Stephen Frost <sfrost (at) snowman (dot) net [email concealed]> writes:
> The md5 hash which is generated for and stored in pg_shadow does not
> use a random salt but instead uses the username which can generally be
> determined ahead of time (especially for the 'postgres' superuser
> account).
So?
The fact that we encrypt the contents of pg_shadow at all is not to
provide security against breakins by people who have managed to
obtain the contents of pg_shadow. Any such attacker knows as much as
the postmaster does, and so there isn't anything much the postmaster can
do to prevent a breakin. The reason we do it is to prevent such a
person (or a dishonest DBA) from obtaining the user's actual original
password. This doesn't improve the security of the database at all,
of course, but it does improve security globally if the user used the
same password for other systems.
> This would allow for the pregeneration of the entire md5
> keyspace using that 'salt' and then quick breakage of the hash once
> it's retrieved by the attacker.
Considering the size of the possible keyspace, this is pretty silly.
> Were a decent random salt of some
> size used it would be difficult to guess and pregenerate the keyspace
> for. Thus, keyspace generation would have to happen after pg_shadow
> was compramised, giving the admin time to detect the compramise and
> take corrective action.
Another large assumption: that the admin knows about the compromise
before the results are used.
>. It is also not made clear that if you are
> already handling transport-level security via SSL and/or IPSEC that
> using md5 actually reduces security by not adding anything to the
> transport-level security and defeating the on-disk security
> effectivness of using md5 for pg_shadow.
That's simply false. The contents of pg_shadow are never sent over the
wire.
You're going to have to work a lot harder to convince us there's any
significant issue here.
> The md5 hash which is generated for and stored in pg_shadow does not
> use a random salt but instead uses the username which can generally be
> determined ahead of time (especially for the 'postgres' superuser
> account).
So?
The fact that we encrypt the contents of pg_shadow at all is not to
provide security against breakins by people who have managed to
obtain the contents of pg_shadow. Any such attacker knows as much as
the postmaster does, and so there isn't anything much the postmaster can
do to prevent a breakin. The reason we do it is to prevent such a
person (or a dishonest DBA) from obtaining the user's actual original
password. This doesn't improve the security of the database at all,
of course, but it does improve security globally if the user used the
same password for other systems.
> This would allow for the pregeneration of the entire md5
> keyspace using that 'salt' and then quick breakage of the hash once
> it's retrieved by the attacker.
Considering the size of the possible keyspace, this is pretty silly.
> Were a decent random salt of some
> size used it would be difficult to guess and pregenerate the keyspace
> for. Thus, keyspace generation would have to happen after pg_shadow
> was compramised, giving the admin time to detect the compramise and
> take corrective action.
Another large assumption: that the admin knows about the compromise
before the results are used.
>. It is also not made clear that if you are
> already handling transport-level security via SSL and/or IPSEC that
> using md5 actually reduces security by not adding anything to the
> transport-level security and defeating the on-disk security
> effectivness of using md5 for pg_shadow.
That's simply false. The contents of pg_shadow are never sent over the
wire.
You're going to have to work a lot harder to convince us there's any
significant issue here.
regards, tom lane
[ reply ]