-07 21:44 Chad Wagner <chad.wagner@gmail.com>
parent: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
1 sibling, 1 reply; 11+ messages in thread
From: Chad Wagner @ 2007-03-07 21:44 UTC (permalink / raw)
To: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>; +Cc: pgsql-sql
On 3/7/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
>
> I know that there is a md5 internal function on postgresql, but I noticed
> that it isn't the more secure today. I would like to know if there is a
> SHA-1 function implemented yet of, if not, if the team has plan to introduce
> it on PostgreSQL.
You are probably looking for the pgcrypto contribution, look in the contrib
directory for it.
test=# select encode(digest('blahblah', 'sha256'), 'hex');
encode
------------------------------------------------------------------
40b1bbb5445fc021a312315379f4633284851e14d1db83fb0730f58872d6033b
(1 row)
--
Chad
http://www.postgresqlforums.com/
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-08 11:39 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
parent: Chad Wagner <chad.wagner@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Ezequias Rodrigues da Rocha @ 2007-03-08 11:39 UTC (permalink / raw)
To: Chad Wagner <chad.wagner@gmail.com>; +Cc: pgsql-sql
I really don't have the pgcrypto. It could be a nice alternative. Could you
tell me the steps to install it ?
I am very concerned about security in my application becouse we are going to
moviment a large ammount of information and money. As much i take care of it
as good.
I know some problem of MD5 and know it is very good too. If someone could
tell me where MD5 is used I could be more relaxed.
My best regards to all
--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox:http://br.mozdev.org/firefox/
2007/3/7, Chad Wagner <chad.wagner@gmail.com>:
>
> On 3/7/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
> >
> > I know that there is a md5 internal function on postgresql, but I
> > noticed that it isn't the more secure today. I would like to know if there
> > is a SHA-1 function implemented yet of, if not, if the team has plan to
> > introduce it on PostgreSQL.
>
>
> You are probably looking for the pgcrypto contribution, look in the
> contrib directory for it.
>
> test=# select encode(digest('blahblah', 'sha256'), 'hex');
> encode
> ------------------------------------------------------------------
> 40b1bbb5445fc021a312315379f4633284851e14d1db83fb0730f58872d6033b
> (1 row)
>
>
>
>
> --
> Chad
> http://www.postgresqlforums.com/
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-08 14:52 Chad Wagner <chad.wagner@gmail.com>
parent: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Chad Wagner @ 2007-03-08 14:52 UTC (permalink / raw)
To: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>; +Cc: pgsql-sql
On 3/8/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
>
> I really don't have the pgcrypto. It could be a nice alternative. Could
> you tell me the steps to install it ?
This should help you out:
http://www.postgresql.org/docs/8.2/static/external-extensions.html
http://developer.postgresql.org/cvsweb.cgi/pgsql/contrib/README?rev=1.91;content-type=text%2Fplain
I am very concerned about security in my application becouse we are going to
> moviment a large ammount of information and money. As much i take care of it
> as good.
SHA1 and MD5 are hashing algorithms, they are typically used for passwords
and in conjunction with public key encryption or over-the-wire encryption to
sign the message. If you are really concerned about security, you may want
to hire an experienced person in the security engineering field. Especially
if you are talking about financial information.
I know some problem of MD5 and know it is very good too. If someone could
> tell me where MD5 is used I could be more relaxed.
The impression I get is that SHA-256, SHA-384, or SHA-512 are the preferred
hashing algorithms, but I really don't keep up on it. Many many password
systems use MD5, I think it is reasonably safe.
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-09 12:34 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
parent: Chad Wagner <chad.wagner@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Ezequias Rodrigues da Rocha @ 2007-03-09 12:34 UTC (permalink / raw)
To: Chad Wagner <chad.wagner@gmail.com>; +Cc: pgsql-sql
Thank you so much for your information. I installed the pgCrypto. Now I have
more than 40 functions (i believe all are from pgcrypto) but when I try to
run your query:
select encode(digest('blahblah', 'sha256'), 'hex');
I got the error:
ERROR: Cannot use "sha256": No such hash algorithm
SQL state: 22023
Any suggestion
Ezequias
2007/3/8, Chad Wagner <chad.wagner@gmail.com>:
>
> On 3/8/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
> >
> > I really don't have the pgcrypto. It could be a nice alternative. Could
> > you tell me the steps to install it ?
>
>
> This should help you out:
>
> http://www.postgresql.org/docs/8.2/static/external-extensions.html
> http://developer.postgresql.org/cvsweb.cgi/pgsql/contrib/README?rev=1.91;content-type=text%2Fplain
>
>
>
>
> I am very concerned about security in my application becouse we are going
> > to moviment a large ammount of information and money. As much i take care of
> > it as good.
