> btober@seaworthysys.com wrote:
>> Anyone have a good function for byte-by-byte XOR of text or varchar
>> data (or does one exist already in pg which I missed in the
>> documentation)?
>>
> You should have a look at pg_crypt which offers a wider range
> of cryptographic functions for postgres.
Are you referring to contrib/pgcrypto here, which has the functions
encrypt(data::bytea, key::bytea, type::text)::bytea
decrypt(data::bytea, key::bytea, type::text)::bytea
or to something else? I do see a reference in some older documentation
for CREATE USER that says "...For more details on how this authentication
system functions see pg_crypt(3)", but I can't really figure out exactly
what documentation that refers to. Further guidance would be appreciated.
> . I dont think there
> is a xor yet, but otoh, xor is inherently insecure if its
> cryptography you are trying.
I'm not sure exactly about the details of where I'm going yet, because
the customer has not layed out specifically what they want, so I'm just
developing some preliminary ideas. I'm preparing to support customer
request that sounds like what they'll want to do is to store
authentication credentials (username and password) in the database. These
credentials are not the database login credentials, but might be username
and passwords for other places employees need passwords for, like web
sites, other other network resources. Eash user would store whatever
passwords they want in a central repository (the database) and then have
to remember only a single password in able to get a list of their stored
passwords. I'm thinking their going to want the credentials stored in the
database to not be in plain text, so yea, I was thinking about simply
xoring them with the respective user's single, non-stored password, or
more likely xoring against an md5 hash of that single, master password.
~Berend Tober
