Re: Re: Proposal for encrypting pg_shadow passwords

Bruce Momjian <pgman@candle.pha.pa.us> writes:
> Just a reminder.  What I think it insecure is the size of our salt.
> With only 3300 possible salts, it doesn't take long to playback a
> duplicate.  That is true of MD5 and crypt.

But aren't we increasing the size of the salt keyspace for MD5?
It'd surely be a major oversight not to.

            regards, tom lane