From: Marko Kreen <markokr@gmail.com>
To: Brian Mathis <brian.mathis@gmail.com>
Cc: Tino Wildenhain <tino@wildenhain.de>
Cc: Ranieri Mazili <ranieri.oliveira@terra.com.br>
Cc: pgsql-general@postgresql.org
Cc: pgsql-sql@postgresql.org
Subject: Re: Encrypted column
Date: Tue, 5 Jun 2007 19:35:29 +0300
Message-ID: <e51f66da0706050935u38a08566v57f1005b724315dd@mail.gmail.com> (raw)
In-Reply-To: <183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com>
References: <46645B01.6070605@terra.com.br>
<4665161F.9090009@wildenhain.de>
<e51f66da0706050712u3c59a369n986ae56344912a24@mail.gmail.com>
<183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com>
<e51f66da0706050739v4d504853va2d3f60719690da@mail.gmail.com>
<e51f66da0706050809r3da6c61eqf8e6f73ae8a1cc82@mail.gmail.com>
<183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com>
On 6/5/07, Brian Mathis <brian.mathis@gmail.com> wrote:
> pgcrypto also supports md5, so I'm not sure what you're referring to
> here.
digest(psw, 'md5') vs. crypt(psw, gen_salt('md5'))
> As I already mentioned, *salting* before you hash is a very
> important step. I'm not sure if you saw that in my post. Without a
> salt, it's trivial to generate a list of all combinations of md5'd
> strings and their results, up to reasonable lengths. Then it would be
> very simple to look up each hash and get the original text. With a
> salt, you need to generate all possible md5s for all possible salts --
> a much harder task.
I dont think its practical method tho'. Rather, when doing
dictionary-based or bruteforce attack, then if hashes do not
have salts you attack them all at once.
But if they have salts then for each word you try you need to
hash it for each salt. Which basically gives the effect that
each hash needs to be attacked separately.
In case of attacking one hash the salt does not matter,
only the algorithm counts then. In that case as i said,
event salted md5 is weaker than des-crypt.
--
marko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: markokr@gmail.com, brian.mathis@gmail.com, tino@wildenhain.de, ranieri.oliveira@terra.com.br, pgsql-general@postgresql.org
Subject: Re: Encrypted column
In-Reply-To: <e51f66da0706050935u38a08566v57f1005b724315dd@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox