| From: | Rod Taylor <pg(at)rbt(dot)ca> |
|---|---|
| To: | Tino Wildenhain <tino(at)wildenhain(dot)de> |
| Cc: | bugtraq(at)securityfocus(dot)com, pgsql-hackers(at)postgresql(dot)org, Stephen Frost <sfrost(at)snowman(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "Jim C(dot) Nasby" <decibel(at)decibel(dot)org> |
| Subject: | Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted |
| Date: | 2005-04-21 13:32:08 |
| Message-ID: | 1114090328.66326.90.camel@home |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Thu, 2005-04-21 at 11:06 +0200, Tino Wildenhain wrote:
> Am Mittwoch, den 20.04.2005, 16:23 -0500 schrieb Jim C. Nasby:
> > On Wed, Apr 20, 2005 at 05:03:18PM -0400, Tom Lane wrote:
> ...
> > Simply put, MD5 is no longer strong enough for protecting secrets. It's
> > just too easy to brute-force. SHA1 is ok for now, but it's days are
> > numbered as well. I think it would be good to alter SHA1 (or something
> > stronger) as an alternative to MD5, and I see no reason not to use a
> > random salt instead of username.
>
> I wonder where you want to store that random salt and how this would add
> to the security.
One advantage of a random salt would be that the username can be changed
without having to reset the password at the same time.
--
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tino Wildenhain | 2005-04-21 13:47:33 | Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted |
| Previous Message | Bruce Momjian | 2005-04-21 13:11:10 | Re: [COMMITTERS] pgsql: Install some slightly realistic cost |