[38505] in bugtraq
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted
daemon@ATHENA.MIT.EDU (Tino Wildenhain)
Thu Apr 21 16:34:37 2005
From: Tino Wildenhain <tino@wildenhain.de>
To: Rod Taylor <pg@rbt.ca>
Cc: bugtraq@securityfocus.com, pgsql-hackers@postgresql.org,
Stephen Frost <sfrost@snowman.net>, Tom Lane <tgl@sss.pgh.pa.us>,
"Jim C. Nasby" <decibel@decibel.org>
In-Reply-To: <1114090328.66326.90.camel@home>
Content-Type: text/plain
Date: Thu, 21 Apr 2005 15:47:33 +0200
Message-Id: <1114091254.10488.6.camel@sabrina.peacock.de>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Am Donnerstag, den 21.04.2005, 09:32 -0400 schrieb Rod Taylor:
> On Thu, 2005-04-21 at 11:06 +0200, Tino Wildenhain wrote:
> > Am Mittwoch, den 20.04.2005, 16:23 -0500 schrieb Jim C. Nasby:
> > > On Wed, Apr 20, 2005 at 05:03:18PM -0400, Tom Lane wrote:
> > ...
> > > Simply put, MD5 is no longer strong enough for protecting secrets. It's
> > > just too easy to brute-force. SHA1 is ok for now, but it's days are
> > > numbered as well. I think it would be good to alter SHA1 (or something
> > > stronger) as an alternative to MD5, and I see no reason not to use a
> > > random salt instead of username.
> >
> > I wonder where you want to store that random salt and how this would add
> > to the security.
>
> One advantage of a random salt would be that the username can be changed
> without having to reset the password at the same time.
Still this does not answer the question where that salt is to be
stored :)
(instead of username one could use somefacyhash(userid) to be
independend from username - otoh, if you change usernames
you usually face some other serious problems like object
ownership and friends)
--
Tino Wildenhain <tino@wildenhain.de>
