Обсуждение: [BUGS] BUG #14797: It's not safe to use MD5

The following bug has been logged on the website:

Bug reference:      14797
Logged by:          Dmitriy Davydov
Email address:      dmitriy.davydov@deiteriy.com
PostgreSQL version: 9.6.5
Operating system:   CentOS
Description:

Hello.
Postgresql 9.6.5 , by default , database user passwords are stored as MD5
hashes (18.8  Encryption Options.
http://repo.postgrespro.ru/doc/pgsql/9.6.5/en/postgres-A4-fop.pdf). At the
moment, it's not safe to use MD5. 
Unfortunately, Rolename is used as the salt.
(src/backend/commands/user.c  
if (!pg_md5_encrypt(password, rolename, strlen(rolename),
encrypted_password)) )  
This is also unsafe.
Payment Card Industry (PCI) Data Security Standard requires the use of hash
functions described in FIPS 180-4, such as SHA-256 and SHA-512.
Please make changes in future versions.


--
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs

On Tue, Sep 05, 2017 at 12:01:06PM +0000, dmitriy.davydov@deiteriy.com wrote:
> Hello.
> Postgresql 9.6.5 , by default , database user passwords are stored as MD5
> hashes (18.8  Encryption Options.

first of all, it's not a bug, so posting it to pgsql-bugs is not
appropriate.

second of all - newer pg already has stronger hashing support:
https://www.depesz.com/2017/04/18/waiting-for-postgresql-10-support-scram-sha-256-authentication-rfc-5802-and-7677/

Best regards,

depesz



-- 
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs