Bugtraq: Re: [HACKERS] Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

[Stephen Frost <sfrost () snowman net>]

* Mike Fratto (mfratto () nwc com) wrote:
> > I thought the idea of the salt was to aid in expanding the 
> > keyspace. Even though the salt is known (in traditional Unix 
> > passwd/shadow/master.passwd databases, 
> I am pretty sure the intent the salt is to make pre-computation of a
> dictionaries infeasable due to storage requirements. It doesn't really add
> to the keyspace because the salt is known and doesn't have to be guessed.
The salt isn't always known...  I don't know how an unprivledged user on
a system w/ /etc/shadow could get at it anyway.  I'm sure alot of people
would be very anxious to know if you know of a way to do that...

        Stephen

Attachment: signature.asc
Description: Digital signature