database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Add modern SHA-2 based password hashes to pgcrypto.

Browse Source 
This adapts the publicly available reference implementation on
https://www.akkadia.org/drepper/SHA-crypt.txt and adds the new hash
algorithms sha256crypt and sha512crypt to crypt() and gen_salt()
respectively.

Author: Bernd Helmle <mailings@oopsware.de>
Reviewed-by: Japin Li <japinli@hotmail.com>
Discussion: https://postgr.es/m/c763235a2757e2f5f9e3e27268b9028349cef659.camel@oopsware.de
This commit is contained in:
Álvaro Herrera
2025-04-05 19:16:58 +02:00
parent e33f2335a9
commit 749a9e20c9
9 changed files with 1114 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
contrib/pgcrypto/px-crypt.h
View File

@ -45,6 +45,30 @@
/* default for blowfish salt */
#define PX_BF_ROUNDS 6
/* Maximum salt string length of shacrypt. */
#define PX_SHACRYPT_SALT_MAX_LEN 16
/* SHA buffer length */
#define PX_SHACRYPT_DIGEST_MAX_LEN 64
/* calculated buffer size of a buffer to store a shacrypt salt string */
#define PX_SHACRYPT_SALT_BUF_LEN (3 + 7 + 10 + PX_SHACRYPT_SALT_MAX_LEN + 1)
/*
* calculated buffer size of a buffer to store complete result of a shacrypt
* digest including salt
*/
#define PX_SHACRYPT_BUF_LEN (PX_SHACRYPT_SALT_BUF_LEN + 86 + 1)
/* Default number of rounds of shacrypt if not explicitly specified. */
#define PX_SHACRYPT_ROUNDS_DEFAULT 5000
/* Minimum number of rounds of shacrypt. */
#define PX_SHACRYPT_ROUNDS_MIN 1000
/* Maximum number of rounds of shacrypt. */
#define PX_SHACRYPT_ROUNDS_MAX 999999999
/*
* main interface
*/
@ -64,6 +88,10 @@ char *_crypt_gensalt_md5_rn(unsigned long count,
const char *input, int size, char *output, int output_size);
char *_crypt_gensalt_blowfish_rn(unsigned long count,
const char *input, int size, char *output, int output_size);
char *_crypt_gensalt_sha256_rn(unsigned long count,
const char *input, int size, char *output, int output_size);
char *_crypt_gensalt_sha512_rn(unsigned long count,
const char *input, int size, char *output, int output_size);
/* disable 'extended DES crypt' */
/* #define DISABLE_XDES */
@ -79,4 +107,7 @@ char *px_crypt_des(const char *key, const char *setting);
char *px_crypt_md5(const char *pw, const char *salt,
char *passwd, unsigned dstlen);
/* crypt-sha.c */
char *px_crypt_shacrypt(const char *pw, const char *salt, char *passwd, unsigned dstlen);
#endif /* _PX_CRYPT_H */