3

How are passwords encoded in column passwd of pg_shadow?

Doing a:

select passwd from pg_shadow;

I see values like the following:

 md52c92c858aa1fa12144f1dcbd4ca9c3a0

... which, doesn't seem to be what I know my password's MD5 hash to be (stripping the leading "md5" obviously). Are the hashes also salted?

4
  • 1
    They are salted and hashed twice. There is a plan for BCrypt in future. You can restrict access for non admin users anyway. Nov 22, 2014 at 14:07
  • 1
    @MladenUzelac it just seems weird (given the salting) that the same password resulted in the same salted hash in two different 9.1 installations (one in Ubuntu the other in a Red Hat system). I guess the salts are the same? Nov 22, 2014 at 15:20
  • wrong answer, i put the correct in the comment Nov 22, 2014 at 15:39
  • MD5 has been considered insecure for 25 years, since 1996. The fact that PostgreSQL still uses MD5 for hashing passwords reduces my confidence in the whole project. Why is it that one of the best open-source database engines is still using MD5 for the main database passwords, when every random developer knows to use a stronger hash function like bcrypt? How can I trust any aspect of PostgreSQL security if they hash passwords like this? Apr 28, 2021 at 3:54

1 Answer 1

3

It actually suffixes the password with the username and then MD5 hash is made out of that, and that hash is then prefixed with 'md5'

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.