From: Guy Rouillier <guyr-ml1@burntmail.com>
To: pgsql-general@postgresql.org
Subject: Re: Encrypted column
Date: Mon, 04 Jun 2007 18:54:55 -0400
Message-ID: <4664983F.4010700@burntmail.com> (raw)
In-Reply-To: <46645B01.6070605@terra.com.br>
References: <46645B01.6070605@terra.com.br>
Ranieri Mazili wrote:
> Hello,
>
> I need to store users and passwords on a table and I want to store it
> encrypted, but I don't found documentation about it, how can I create a
> table with columns "user" and "password" with column "password"
> encrypted and how can I check if "user" and "password" are correct using
> a sql query ?
Many people consider two-way encryption to be insecure; two-way
encryption means you can decrypt a value if you know the key, and it is
insecure because you usually have to put the key into the source code.
That means at least one person in your company, the programmer
maintaining the source code, can learn all of your users' passwords.
One way around that is to hash the value instead. Then to validate, at
runtime you hash the user-entered password using the same hash function,
and validate that it matches the stored hash. No one in your company
ever knows end-user passwords.
--
Guy Rouillier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: guyr-ml1@burntmail.com, pgsql-general@postgresql.org
Subject: Re: Encrypted column
In-Reply-To: <4664983F.4010700@burntmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox