Received: from localhost (maia-3.hub.org [200.46.204.184]) by postgresql.org (Postfix) with ESMTP id 12F529FB2CF for ; Fri, 9 Mar 2007 08:35:06 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.184]) (amavisd-new, port 10024) with ESMTP id 48975-01-5 for ; Fri, 9 Mar 2007 08:34:56 -0400 (AST) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4 Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.168]) by postgresql.org (Postfix) with ESMTP id EC9D19FB2CD for ; Fri, 9 Mar 2007 08:35:00 -0400 (AST) Received: by ug-out-1314.google.com with SMTP id k3so1243225ugf for ; Fri, 09 Mar 2007 04:34:59 -0800 (PST) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=J2cKrj1L2wL4eJ5fJS4ny351ZP84oii2pFpSfFiF0tidNHTgmn8SynzfmWEXUBAfXBbbvG0xS76EPHjiI8GDg9gfCg2sBVRwM+StWritW5kimTAAuUZpegAncWmFzkvyOyjgpGVNy7HuPe1AWw4f5EWjkXmHgPFf79+IWjvKT+I= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=nQGDfcfxEMN2mQPfLrATWt4zt700IIIH0QVvfRDR9o0mDK5mZVz3dAyDraFLr4nGVKIjiMhwVhQ7Kr43JNM4ac7PQJ61LOR+yKwwlvf7jGsi/ZP9LyJTZJGRCGYBpqdwUCi8A5lQPaMwOhjx97GjaipHnKFwrf274df6GYM03Uc= Received: by 10.67.21.11 with SMTP id y11mr9482059ugi.1173443699245; Fri, 09 Mar 2007 04:34:59 -0800 (PST) Received: by 10.67.94.13 with HTTP; Fri, 9 Mar 2007 04:34:59 -0800 (PST) Message-ID: <55c095e90703090434ob874f2q4ff3cfd0d91c88f3@mail.gmail.com> Date: Fri, 9 Mar 2007 09:34:59 -0300 From: "Ezequias Rodrigues da Rocha" To: "Chad Wagner" Subject: Re: SHA-1 vs MD5 Cc: PostgreSQL In-Reply-To: <81961ff50703080652o41274e2djc5b789fb4da9bd27@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_756_5025626.1173443699183" References: <55c095e90703071204t5aebb921s9d5f1067d3c2f035@mail.gmail.com> <81961ff50703071344i28d9ea6cr4902fed404b38602@mail.gmail.com> <55c095e90703080339y67152f49ud82741fd21ac6370@mail.gmail.com> <81961ff50703080652o41274e2djc5b789fb4da9bd27@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200703/99 X-Sequence-Number: 27737 ------=_Part_756_5025626.1173443699183 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Thank you so much for your information. I installed the pgCrypto. Now I have more than 40 functions (i believe all are from pgcrypto) but when I try to run your query: select encode(digest('blahblah', 'sha256'), 'hex'); I got the error: ERROR: Cannot use "sha256": No such hash algorithm SQL state: 22023 Any suggestion Ezequias 2007/3/8, Chad Wagner : > > On 3/8/07, Ezequias Rodrigues da Rocha wrote: > > > > I really don't have the pgcrypto. It could be a nice alternative. Could > > you tell me the steps to install it ? > > > This should help you out: > > http://www.postgresql.org/docs/8.2/static/external-extensions.html > http://developer.postgresql.org/cvsweb.cgi/pgsql/contrib/README?rev=1.91;content-type=text%2Fplain > > > > > I am very concerned about security in my application becouse we are going > > to moviment a large ammount of information and money. As much i take care of > > it as good. > > > SHA1 and MD5 are hashing algorithms, they are typically used for passwords > and in conjunction with public key encryption or over-the-wire encryption to > sign the message. If you are really concerned about security, you may want > to hire an experienced person in the security engineering field. Especially > if you are talking about financial information. > > > I know some problem of MD5 and know it is very good too. If someone could > > tell me where MD5 is used I could be more relaxed. > > > > The impression I get is that SHA-256, SHA-384, or SHA-512 are the > preferred hashing algorithms, but I really don't keep up on it. Many many > password systems use MD5, I think it is reasonably safe. > -- Ezequias Rodrigues da Rocha http://ezequiasrocha.blogspot.com/ use Mozilla Firefox:http://br.mozdev.org/firefox/ ------=_Part_756_5025626.1173443699183 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Thank you so much for your information. I installed the pgCrypto. Now I have more than 40 functions (i believe all are from pgcrypto) but when I try to run your query:

select encode(digest('blahblah', 'sha256'), 'hex');

I got the error:

ERROR: Cannot use "sha256": No such hash algorithm
SQL state: 22023


Any suggestion

Ezequias


2007/3/8, Chad Wagner < chad.wagner@gmail.com>:
On 3/8/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:
I really don't have the pgcrypto. It could be a nice alternative. Could you tell me the steps to install it ?

I am very concerned about security in my application becouse we are going to moviment a large ammount of information and money. As much i take care of it as good.

SHA1 and MD5 are hashing algorithms, they are typically used for passwords and in conjunction with public key encryption or over-the-wire encryption to sign the message.  If you are really concerned about security, you may want to hire an experienced person in the security engineering field.  Especially if you are talking about financial information.
 

I know some problem of MD5 and know it is very good too. If someone could tell me where MD5 is used I could be more relaxed.


The impression I get is that SHA-256, SHA-384, or SHA-512 are the preferred hashing algorithms, but I really don't keep up on it.  Many many password systems use MD5, I think it is reasonably safe.



--
Ezequias Rodrigues da Rocha
http://ezequiasrocha.blogspot.com/
use Mozilla Firefox: http://br.mozdev.org/firefox/ ------=_Part_756_5025626.1173443699183--