* Joshua D. Drake (jd@commandprompt.com) wrote:
> >Simply put, MD5 is no longer strong enough for protecting secrets. It's
> >just too easy to brute-force. SHA1 is ok for now, but it's days are
> >numbered as well. I think it would be good to alter SHA1 (or something
> >stronger) as an alternative to MD5, and I see no reason not to use a
> >random salt instead of username.
>
> If you aren't paying close enough attention to your database server to
> see that someone is trying to brute force your MD5 password you have
> bigger problems.
If the attacker knows the salt then she can do almost all of the
brute-force work up-front before even attempting to attack the system
directly. The sys admin would have no way of knowing this was
happening. Once this is done the attacker just needs the hash from
pg_shadow to quickly find the user's password (or something that hashes
to the same thing).
In this situation I'm assuming the system is using the 'password'
method in pg_hba.conf. If the system used the 'md5' method in
pg_hba.conf the attacker would need only the hash from pg_shadow to
authenticate and wouldn't need the users original password at all.
If a random salt were used in this situation, and 'password' were used
in pg_hba.conf then the attacker would be unable to determine the salt
ahead of time and would be forced to generate the keyspace after
obtaining pg_shadow to brute-force the password, a time consuming
process hopefully given the admin an opportunity to discover the
compromise.
Thanks,
Stephen