From: Tom Lane <tgl@sss.pgh.pa.us>
To: Mark R. Dingee <mark.dingee@cox.net>
Cc: pgsql-sql@postgresql.org
Cc: mario.splivalo@mobart.hr
Subject: Re: PGSQL encryption functions
Date: Wed, 02 Nov 2005 09:39:52 -0500
Message-ID: <5332.1130942392@sss.pgh.pa.us> (raw)
In-Reply-To: <200511020829.48299.mark.dingee@cox.net>
References: <200511011438.06610.mark.dingee@cox.net>
<28738.1130883210@sss.pgh.pa.us>
<1130923587.7739.11.camel@ekim>
<200511020829.48299.mark.dingee@cox.net>
"Mark R. Dingee" <mark.dingee@cox.net> writes:
> The script I'm using to "break" md5 presumes that the cracker knows the 3
> elements being concatenated together to form the plain-text sting which is
> then passed into md5. The method I'm using then begins running through
> various permutations. Do you believe that the methodology is appropriate or
> that I'm being a bit paranoid?
Well, this is a fundamentally insecure way of using *any* crypto hash method.
You're blaming MD5 for the fact that you're misusing it.
There has to be some component of the hash input that the attacker
doesn't know and can't trivially guess. Adding a randomly chosen "salt"
string is one common way to do that.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, mark.dingee@cox.net, mario.splivalo@mobart.hr
Subject: Re: PGSQL encryption functions
In-Reply-To: <5332.1130942392@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox