Re: Generating unique session ids

On Thu, 27 Jul 2006, Tom Lane wrote:

> Tomasz Ostrowski <tometzky@batory.org.pl> writes:
> > * When somebody knows md5('secret_salt' || '5') he will be able to
> > easily compute
> >     md5('secret_salt' || '50')
> >     md5('secret_salt' || '51')
>
> Sure, but can't you fix that by putting the secret part at the end?

I'm not so sure anymore. I think I was wrong... Forget it.

> > * PostgreSQL integers (as returned by nextval()) are 4 bytes. This
> > means only 32 bit strength - much too low for today computers.
>
> Um, nextval returns int8.

OK. 64 bit should be enough.

> > * Any database user is most of the time able to read function
> > bodies, so anybody who is able co connect to your database will be
> > able to get your 'secret_salt' and then predict session id's.
>
> Yeah, it's not clear where to hide the secret.

As somebody said it would be possible with restricted table and
security definer function.

Regards
Tometzky
--
...although Eating Honey was a very good thing to do, there was a
moment just before you began to eat it which was better than when you
were...
                                                      Winnie the Pooh