Received: from localhost (maia-1.hub.org [200.46.204.191]) by postgresql.org (Postfix) with ESMTP id A5A359FBE69 for ; Tue, 5 Jun 2007 13:35:38 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.191]) (amavisd-maia, port 10024) with ESMTP id 33283-01-5 for ; Tue, 5 Jun 2007 13:35:31 -0300 (ADT) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.5 Received: from wa-out-1112.google.com (wa-out-1112.google.com [209.85.146.178]) by postgresql.org (Postfix) with ESMTP id C03AD9FBB74 for ; Tue, 5 Jun 2007 13:35:30 -0300 (ADT) Received: by wa-out-1112.google.com with SMTP id k40so2490560wah for ; Tue, 05 Jun 2007 09:35:29 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=DLTVpGVRtQ61kQgxBo1gFEPsx8UBQ9YuMbjk42Nkpq7xajGOZwF2Nm2ygyL0gkjcOafO04+c4XsLDX3n4x9JUne8lUiWrnWiPueSwhUAax/TsUGeOFQfM1YbXhFo2gMctzO4ySEHr7Jntu0J4XBKVCecLvfKmo3qj8OleFaaeag= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ruKgvCVJfLD/LxS3Uht09OIcZNwy3WJdzd2vIP02YAKlNf15c0JDKw8SqdKRrMV+j6g5PyrJXApHLtjQ2OQxKJYzwzqX/0HcBjdMyzSWsRRHQq8GHG88zAIu2xexSQvsTnaaS3YP3MHvO+31yzOfxeFuF/eU3CVGDjil4hHU6to= Received: by 10.114.159.1 with SMTP id h1mr6085722wae.1181061329345; Tue, 05 Jun 2007 09:35:29 -0700 (PDT) Received: by 10.114.255.5 with HTTP; Tue, 5 Jun 2007 09:35:29 -0700 (PDT) Message-ID: Date: Tue, 5 Jun 2007 19:35:29 +0300 From: "Marko Kreen" To: "Brian Mathis" Subject: Re: Encrypted column Cc: "Tino Wildenhain" , "Ranieri Mazili" , pgsql-general@postgresql.org, pgsql-sql@postgresql.org In-Reply-To: <183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46645B01.6070605@terra.com.br> <4665161F.9090009@wildenhain.de> <183c528b0706050726v3214820fx6669d1e99bcfaaa@mail.gmail.com> <183c528b0706050822t64a067aeg74d4190ae2a51807@mail.gmail.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/418 X-Sequence-Number: 115241 On 6/5/07, Brian Mathis wrote: > pgcrypto also supports md5, so I'm not sure what you're referring to > here. digest(psw, 'md5') vs. crypt(psw, gen_salt('md5')) > As I already mentioned, *salting* before you hash is a very > important step. I'm not sure if you saw that in my post. Without a > salt, it's trivial to generate a list of all combinations of md5'd > strings and their results, up to reasonable lengths. Then it would be > very simple to look up each hash and get the original text. With a > salt, you need to generate all possible md5s for all possible salts -- > a much harder task. I dont think its practical method tho'. Rather, when doing dictionary-based or bruteforce attack, then if hashes do not have salts you attack them all at once. But if they have salts then for each word you try you need to hash it for each salt. Which basically gives the effect that each hash needs to be attacked separately. In case of attacking one hash the salt does not matter, only the algorithm counts then. In that case as i said, event salted md5 is weaker than des-crypt. -- marko