From: Tino Wildenhain <tino@wildenhain.de>
To: Marko Kreen <markokr@gmail.com>
Cc: Ranieri Mazili <ranieri.oliveira@terra.com.br>
Cc: pgsql-general@postgresql.org
Cc: pgsql-sql@postgresql.org
Subject: Re: Encrypted column
Date: Tue, 05 Jun 2007 18:16:09 +0200
Message-ID: <46658C49.3010004@wildenhain.de> (raw)
In-Reply-To: <e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
References: <46645B01.6070605@terra.com.br>
<4665161F.9090009@wildenhain.de>
<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
Marko Kreen schrieb:
> On 6/5/07, Tino Wildenhain <tino@wildenhain.de> wrote:
>> Ranieri Mazili schrieb:
>> > Hello,
>> >
>> > I need to store users and passwords on a table and I want to store it
>> > encrypted, but I don't found documentation about it, how can I create a
>> > table with columns "user" and "password" with column "password"
>> > encrypted and how can I check if "user" and "password" are correct
>> using
>> > a sql query ?
>>
>> Passwords are usually not encrypted but hashed instead. A common hash
>> function is available in postgres w/o any additional extension:
>>
>> md5()
>>
>> The rule is, if two hashes compare equal, then the original data must
>> be equal (yes, there are chances for collisions, but practically very
>> low. See also sha1 and friends in the pgcrypto contrib module)
>
> Both md5 and sha1 are bad for passwords, no salt and easy to
> bruteforce - due to the tiny amount of data in passwords.
>
Err. I did not mention salt but nobody prevents you from using
a salt with md5 and sha.
Regards
Tino
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tino@wildenhain.de, markokr@gmail.com, ranieri.oliveira@terra.com.br, pgsql-general@postgresql.org
Subject: Re: Encrypted column
In-Reply-To: <46658C49.3010004@wildenhain.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox