Received: from localhost (maia-5.hub.org [200.46.204.182]) by postgresql.org (Postfix) with ESMTP id 497909FB430 for ; Tue, 5 Jun 2007 11:39:42 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.182]) (amavisd-maia, port 10024) with ESMTP id 18202-04 for ; Tue, 5 Jun 2007 11:39:32 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.4 Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.231]) by postgresql.org (Postfix) with ESMTP id A0BD89FB7E0 for ; Tue, 5 Jun 2007 11:39:38 -0300 (ADT) Received: by nz-out-0506.google.com with SMTP id m22so1180899nzf for ; Tue, 05 Jun 2007 07:39:37 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=kTblkeRu8eNyyovXU6yQQJBzwZoVncDxeNIPVeJ7S/N/Og0UjdWbKej9cBtsjryUqZoZgOtSsuF3SZh8Gj8rU0/OBJrhhXCIfjMsxidaNTK1ThWCGDHdGiUwXfjQqcMqpi8LnjjYOaG/tTh81CiYrJasU0yaQadrJ700b5EGt9E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=k4Olk920Uzl58ZUTtKougJVX41w6As3/aTl4pYzLr0fH2l0v1vHPGrMnSdMsCy9ei74KKPUTVstY0HBzOgTgs1yNTjARXjrBWRAzian6s2AIgAlrPgoQlhecegW9b3L9eAQpWNi4Il6vHwAjs03khH4jus6UnDw1l0X+7p4trHk= Received: by 10.115.61.1 with SMTP id o1mr6021777wak.1181054377017; Tue, 05 Jun 2007 07:39:37 -0700 (PDT) Received: by 10.114.255.5 with HTTP; Tue, 5 Jun 2007 07:39:36 -0700 (PDT) Message-ID: Date: Tue, 5 Jun 2007 17:39:36 +0300 From: "Marko Kreen" To: "Brian Mathis" Subject: Re: Encrypted column Cc: "Tino Wildenhain" , "Ranieri Mazili" , pgsql-general@postgresql.org, pgsql-sql@postgresql.org In-Reply-To: <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de> <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/401 X-Sequence-Number: 115224 On 6/5/07, Brian Mathis wrote: > On 6/5/07, Marko Kreen wrote: > > Both md5 and sha1 are bad for passwords, no salt and easy to > > bruteforce - due to the tiny amount of data in passwords. > > > > Proper ways is to use crypt() function from pgcrypto module. > > Due to historical accident is has bad name which hints at > > encryption, actually its only purpose is to hash passwords. > > Read more in pgcrypto doc. > > If you salt them yourself, there's no problem with md5 or sha1, and > they are arguably more secure than the old "crypt" call. Most modern > linuxes use md5 for password storage. No, both md5 and sha1 are actually easier to bruteforce than the old DES-based crypt. Ofcourse that does not mean that old DES-crypt is good idea. Pgcrypto's crypt() supports bit more modern md5crypt and bf-crypt algoriths which give much higher security margin. It can be argued that bf-crypt is the "state-of-the-art" algorithm for password hashing. -- marko