>
>
> SHA1 and MD5 are hashing algorithms, they are typically used for passwords
> and in conjunction with public key encryption or over-the-wire encryption to
> sign the message. If you are really concerned about security, you may want
> to hire an experienced person in the security engineering field. Especially
> if you are talking about financial information.
>
>
> I know some problem of MD5 and know it is very good too. If someone could
> > tell me where MD5 is used I could be more relaxed.
>
>
>
> The impression I get is that SHA-256, SHA-384, or SHA-512 are the
> preferred hashing algorithms, but I really don't keep up on it. Many many
> password systems use MD5, I think it is reasonably safe.
>
--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox:http://br.mozdev.org/firefox/
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-09 13:14 Chad Wagner <chad.wagner@gmail.com>
parent: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Chad Wagner @ 2007-03-09 13:14 UTC (permalink / raw)
To: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>; +Cc: pgsql-sql
On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
>
> Thank you so much for your information. I installed the pgCrypto. Now I
> have more than 40 functions (i believe all are from pgcrypto) but when I try
> to run your query:
>
> select encode(digest('blahblah', 'sha256'), 'hex');
>
> I got the error:
>
> ERROR: Cannot use "sha256": No such hash algorithm
> SQL state: 22023
>
It may not be available in your version of the database/pgcrypto module, my
test was performed on 8.2.3.
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-09 17:26 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
parent: Chad Wagner <chad.wagner@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Ezequias Rodrigues da Rocha @ 2007-03-09 17:26 UTC (permalink / raw)
To: Chad Wagner <chad.wagner@gmail.com>; +Cc: pgsql-sql
You are correct. My pg (8.1.3)
Now what I do to remove it ?
Just delete the functions ?
Ezequias
2007/3/9, Chad Wagner <chad.wagner@gmail.com>:
>
> On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
> >
> > Thank you so much for your information. I installed the pgCrypto. Now I
> > have more than 40 functions (i believe all are from pgcrypto) but when I try
> > to run your query:
> >
> > select encode(digest('blahblah', 'sha256'), 'hex');
> >
> > I got the error:
> >
> > ERROR: Cannot use "sha256": No such hash algorithm
> > SQL state: 22023
> >
>
>
> It may not be available in your version of the database/pgcrypto module,
> my test was performed on 8.2.3.
>
--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox:http://br.mozdev.org/firefox/
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-09 17:35 Chad Wagner <chad.wagner@gmail.com>
parent: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
0 siblings, 1 reply; 11+ messages in thread
From: Chad Wagner @ 2007-03-09 17:35 UTC (permalink / raw)
To: Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>; +Cc: pgsql-sql
On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
>
> You are correct. My pg (8.1.3)
>
> Now what I do to remove it ?
>
> Just delete the functions ?
>
There is usually an uninstall_pgcrypto.sql script you can run against the
database. But 8.1 probably supports at least sha1, or you can consider
upgrading to 8.2.
^ permalink raw reply [nested|flat] 11+ messages in thread
* Re: SHA-1 vs MD5
@ 2007-03-09 17:48 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
parent: Chad Wagner <chad.wagner@gmail.com>
0 siblings, 0 replies; 11+ messages in thread
From: Ezequias Rodrigues da Rocha @ 2007-03-09 17:48 UTC (permalink / raw)
To: Chad Wagner <chad.wagner@gmail.com>; +Cc: pgsql-sql
You are correct SH1 is supported. So I get the output size from 128 to 160
ok ?
I saw at wikipedia.
What does "With flaws" colisions means ? Does it means some ? in MD5 the put
only "yes"
Regards
Ezequias
2007/3/9, Chad Wagner <chad.wagner@gmail.com>:
>
> On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
> >
> > You are correct. My pg (8.1.3)
> >
> > Now what I do to remove it ?
> >
> > Just delete the functions ?
> >
>
> There is usually an uninstall_pgcrypto.sql script you can run against the
> database. But 8.1 probably supports at least sha1, or you can consider
> upgrading to 8.2.
>
--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox:http://br.mozdev.org/firefox/
^ permalink raw reply [nested|flat] 11+ messages in thread
end of thread, other threads:[~2007-03-09 17:48 UTC | newest]
Thread overview: 11+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2007-03-07 20:04 SHA-1 vs MD5 Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
2007-03-07 20:17 ` Andrew Sullivan <ajs@crankycanuck.ca>
2007-03-07 20:31 ` Andrej Ricnik-Bay <andrej.groups@gmail.com>
2007-03-07 21:44 ` Chad Wagner <chad.wagner@gmail.com>
2007-03-08 11:39 ` Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
2007-03-08 14:52 ` Chad Wagner <chad.wagner@gmail.com>
2007-03-09 12:34 ` Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
2007-03-09 13:14 ` Chad Wagner <chad.wagner@gmail.com>
2007-03-09 17:26 ` Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
2007-03-09 17:35 ` Chad Wagner <chad.wagner@gmail.com>
2007-03-09 17:48 ` Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox