md5 again

Since I broke my table on hub and am awaiting assistance I'm shifting
away from the website temporarily and back to the md5 stuff. In going
over the previous conversations I've come up with the following:

The client can be sending the password in either plain text or in
hashed form with one of the two scenarios for a login process:

direction what
----------------------------------------------
CL -> PG username
PG -> CL random salt
CL -> PG plaintext passwd

CL -> PG username
PG -> CL random salt
CL -> PG encrypted passwd

----------------------------------------------

When PG receives the password, it doesn't know if the password is
encrypted or not. It checks first plaintext matching, then encrypted
matching using the random salt it sent to CL.

---------------------------------------------

Possible encryption methods:

MD5(password+salt)

MD5(MD5(password) + MD5(salt))

MD5(password+salt)

MD5(MD5(username+password)+salt)

MD5(MD5(username+password)+MD5(salt))

MD5(MD5(username+password+salt))

and many others.

---------------------------------------------

Is there a preference to the method used?

Also while thinking about this and the vulnerability of the wire itself,
I've also come up with something that may enhance the login security.

If CL sends the MD5 of the username rather than the plaintext username,
only CL and PG will know what the username is. PG will know it by
comparing it with the MD5 of every username in pg_shadow. So even if the
wire is being sniffed the unhashed username can be used in the password's
encryption along with the salt sent by PG. This method will take longer
for a user to log in, but the login process is only per session, not per
SQL call.

Comments?

Vince.
--
==========================================================================
Vince Vielhaber -- KA8CSH email: vev(at)michvhf(dot)com http://www.pop4.net
128K ISDN from $22.00/mo - 56K Dialup from $16.00/mo at Pop4 Networking
Online Campground Directory http://www.camping-usa.com
Online Giftshop Superstore http://www.cloudninegifts.com
==========================================================================