Magnus Hagander wrote:
> Using MD5 for passwords doesn't, afaik, actually require
> collision-resistance. It requires resistance against preimage-attacks,
> which there are none for MD5. At least not yet.
Marc Stevens et al have a chosen prefix attack on MD5 (similar to a
second preimage attack, but slightly weaker) which they've successfully
used to forge root CA certs, using a cluster of PS3s. Cf. their
presentation at 25c3 last December.
>> this has implications for storing passwords as MD5 hashes. My
> That would be the only system use of MD5. What implications are those?
> We might want to consider using a safer hash for the password storage at
> some point, but from what I gather it's not really urgent for *that* use.
It would be a lot more urgent if we weren't salting, but IIRC we are.
In response to
pgsql-bugs by date
|Next:||From: Magnus Hagander||Date: 2009-06-24 11:45:04|
|Subject: Re: BUG #4877: LDAP auth allows empty password string|
|Previous:||From: Heikki Linnakangas||Date: 2009-06-24 10:38:24|
|Subject: Re: psql: FATAL: the database system is in recovery mode|