From: Marko Kreen <markokr@gmail.com>
To: Brian Mathis <brian.mathis@gmail.com>
Cc: Tino Wildenhain <tino@wildenhain.de>
Cc: Ranieri Mazili <ranieri.oliveira@terra.com.br>
Cc: pgsql-general@postgresql.org
Cc: pgsql-sql@postgresql.org
Subject: Re: Encrypted column
Date: Tue, 5 Jun 2007 17:39:36 +0300
Message-ID: <e51f66da0706050739v4d504853va2d3f60719690da@mail.gmail.com> (raw)
In-Reply-To: <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com>
References: <46645B01.6070605@terra.com.br>
<4665161F.9090009@wildenhain.de>
<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
<183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com>
On 6/5/07, Brian Mathis <brian.mathis@gmail.com> wrote:
> On 6/5/07, Marko Kreen <markokr@gmail.com> wrote:
> > Both md5 and sha1 are bad for passwords, no salt and easy to
> > bruteforce - due to the tiny amount of data in passwords.
> >
> > Proper ways is to use crypt() function from pgcrypto module.
> > Due to historical accident is has bad name which hints at
> > encryption, actually its only purpose is to hash passwords.
> > Read more in pgcrypto doc.
>
> If you salt them yourself, there's no problem with md5 or sha1, and
> they are arguably more secure than the old "crypt" call. Most modern
> linuxes use md5 for password storage.
No, both md5 and sha1 are actually easier to bruteforce than
the old DES-based crypt. Ofcourse that does not mean that
old DES-crypt is good idea. Pgcrypto's crypt() supports bit
more modern md5crypt and bf-crypt algoriths which give much
higher security margin. It can be argued that bf-crypt is the
"state-of-the-art" algorithm for password hashing.
--
marko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: markokr@gmail.com, brian.mathis@gmail.com, tino@wildenhain.de, ranieri.oliveira@terra.com.br, pgsql-general@postgresql.org
Subject: Re: Encrypted column
In-Reply-To: <e51f66da0706050739v4d504853va2d3f60719690da@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox