Re: MD5 Authentication

On 05/11/2009, at 16:49, Rafael Martinez wrote:

> Raimon Fernandez wrote:
>> Hello again ...
>>
>>
>> I'm trying to Authenticate to some PostgreSQL using MD5.
>>
>> I can get the salt, for example:
>>
>> A7 2E DB 2F
>>
>
> Hello
>
> The md5 authentication in PostgreSQL works this way:
>
> server -------------- 4-byte token ---------------------------> client
> server <--- "md5" + md5(md5(password + username) + token)" ---- client

Where did gou get this ?

I can't find it in the docs ...

AuthenticationMD5Password
The frontend must now send a PasswordMessage containing the password
encrypted via MD5,
using the 4-character salt specified in the AuthenticationMD5Password
message. If this is the
correct password, the server responds with an AuthenticationOk,
otherwise it responds with an
ErrorResponse.

Also, for what I see, I have to send the first byte with 'p' and then
the MD5 of the psw using the salt, I cna't see the specification where
I have to send the 'md5' string ...

And, I have to make two MD5 ...

I'll give it a try ...

thanks,

raimon