X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id 96ECED6899 for ; Wed, 2 Nov 2005 10:39:55 -0400 (AST) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 70784-05 for ; Wed, 2 Nov 2005 14:39:52 +0000 (GMT) Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by svr1.postgresql.org (Postfix) with ESMTP id 29C49D6896 for ; Wed, 2 Nov 2005 10:39:54 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id jA2Edq3s005333; Wed, 2 Nov 2005 09:39:52 -0500 (EST) To: "Mark R. Dingee" Cc: pgsql-sql@postgresql.org, mario.splivalo@mobart.hr Subject: Re: PGSQL encryption functions In-reply-to: <200511020829.48299.mark.dingee@cox.net> References: <200511011438.06610.mark.dingee@cox.net> <28738.1130883210@sss.pgh.pa.us> <1130923587.7739.11.camel@ekim> <200511020829.48299.mark.dingee@cox.net> Comments: In-reply-to "Mark R. Dingee" message dated "Wed, 02 Nov 2005 08:29:47 -0500" Date: Wed, 02 Nov 2005 09:39:52 -0500 Message-ID: <5332.1130942392@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.006 required=5 tests=[AWL=0.006] X-Spam-Score: 0.006 X-Spam-Level: X-Archive-Number: 200511/27 X-Sequence-Number: 23279 "Mark R. Dingee" writes: > The script I'm using to "break" md5 presumes that the cracker knows the 3 > elements being concatenated together to form the plain-text sting which is > then passed into md5. The method I'm using then begins running through > various permutations. Do you believe that the methodology is appropriate or > that I'm being a bit paranoid? Well, this is a fundamentally insecure way of using *any* crypto hash method. You're blaming MD5 for the fact that you're misusing it. There has to be some component of the hash input that the attacker doesn't know and can't trivially guess. Adding a randomly chosen "salt" string is one common way to do that. regards, tom lane