Received: from localhost (maia-1.hub.org [200.46.204.191])
	by postgresql.org (Postfix) with ESMTP id 916559FB925;
	Tue,  5 Jun 2007 13:16:18 -0300 (ADT)
Received: from postgresql.org ([200.46.204.71])
	by localhost (mx1.hub.org [200.46.204.191]) (amavisd-maia, port 10024)
	with ESMTP id 76472-09; Tue,  5 Jun 2007 13:16:11 -0300 (ADT)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.5
X-Greylist: from auto-whitelisted by SQLgrey-1.7.5
Received: from service-web.de (p15093784.pureserver.info [217.160.106.224])
	by postgresql.org (Postfix) with ESMTP id B0DCA9FBC3B;
	Tue,  5 Jun 2007 13:16:11 -0300 (ADT)
Received: from [145.228.94.105] (unknown [145.228.94.105])
	by service-web.de (Postfix) with ESMTP id 0B1FD200160;
	Tue,  5 Jun 2007 18:16:11 +0200 (CEST)
Message-ID: <46658C49.3010004@wildenhain.de>
Date: Tue, 05 Jun 2007 18:16:09 +0200
From: Tino Wildenhain <tino@wildenhain.de>
User-Agent: Thunderbird 1.5.0.12 (Windows/20070509)
MIME-Version: 1.0
To: Marko Kreen <markokr@gmail.com>
Cc: Ranieri Mazili <ranieri.oliveira@terra.com.br>,
	pgsql-general@postgresql.org, pgsql-sql@postgresql.org
Subject: Re: Encrypted column
References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de>
	<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
In-Reply-To: <e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Archive-Number: 200706/415
X-Sequence-Number: 115238

Marko Kreen schrieb:
> On 6/5/07, Tino Wildenhain <tino@wildenhain.de> wrote:
>> Ranieri Mazili schrieb:
>> > Hello,
>> >
>> > I need to store users and passwords on a table and I want to store it
>> > encrypted, but I don't found documentation about it, how can I create a
>> > table with columns "user" and "password" with column "password"
>> > encrypted and how can I check if "user" and "password" are correct 
>> using
>> > a sql query ?
>>
>> Passwords are usually not encrypted but hashed instead. A common hash
>> function is available in postgres w/o any additional extension:
>>
>> md5()
>>
>> The rule is, if two hashes compare equal, then the original data must
>> be equal (yes, there are chances for collisions, but practically very
>> low. See also sha1 and friends in the pgcrypto contrib module)
> 
> Both md5 and sha1 are bad for passwords, no salt and easy to
> bruteforce - due to the tiny amount of data in passwords.
> 
Err. I did not mention salt but nobody prevents you from using
a salt with md5 and sha.

Regards
Tino