Re: MD5 authentication needs help

From: Stephen Frost <sfrost(at)snowman(dot)net>
To: Bruce Momjian <bruce(at)momjian(dot)us>
Cc: PostgreSQL-development <pgsql-hackers(at)postgreSQL(dot)org>
Subject: Re: MD5 authentication needs help
Date: 2015-03-04 02:11:07
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers

Bruce, all,

* Bruce Momjian (bruce(at)momjian(dot)us) wrote:
> It feels like MD5 has accumulated enough problems that we need to start
> looking for another way to store and pass passwords. The MD5 problems
> are:
> 1) MD5 makes users feel uneasy (though our usage is mostly safe)
> 2) The per-session salt sent to the client is only 32-bits, meaning
> that it is possible to reply an observed MD5 hash in ~16k connection
> attempts.
> 3) Using the user name for the MD5 storage salt allows the MD5 stored
> hash to be used on a different cluster if the user used the same
> password.
> 4) Using the user name for the MD5 storage salt causes the renaming of
> a user to break the stored password.
> For these reasons, it is probably time to start thinking about a
> replacement that fixes these issues. We would keep MD5 but recommend
> a better option.

For more background, I'd suggest taking a look at this recent thread:




In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Jan de Visser 2015-03-04 02:37:04 Re: Idea: closing the loop for "pg_ctl reload"
Previous Message Kyotaro HORIGUCHI 2015-03-04 02:04:57 Re: How about to have relnamespace and relrole?