DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=JwGyhh1G4VYUQF2szOiOm4WocYQNYlvleZXKwofrMYLjP186fpMIxxzQPKKr6TV29b2MEsW1eaOjTupneffUTD5P+PH7qmNSXFRu6aZZNagL42rSzW2DvXey3v39+WGTnw2SwrIA0XMHQmSkzTN5ERIl2YQLQo+6PzlM/kQ5R34=
Message-ID: <ddcd549e0511020604g32d6556fo7864f03f2373578e@mail.gmail.com>
Date: Wed, 2 Nov 2005 14:04:05 +0000
From: Neil Saunders <n.j.saunders@gmail.com>
To: "Mark R. Dingee" <mark.dingee@cox.net>
Subject: Re: PGSQL encryption functions
Cc: pgsql-sql@postgresql.org, mario.splivalo@mobart.hr
In-Reply-To: <200511020829.48299.mark.dingee@cox.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <200511011438.06610.mark.dingee@cox.net>
	<28738.1130883210@sss.pgh.pa.us> <1130923587.7739.11.camel@ekim>
	<200511020829.48299.mark.dingee@cox.net>

OK, you're not really "breaking" md5. If the attacker already knows
the information being encrypted, then all you're testing is the
concatenation order- Surely the information is more important than the
order? md5 is a one way hash function, and so using an alternate
algorithm will provide no benefit whatsoever; you're just running
through 9 permutations.

Kind Regards,

Neil.

On 11/2/05, Mark R. Dingee <mark.dingee@cox.net> wrote:
> Mike & Tom,
>
> The script I'm using to "break" md5 presumes that the cracker knows the 3
> elements being concatenated together to form the plain-text sting which i=
s
> then passed into md5.  The method I'm using then begins running through
> various permutations.  Do you believe that the methodology is appropriate=
 or
> that I'm being a bit paranoid?
>
> Thanks
>
> On Tuesday 01 November 2005 05:13 pm, Tom Lane wrote:
> > "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > > md5 works, but I've been able to
> > > brute-force crack it very quickly,
> >
> > Really?  Where's your publication of this remarkable breakthrough?
> >
> >                       regards, tom lane
> >
> > ---------------------------(end of broadcast)--------------------------=
-
> > TIP 1: if posting/reading through Usenet, please send an appropriate
> >        subscribe-nomail command to majordomo@postgresql.org so that you=
r
> >        message can get through to the mailing list cleanly
>
> On Wednesday 02 November 2005 04:26 am, Mario Splivalo wrote:
> > On Tue, 2005-11-01 at 17:13 -0500, Tom Lane wrote:
> > > "Mark R. Dingee" <mark.dingee@cox.net> writes:
> > > > md5 works, but I've been able to
> > > > brute-force crack it very quickly,
> > >
> > > Really?  Where's your publication of this remarkable breakthrough?
> >
> > I'd say you can't bruteforce md5, unless you're extremley lucky.
> > However, md5 is easily broken, you just need to know how to construct
> > the hashes.
> >
> > One could switch to SHA for 'increaased' security.
> >
> > Although I don't think he'd be having problems using MD5 as he describe=
d
> > it. I'd also lilke to see he's example of brute-force 'cracking' the MD=
5
> > digest.
> >
> >       Mike
>
> ---------------------------(end of broadcast)---------------------------
> TIP 1: if posting/reading through Usenet, please send an appropriate
>       subscribe-nomail command to majordomo@postgresql.org so that your
>       message can get through to the mailing list cleanly
>