[38544] in bugtraq
Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted
daemon@ATHENA.MIT.EDU (Antoine Martin)
Fri Apr 22 16:59:56 2005
From: Antoine Martin <antoine@nagafix.co.uk>
To: Bruno Wolff III <bruno@wolff.to>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, "Jim C. Nasby" <decibel@decibel.org>,
pgsql-hackers@postgresql.org, bugtraq@securityfocus.com
In-Reply-To: <20050421222716.GA2730@wolff.to>
Content-Type: text/plain
Date: Fri, 22 Apr 2005 21:02:21 +0100
Message-Id: <1114200141.11982.25.camel@cobra>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
On Thu, 2005-04-21 at 17:27 -0500, Bruno Wolff III wrote:
> On Wed, Apr 20, 2005 at 22:27:01 -0400,
> Stephen Frost <sfrost@snowman.net> wrote:
> >
> > SHA2 would also be nice.
>
> I think the new hash functions are called SHA256 and SHA512.
> For Postgres' purposes the recent weaknesses found in SHA1 and MD5
> aren't a big deal.
It is irrelevant here, if I am reading this correctly:
http://theory.csail.mit.edu/~yiqun/shanote.pdf
"collision search attacks"
Basically, multiple input data that have the same output hash, which is
of no use when what you are trying to find is the input.
Finding collisions quicker for a known input is one thing, but that is
not going to reduce the search space, not even your storage space (it is
unlikely that the colliding results would all be valid input).
Is adding the non-guessable salt that hard anyway?
