Re: MD5 Authentication

On 05/11/2009, at 18:24, Raimon Fernandez wrote:

>
> On 05/11/2009, at 18:02, Rafael Martinez wrote:
>
>> Raimon Fernandez wrote:
>>>
>>> On 05/11/2009, at 16:49, Rafael Martinez wrote:
>>>
>>>>
>>>> The md5 authentication in PostgreSQL works this way:
>>>>
>>>> server -------------- 4-byte token --------------------------->
>>>> client
>>>> server <--- "md5" + md5(md5(password + username) + token) ----
>>>> client
>>>
>>> Where did gou get this ?
>>>
>>> I can't find it in the docs ...
>>>
>>
>>
>> From an e-mail from Tom Lane about this:
>> http://archives.postgresql.org/pgsql-novice/2003-05/msg00305.php
>
> ok, thanks ...

at least, my first md5 (psw+user) is the same as the pg_shadow
(wihtout the 'md5') ...

should I md5 the first md5 as I get it as string (like username) or
byte by byte ?

thanks,

regards,

r.