MD5 passwords explained (was Re: md5 hash question (2))

From: "Magnus Naeslund(f)" <mag(at)fbab(dot)net>
To: "al eker" <cagils(at)biznet(dot)com(dot)tr>
Cc: <pgsql-general(at)postgresql(dot)org>
Subject: MD5 passwords explained (was Re: md5 hash question (2))
Date: 2002-12-10 09:56:31
Message-ID: 00ee01c2a032$6a9df160$f80c0a0a@mnd
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Çagil Seker <cagils(at)biznet(dot)com(dot)tr> wrote:
> sorry, but I have another q about that md5 hashing. When I use a
> sniffer on the wire I see md5 hashes of user - probably the password
> hash. But when I compare the password hash with the hash on the wire
> I see they are different. In what format is the md5 hash on the wire
> encoded? I've tried double md5'ing but didn't get the right hash.
>

There seems to be some confusion regarding the md5 authentication method
used in postgresql, and i thought it might be good if i typed this
message so that it can be referred to if anyone asks these questions
again.

Someone will surely correct me if i'm wrong :)

The password in the database is stored like this:

md5passwd = "md5"+md5(cleartxtpasswd+user);

When connecting and authenticating this happens:

The server generates a random salt (nonce) and sends it to the client.

md5salt = 4 random chars

The client then does this:

md5hash = md5(md5(cleartxtpasswd+user)+md5salt)

and sends it to the server.

The server then does the same on it's side and compares the result with
the hash gotten from the client. If they match the password is correct.

This is standard MAC / shared secret stuff.

It's done do avoid sending clear text passwords (or even the stored md5
password, to prevent brute force cracking) over the wire.

Regards
Magnus

In response to

Responses

Browse pgsql-general by date

  From Date Subject
Next Message Çağıl Şeker 2002-12-10 10:06:26 Re: MD5 passwords explained (was Re: md5 hash question (2))
Previous Message Lincoln Yeoh 2002-12-10 09:28:38 Full text indexing - Burrows-Wheeler + suffix arrays