Hi Tom,
md5 is not being recommended anywhere because it contains hash collision.
Therefore either it should be replaced with SHA1 or any other good hash
algorithm or taken out of core completely. md5 in core is worthless now.I am
not using it in my application. I am using SHA1 in client/web tier for password
hashing.
Would replacing md5 with SHA1 in core involve much work?
Sanjay Sharma> To: [EMAIL PROTECTED]> CC: pgsql-hackers@postgresql.org>
Subject: Re: [HACKERS] [GENERAL] SHA1 on postgres 8.3 > Date: Wed, 2 Apr 2008
11:38:31 -0400> From: [EMAIL PROTECTED]> > "Greg Sabino Mullane" <[EMAIL
PROTECTED]> writes:> > I don't agree that we should just close discussion.
Nobody seems happy> > with the status quo, which is that we provide md5 but not
sha1,> > There may be a few people who are unhappy, but the above claim seems>
vastly overblown. md5 is sufficient for the purpose it is intended> for in core
postgres (namely, obscuring the true source text of> passwords), and if you
have needs much beyond that you'll soon be> installing pgcrypto anyway.> >
regards, tom lane> > -- > Sent via pgsql-hackers mailing list
(pgsql-hackers@postgresql.org)> To make changes to your subscription:>
http://www.postgresql.org/mailpref/pgsql-hackers
_________________________________________________________________
Tried the new MSN Messenger? It’s cool! Download now.
http://messenger.msn.com/Download/Default.aspx?mkt=en-in
