目录搜索
前言何为PostgreSQL?PostgreSQL简史格式约定更多信息臭虫汇报指导I. 教程章1. 从头开始1.1. 安装1.2. 体系基本概念1.3. 创建一个数据库1.4. 访问数据库章2. SQL语言2.1. 介绍2.2. 概念2.3. 创建新表2.4. 向表中添加行2.5. 查询一个表2.6. 表间链接2.7. 聚集函数2.8. 更新2.9. 删除章3. 高级特性3.1. 介绍3.2. 视图3.3. 外键3.4. 事务3.5. 窗口函数3.6. 继承3.7. 结论II. SQL语言章4. SQL语法4.1. 词法结构4.2. 值表达式4.3. 调用函数章5. 数据定义5.1. 表的基本概念5.2. 缺省值5.3. 约束5.4. 系统字段5.5. 修改表5.6. 权限5.7. 模式5.8. 继承5.9. 分区5.10. 其它数据库对象5.11. 依赖性跟踪章 6. 数据操作6.1. 插入数据6.2. 更新数据6.3. 删除数据章7. 查询7.1. 概述7.2. 表表达式7.3. 选择列表7.4. 组合查询7.5. 行排序7.6. LIMIT和OFFSET7.7. VALUES列表7.8. WITH的查询(公用表表达式)章8. 数据类型8.1. 数值类型8.2. 货币类型8.3. 字符类型8.4. 二进制数据类型8.5. 日期/时间类型8.6. 布尔类型8.7. 枚举类型8.8. 几何类型8.9. 网络地址类型8.10. 位串类型8.11. 文本搜索类型8.12. UUID类型8.13. XML类型8.14. 数组8.15. 复合类型8.16. 对象标识符类型8.17. 伪类型章 9. 函数和操作符9.1. 逻辑操作符9.2. 比较操作符9.3. 数学函数和操作符9.4. 字符串函数和操作符9.5. 二进制字符串函数和操作符9.6. 位串函数和操作符9.7. 模式匹配9.8. 数据类型格式化函数9.9. 时间/日期函数和操作符9.10. 支持枚举函数9.11. 几何函数和操作符9.12. 网络地址函数和操作符9.13. 文本检索函数和操作符9.14. XML函数9.15. 序列操作函数9.16. 条件表达式9.17. 数组函数和操作符9.18. 聚合函数9.19. 窗口函数9.20. 子查询表达式9.21. 行和数组比较9.22. 返回集合的函数9.23. 系统信息函数9.24. 系统管理函数9.25. 触发器函数章10. 类型转换10.3. 函数10.2. 操作符10.1. 概述10.4. 值存储10.5. UNION章11. 索引11.1. 介绍11.2. 索引类型11.3. 多字段索引11.4. 索引和ORDER BY11.5. 组合多个索引11.6. 唯一索引11.7. 表达式上的索引11.8. 部分索引11.9. 操作类和操作簇11.10. 检查索引的使用章12. Full Text Search12.1. Introduction12.2. Tables and Indexes12.3. Controlling Text Search12.4. Additional Features12.5. Parsers12.6. Dictionaries12.7. Configuration Example12.8. Testing and Debugging Text Search12.9. GiST and GIN Index Types12.10. psql Support12.11. Limitations12.12. Migration from Pre-8.3 Text Search章13. 并发控制13.1. 介绍13.2. 事务隔离13.3. 明确锁定13.4. 应用层数据完整性检查13.5. 锁和索引章14. 性能提升技巧14.1. 使用EXPLAIN14.2. 规划器使用的统计信息14.3. 用明确的JOIN语句控制规划器14.4. 向数据库中添加记录14.5. 非持久性设置III. 服务器管理章15. 安装指导15.1. 简版15.2. 要求15.3. 获取源码15.4. 升级15.5. 安装过程15.6. 安装后的设置15.7. 支持的平台15.8. 特殊平台的要求章16. Installation from Source Code on Windows16.1. Building with Visual C++ or the Platform SDK16.2. Building libpq with Visual C++ or Borland C++章17. 服务器安装和操作17.1. PostgreSQL用户帐户17.2. 创建数据库集群17.3. 启动数据库服务器17.4. 管理内核资源17.5. 关闭服务17.6. 防止服务器欺骗17.7. 加密选项17.8. 用SSL进行安全的TCP/IP连接17.9. Secure TCP/IP Connections with SSH Tunnels章18. 服务器配置18.1. 设置参数18.2. 文件位置18.3. 连接和认证18.4. 资源消耗18.5. 预写式日志18.6. 查询规划18.7. 错误报告和日志18.8. 运行时统计18.9. 自动清理18.10. 客户端连接缺省18.12. 版本和平台兼容性18.11. 锁管理18.13. 预置选项18.14. 自定义的选项18.15. 开发人员选项18.16. 短选项章19. 用户认证19.1. pg_hba.conf 文件19.2. 用户名映射19.3. 认证方法19.4. 用户认证章20. 数据库角色和权限20.1. 数据库角色20.2. 角色属性20.3. 权限20.4. 角色成员20.5. 函数和触发器章21. 管理数据库21.1. 概述21.2. 创建一个数据库21.3. 临时库21.4. 数据库配置21.5. 删除数据库21.6. 表空间章22. 本土化22.1. 区域支持22.2. 字符集支持章23. 日常数据库维护工作23.1. Routine Vacuuming日常清理23.2. 经常重建索引23.3. 日志文件维护章24. 备份和恢复24.1. SQL转储24.2. 文件系统级别的备份24.3. 在线备份以及即时恢复(PITR)24.4. 版本间迁移章25. 高可用性与负载均衡,复制25.1. 不同解决方案的比较25.2. 日志传送备份服务器25.3. 失效切换25.4. 日志传送的替代方法25.5. 热备章26. 恢复配置26.1. 归档恢复设置26.2. 恢复目标设置26.3. 备服务器设置章27. 监控数据库的活动27.1. 标准Unix工具27.2. 统计收集器27.3. 查看锁27.4. 动态跟踪章28. 监控磁盘使用情况28.1. 判断磁盘的使用量28.2. 磁盘满导致的失效章29. 可靠性和预写式日志29.1. 可靠性29.2. 预写式日志(WAL)29.3. 异步提交29.4. WAL配置29.5. WAL内部章30. Regression Tests30.1. Running the Tests30.2. Test Evaluation30.3. Variant Comparison Files30.4. Test Coverage ExaminationIV. 客户端接口章31. libpq-C库31.1. 数据库联接函数31.2. 连接状态函数31.3. 命令执行函数31.4. 异步命令处理31.5. 取消正在处理的查询31.6. 捷径接口31.7. 异步通知31.8. 与COPY命令相关的函数31.9. Control Functions 控制函数31.10. 其他函数31.11. 注意信息处理31.12. 事件系统31.13. 环境变量31.14. 口令文件31.15. 连接服务的文件31.16. LDAP查找连接参数31.17. SSL支持31.18. 在多线程程序里的行为31.19. 制作libpq程序31.20. 例子程序章32. 大对象32.1. 介绍32.2. 实现特点32.3. 客户端接口32.4. 服务器端函数32.5. 例子程序章33. ECPG - Embedded SQL in C33.1. The Concept33.2. Connecting to the Database Server33.3. Closing a Connection33.4. Running SQL Commands33.5. Choosing a Connection33.6. Using Host Variables33.7. Dynamic SQL33.8. pgtypes library33.9. Using Descriptor Areas33.10. Informix compatibility mode33.11. Error Handling33.12. Preprocessor directives33.13. Processing Embedded SQL Programs33.14. Library Functions33.15. Internals章34. 信息模式34.1. 关于这个模式34.2. 数据类型34.3. information_schema_catalog_name34.4. administrable_role_authorizations34.5. applicable_roles34.6. attributes34.7. check_constraint_routine_usage34.8. check_constraints34.9. column_domain_usage34.10. column_privileges34.11. column_udt_usage34.12. 字段34.13. constraint_column_usage34.14. constraint_table_usage34.15. data_type_privileges34.16. domain_constraints34.18. domains34.17. domain_udt_usage34.19. element_types34.20. enabled_roles34.21. foreign_data_wrapper_options34.22. foreign_data_wrappers34.23. foreign_server_options34.24. foreign_servers34.25. key_column_usage34.26. parameters34.27. referential_constraints34.28. role_column_grants34.29. role_routine_grants34.30. role_table_grants34.31. role_usage_grants34.32. routine_privileges34.33. routines34.34. schemata34.35. sequences34.36. sql_features34.37. sql_implementation_info34.38. sql_languages34.39. sql_packages34.40. sql_parts34.41. sql_sizing34.42. sql_sizing_profiles34.43. table_constraints34.44. table_privileges34.45. tables34.46. triggered_update_columns34.47. 触发器34.48. usage_privileges34.49. user_mapping_options34.50. user_mappings34.51. view_column_usage34.52. view_routine_usage34.53. view_table_usage34.54. 视图V. 服务器端编程章35. 扩展SQL35.1. 扩展性是如何实现的35.2. PostgreSQL类型系统35.3. User-Defined Functions35.4. Query Language (SQL) Functions35.5. Function Overloading35.6. Function Volatility Categories35.7. Procedural Language Functions35.8. Internal Functions35.9. C-Language Functions35.10. User-Defined Aggregates35.11. User-Defined Types35.12. User-Defined Operators35.13. Operator Optimization Information35.14. Interfacing Extensions To Indexes35.15. 用C++扩展章36. 触发器36.1. 触发器行为概述36.3. 用 C 写触发器36.2. 数据改变的可视性36.4. 一个完整的例子章37. 规则系统37.1. The Query Tree37.2. 视图和规则系统37.3. 在INSERT,UPDATE和DELETE上的规则37.4. 规则和权限37.5. 规则和命令状态37.6. 规则与触发器得比较章38. Procedural Languages38.1. Installing Procedural Languages章39. PL/pgSQL - SQL过程语言39.1. 概述39.2. PL/pgSQL的结构39.3. 声明39.4. 表达式39.5. 基本语句39.6. 控制结构39.7. 游标39.8. 错误和消息39.9. 触发器过程39.10. PL/pgSQL Under the Hood39.11. 开发PL/pgSQL的一些提示39.12. 