Thread: SHA-1 vs MD5

I know that there is a md5 internal function on postgresql, but I noticed that it isn't the more secure today. I would like to know if there is a SHA-1 function implemented yet of, if not, if the team has plan to introduce it on PostgreSQL.

On 3/7/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com > wrote:

I know that there is a md5 internal function on postgresql, but I noticed that it isn't the more secure today. I would like to know if there is a SHA-1 function implemented yet of, if not, if the team has plan to introduce it on PostgreSQL.

You are probably looking for the pgcrypto contribution, look in the contrib directory for it.

test=# select encode(digest('blahblah', 'sha256'), 'hex');
                              encode                             
------------------------------------------------------------------
 40b1bbb5445fc021a312315379f4633284851e14d1db83fb0730f58872d6033b
(1 row)

--
Chad
http://www.postgresqlforums.com/

I really don't have the pgcrypto. It could be a nice alternative. Could you tell me the steps to install it ?

I am very concerned about security in my application becouse we are going to moviment a large ammount of information and money. As much i take care of it as good.

I know some problem of MD5 and know it is very good too. If someone could tell me where MD5 is used I could be more relaxed.

On 3/8/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:

I really don't have the pgcrypto. It could be a nice alternative. Could you tell me the steps to install it ?

This should help you out:

http://www.postgresql.org/docs/8.2/static/external-extensions.html
http://developer.postgresql.org/cvsweb.cgi/pgsql/contrib/README?rev=1.91;content-type=text%2Fplain

 

I am very concerned about security in my application becouse we are going to moviment a large ammount of information and money. As much i take care of it as good.

SHA1 and MD5 are hashing algorithms, they are typically used for passwords and in conjunction with public key encryption or over-the-wire encryption to sign the message.  If you are really concerned about security, you may want to hire an experienced person in the security engineering field.  Especially if you are talking about financial information.
 

I know some problem of MD5 and know it is very good too. If someone could tell me where MD5 is used I could be more relaxed.

The impression I get is that SHA-256, SHA-384, or SHA-512 are the preferred hashing algorithms, but I really don't keep up on it.  Many many password systems use MD5, I think it is reasonably safe.

Thank you so much for your information. I installed the pgCrypto. Now I have more than 40 functions (i believe all are from pgcrypto) but when I try to run your query:

select encode(digest('blahblah', 'sha256'), 'hex');

I got the error:

ERROR: Cannot use "sha256": No such hash algorithm
SQL state: 22023

On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com> wrote:

Thank you so much for your information. I installed the pgCrypto. Now I have more than 40 functions (i believe all are from pgcrypto) but when I try to run your query:

select encode(digest('blahblah', 'sha256'), 'hex');

I got the error:

ERROR: Cannot use "sha256": No such hash algorithm
SQL state: 22023

It may not be available in your version of the database/pgcrypto module, my test was performed on 8.2.3 .

You are correct. My pg (8.1.3)

Now what I do to remove it ?

Just delete the functions ?

On 3/9/07, Ezequias Rodrigues da Rocha <ezequias.rocha@gmail.com > wrote:

You are correct. My pg (8.1.3)

Now what I do to remove it ?

Just delete the functions ?

There is usually an uninstall_pgcrypto.sql script you can run against the database.  But 8.1 probably supports at least sha1, or you can consider upgrading to 8.2.