1

How are passwords encoded in column passwd of pg_shadow?

Doing a:

select passwd from pg_shadow;

I see values like the following:

 md52c92c858aa1fa12144f1dcbd4ca9c3a0

... which, doesn't seem to be what I know my password's MD5 hash to be (stripping the leading "md5" obviously). Are the hashes also salted?

  • 1
    They are salted and hashed twice. There is a plan for BCrypt in future. You can restrict access for non admin users anyway. – Mladen Uzelac Nov 22 '14 at 14:07
  • 1
    @MladenUzelac it just seems weird (given the salting) that the same password resulted in the same salted hash in two different 9.1 installations (one in Ubuntu the other in a Red Hat system). I guess the salts are the same? – Marcus Junius Brutus Nov 22 '14 at 15:20
  • wrong answer, i put the correct in the comment – Mladen Uzelac Nov 22 '14 at 15:39
1

It actually suffixes the password with the username and then MD5 hash is made out of that, and that hash is then prefixed with 'md5'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.