从OraclePL/SQL 进行移植章40. PL/Tcl - Tcl Procedural Language40.1. Overview40.2. PL/Tcl Functions and Arguments40.3. Data Values in PL/Tcl40.4. Global Data in PL/Tcl40.5. Database Access from PL/Tcl40.6. Trigger Procedures in PL/Tcl40.7. Modules and the unknown command40.8. Tcl Procedure Names章41. PL/Perl - Perl Procedural Language41.1. PL/Perl Functions and Arguments41.2. Data Values in PL/Perl41.3. Built-in Functions41.4. Global Values in PL/Perl41.6. PL/Perl Triggers41.5. Trusted and Untrusted PL/Perl41.7. PL/Perl Under the Hood章42. PL/Python - Python Procedural Language42.1. Python 2 vs. Python 342.2. PL/Python Functions42.3. Data Values42.4. Sharing Data42.5. Anonymous Code Blocks42.6. Trigger Functions42.7. Database Access42.8. Utility Functions42.9. Environment Variables章43. Server Programming Interface43.1. Interface FunctionsSpi-spi-connectSpi-spi-finishSpi-spi-pushSpi-spi-popSpi-spi-executeSpi-spi-execSpi-spi-execute-with-argsSpi-spi-prepareSpi-spi-prepare-cursorSpi-spi-prepare-paramsSpi-spi-getargcountSpi-spi-getargtypeidSpi-spi-is-cursor-planSpi-spi-execute-planSpi-spi-execute-plan-with-paramlistSpi-spi-execpSpi-spi-cursor-openSpi-spi-cursor-open-with-argsSpi-spi-cursor-open-with-paramlistSpi-spi-cursor-findSpi-spi-cursor-fetchSpi-spi-cursor-moveSpi-spi-scroll-cursor-fetchSpi-spi-scroll-cursor-moveSpi-spi-cursor-closeSpi-spi-saveplan43.2. Interface Support FunctionsSpi-spi-fnameSpi-spi-fnumberSpi-spi-getvalueSpi-spi-getbinvalSpi-spi-gettypeSpi-spi-gettypeidSpi-spi-getrelnameSpi-spi-getnspname43.3. Memory ManagementSpi-spi-pallocSpi-reallocSpi-spi-pfreeSpi-spi-copytupleSpi-spi-returntupleSpi-spi-modifytupleSpi-spi-freetupleSpi-spi-freetupletableSpi-spi-freeplan43.4. Visibility of Data Changes43.5. ExamplesVI. 参考手册I. SQL命令Sql-abortSql-alteraggregateSql-alterconversionSql-alterdatabaseSql-alterdefaultprivilegesSql-alterdomainSql-alterforeigndatawrapperSql-alterfunctionSql-altergroupSql-alterindexSql-alterlanguageSql-alterlargeobjectSql-alteroperatorSql-alteropclassSql-alteropfamilySql-alterroleSql-alterschemaSql-altersequenceSql-alterserverSql-altertableSql-altertablespaceSql-altertsconfigSql-altertsdictionarySql-altertsparserSql-altertstemplateSql-altertriggerSql-altertypeSql-alteruserSql-alterusermappingSql-alterviewSql-analyzeSql-beginSql-checkpointSql-closeSql-clusterSql-commentSql-commitSql-commit-preparedSql-copySql-createaggregateSql-createcastSql-createconstraintSql-createconversionSql-createdatabaseSql-createdomainSql-createforeigndatawrapperSql-createfunctionSql-creategroupSql-createindexSql-createlanguageSql-createoperatorSql-createopclassSql-createopfamilySql-createroleSql-createruleSql-createschemaSql-createsequenceSql-createserverSql-createtableSql-createtableasSql-createtablespaceSql-createtsconfigSql-createtsdictionarySql-createtsparserSql-createtstemplateSql-createtriggerSql-createtypeSql-createuserSql-createusermappingSql-createviewSql-deallocateSql-declareSql-deleteSql-discardSql-doSql-dropaggregateSql-dropcastSql-dropconversionSql-dropdatabaseSql-dropdomainSql-dropforeigndatawrapperSql-dropfunctionSql-dropgroupSql-dropindexSql-droplanguageSql-dropoperatorSql-dropopclassSql-dropopfamilySql-drop-ownedSql-droproleSql-dropruleSql-dropschemaSql-dropsequenceSql-dropserverSql-droptableSql-droptablespaceSql-droptsconfigSql-droptsdictionarySql-droptsparserSql-droptstemplateSql-droptriggerSql-droptypeSql-dropuserSql-dropusermappingSql-dropviewSql-endSql-executeSql-explainSql-fetchSql-grantSql-insertSql-listenSql-loadSql-lockSql-moveSql-notifySql-prepareSql-prepare-transactionSql-reassign-ownedSql-reindexSql-release-savepointSql-resetSql-revokeSql-rollbackSql-rollback-preparedSql-rollback-toSql-savepointSql-selectSql-selectintoSql-setSql-set-constraintsSql-set-roleSql-set-session-authorizationSql-set-transactionSql-showSql-start-transactionSql-truncateSql-unlistenSql-updateSql-vacuumSql-valuesII. 客户端应用程序App-clusterdbApp-createdbApp-createlangApp-createuserApp-dropdbApp-droplangApp-dropuserApp-ecpgApp-pgconfigApp-pgdumpApp-pg-dumpallApp-pgrestoreApp-psqlApp-reindexdbApp-vacuumdbIII. PostgreSQL服务器应用程序App-initdbApp-pgcontroldataApp-pg-ctlApp-pgresetxlogApp-postgresApp-postmasterVII. 内部章44. PostgreSQL内部概览44.1. 查询路径44.2. 连接是如何建立起来的44.3. 分析器阶段44.4. ThePostgreSQL规则系统44.5. 规划器/优化器44.6. 执行器章45. 系统表45.1. 概述45.2. pg_aggregate45.3. pg_am45.4. pg_amop45.5. pg_amproc45.6. pg_attrdef45.7. pg_attribute45.8. pg_authid45.9. pg_auth_members45.10. pg_cast45.11. pg_class45.12. pg_constraint45.13. pg_conversion45.14. pg_database45.15. pg_db_role_setting45.16. pg_default_acl45.17. pg_depend45.18. pg_description45.19. pg_enum45.20. pg_foreign_data_wrapper45.21. pg_foreign_server45.22. pg_index45.23. pg_inherits45.24. pg_language45.25. pg_largeobject45.26. pg_largeobject_metadata45.27. pg_namespace45.28. pg_opclass45.29. pg_operator45.30. pg_opfamily45.31. pg_pltemplate45.32. pg_proc45.33. pg_rewrite45.34. pg_shdepend45.35. pg_shdescription45.36. pg_statistic45.37. pg_tablespace45.38. pg_trigger45.39. pg_ts_config45.40. pg_ts_config_map45.41. pg_ts_dict45.42. pg_ts_parser45.43. pg_ts_template45.44. pg_type45.45. pg_user_mapping45.46. System Views45.47. pg_cursors45.48. pg_group45.49. pg_indexes45.50. pg_locks45.51. pg_prepared_statements45.52. pg_prepared_xacts45.53. pg_roles45.54. pg_rules45.55. pg_settings45.56. pg_shadow45.57. pg_stats45.58. pg_tables45.59. pg_timezone_abbrevs45.60. pg_timezone_names45.61. pg_user45.62. pg_user_mappings45.63. pg_views章46. Frontend/Backend Protocol46.1. Overview46.2. Message Flow46.3. Streaming Replication Protocol46.4. Message Data Types46.5. Message Formats46.6. Error and Notice Message Fields46.7. Summary of Changes since Protocol 2.047. PostgreSQL Coding Conventions47.1. Formatting47.2. Reporting Errors Within the Server47.3. Error Message Style Guide章48. Native Language Support48.1. For the Translator48.2. For the Programmer章49. Writing A Procedural Language Handler章50. Genetic Query Optimizer50.1. Query Handling as a Complex Optimization Problem50.2. Genetic Algorithms50.3. Genetic Query Optimization (GEQO) in PostgreSQL50.4. Further Reading章51. 索引访问方法接口定义51.1. 索引的系统表记录51.2. 索引访问方法函数51.3. 索引扫描51.4. 索引锁的考量51.5. 索引唯一性检查51.6. 索引开销估计函数章52. GiST Indexes52.1. Introduction52.2. Extensibility52.3. Implementation52.4. Examples52.5. Crash Recovery章53. GIN Indexes53.1. Introduction53.2. