[38502] in bugtraq
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted
daemon@ATHENA.MIT.EDU (Rod Taylor)
Thu Apr 21 15:49:40 2005
From: Rod Taylor <pg@rbt.ca>
To: Tino Wildenhain <tino@wildenhain.de>
Cc: bugtraq@securityfocus.com, pgsql-hackers@postgresql.org,
Stephen Frost <sfrost@snowman.net>, Tom Lane <tgl@sss.pgh.pa.us>,
"Jim C. Nasby" <decibel@decibel.org>
In-Reply-To: <1114074398.10488.3.camel@sabrina.peacock.de>
Content-Type: text/plain
Date: Thu, 21 Apr 2005 09:32:08 -0400
Message-Id: <1114090328.66326.90.camel@home>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
On Thu, 2005-04-21 at 11:06 +0200, Tino Wildenhain wrote:
> Am Mittwoch, den 20.04.2005, 16:23 -0500 schrieb Jim C. Nasby:
> > On Wed, Apr 20, 2005 at 05:03:18PM -0400, Tom Lane wrote:
> ...
> > Simply put, MD5 is no longer strong enough for protecting secrets. It's
> > just too easy to brute-force. SHA1 is ok for now, but it's days are
> > numbered as well. I think it would be good to alter SHA1 (or something
> > stronger) as an alternative to MD5, and I see no reason not to use a
> > random salt instead of username.
>
> I wonder where you want to store that random salt and how this would add
> to the security.
One advantage of a random salt would be that the username can be changed
without having to reset the password at the same time.
--
