X-Original-To: pgsql-php-postgresql.org@localhost.postgresql.org
Received: from localhost (unknown [200.46.204.144])
	by svr1.postgresql.org (Postfix) with ESMTP id 083DED1B181
	for <pgsql-php-postgresql.org@localhost.postgresql.org>;
	Wed, 28 Jul 2004 17:16:36 -0300 (ADT)
Received: from svr1.postgresql.org ([200.46.204.71])
	by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024)
	with ESMTP id 33002-08
	for <pgsql-php-postgresql.org@localhost.postgresql.org>;
	Wed, 28 Jul 2004 20:16:14 +0000 (GMT)
Received: from stark.xeocode.com (gsstark.mtl.istop.com [66.11.160.162])
	by svr1.postgresql.org (Postfix) with ESMTP id 584FCD1B171
	for <pgsql-php@postgresql.org>; Wed, 28 Jul 2004 17:16:12 -0300 (ADT)
Received: from localhost ([127.0.0.1] helo=stark.xeocode.com)
	by stark.xeocode.com with smtp (Exim 3.36 #1 (Debian))
	id 1BpuqQ-0005Yo-00; Wed, 28 Jul 2004 16:16:10 -0400
To: Bruno Wolff III <bruno@wolff.to>
Cc: Daniel Struck <struck.d@retrovirology.lu>,
	Mitch Pirtle <mitchy@spacemonkeylabs.com>, pgsql-php@postgresql.org
Subject: Re: [ADMIN] Secure DB Systems - How to
References: <ccjra4$pgl$1@sea.gmane.org> <20040709152722.GA20935@wolff.to>
	<20040713113557.31e9d6dc@localhost> <20040713123817.GB3710@wolff.to>
	<20040713151838.0004cb8e@localhost>
	<40F3EC4A.1060101@spacemonkeylabs.com>
	<20040727134133.676ab9cf@localhost> <20040727194905.GA20499@wolff.to>
In-Reply-To: <20040727194905.GA20499@wolff.to>
From: Greg Stark <gsstark@mit.edu>
Organization: The Emacs Conspiracy; member since 1992
Date: 28 Jul 2004 16:16:10 -0400
Message-ID: <87brhzsx9x.fsf@stark.xeocode.com>
Lines: 14
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Virus-Scanned: by amavisd-new at hub.org
X-Spam-Status: No, hits=0.0 tagged_above=0.0 required=5.0 tests=
X-Spam-Level: 
X-Archive-Number: 200407/35
X-Sequence-Number: 2860


Bruno Wolff III <bruno@wolff.to> writes:

> That depends on the kind of queries. Searching for exact matches should work
> fine. Some other things can be done in special cases.

If searching for exact matches works then you're using a naive encryption
system. The problem is that it also means your database is vulnerable to
dictionary attacks. Good encryption systems will include random padding to
ensure that you can't attack it by merely guessing many possible plaintexts
and verifying to see if any match.

-- 
greg