Skip site navigation (1) Skip section navigation (2)

Re: [GENERAL] SHA1 on postgres 8.3

From: Svenne Krap <svenne(at)krap(dot)dk>
To: pgsql-hackers(at)postgresql(dot)org
Subject: Re: [GENERAL] SHA1 on postgres 8.3
Date: 2008-04-03 16:14:17
Message-ID: 47F50259.7060400@krap.dk (view raw or flat)
Thread:
Lists: pgsql-generalpgsql-hackers
Mark Mielke wrote:
> This presumes that better hashes truly exist. It is basic math to show 
> that all hashes will include collisions. Ignoring the possibility that 
> one hash has theoretical better distribution for real documents, the 
> real "benefit" of SHA-1 over MD5, is that it has more bits. The 
> "ultimate" solution here, is to store the original using the "full 
> copy" hash technique, with 0 chance of collision. This extreme defeats 
> the purpose of a hash to start with.
>
> Why does PostgreSQL need something better than md5 as part of core? 
> Bragging rights?
Having more than one hash algorithm significantly decreases the risk of 
(common) collisions.

As a non-developer (who does track most messages on the list anyways), I 
surely find the SHA* functions will add significantly value and they 
should be easy to install (well-defined functions) with no maintainance 
afterwards.
Hashes are an absolute minimum for keeping passwords stored somehat 
safely in a database.

More two or even three different hashes with different collion-points 
will strongly increase the security.

In response to

Responses

pgsql-hackers by date

Next:From: Tom DunstanDate: 2008-04-03 16:15:52
Subject: Re: modules
Previous:From: Pavan DeolaseeDate: 2008-04-03 16:12:48
Subject: Re: [GENERAL] ANALYZE getting dead tuple count hopelessly wrong

pgsql-general by date

Next:From: Tom DunstanDate: 2008-04-03 16:15:52
Subject: Re: modules
Previous:From: Pavan DeolaseeDate: 2008-04-03 16:12:48
Subject: Re: [GENERAL] ANALYZE getting dead tuple count hopelessly wrong

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group