Message-ID: <46662B4F.3070403@joeconway.com>
Date: Tue, 05 Jun 2007 20:34:39 -0700
From: Joe Conway <mail@joeconway.com>
User-Agent: Thunderbird 1.5.0.12 (X11/20070530)
MIME-Version: 1.0
To: Marko Kreen <markokr@gmail.com>
CC: Brian Mathis <brian.mathis@gmail.com>,
	Tino Wildenhain <tino@wildenhain.de>,
	Ranieri Mazili <ranieri.oliveira@terra.com.br>,
	pgsql-general@postgresql.org,  pgsql-sql@postgresql.org
Subject: Re: Encrypted column
References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de>	
	<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>	
	<183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com>	
	<e51f66da0706050739v4d504853va2d3f60719690da@mail.gmail.com>	
	<e51f66da0706050809r3da6c61eqf8e6f73ae8a1cc82@mail.gmail.com>	
	<183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com>
	<e51f66da0706050935u38a08566v57f1005b724315dd@mail.gmail.com>
In-Reply-To: <e51f66da0706050935u38a08566v57f1005b724315dd@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Marko Kreen wrote:
> On 6/5/07, Brian Mathis <brian.mathis@gmail.com> wrote:
>> pgcrypto also supports md5, so I'm not sure what you're referring to
>> here.
> 
> digest(psw, 'md5') vs. crypt(psw, gen_salt('md5'))
> 
>> As I already mentioned, *salting* before you hash is a very
>> important step.  I'm not sure if you saw that in my post.  Without a
>> salt, it's trivial to generate a list of all combinations of md5'd
>> strings and their results, up to reasonable lengths.  Then it would be
>> very simple to look up each hash and get the original text.  With a
>> salt, you need to generate all possible md5s for all possible salts --
>> a much harder task.
> 
> I dont think its practical method tho'.  Rather, when doing
> dictionary-based or bruteforce attack, then if hashes do not
> have salts you attack them all at once.
> 
> But if they have salts then for each word you try you need to
> hash it for each salt.  Which basically gives the effect that
> each hash needs to be attacked separately.
> 
> In case of attacking one hash the salt does not matter,
> only the algorithm counts then.  In that case as i said,
> event salted md5 is weaker than des-crypt.

The best method as far as I understand it is HMAC 
(http://www.faqs.org/rfcs/rfc2104.html).

It has some significant cryptanalysis behind it to ensure it does not 
leak information that would compromise the password. Even MD5 and SHA1, 
which have been shown to have certain weaknesses, are not at issue when 
used with HMAC (see, for example, section 3.1.1 of 
http://www.apps.ietf.org/rfc/rfc4835.html)

The way you would use HMAC is:
1. generate a random token, whatever length you want (the salt)
2. use HMAC (implemented with either md5 or sha1 or something newer) to
    hash the salt with the password
3. store the salt and the resulting HMAC hash
4. on login, calculate the HMAC of the token using the provide password,
    and compare to the stored hash

pgcrypto appears to support HMAC. It is also relatively easy to 
implement on top of the built in md5 function if you'd rather not 
install pgcrypto. And I'm sure there are HMAC functions available that 
could be used in PL/Perl and/or PL/Python.

Joe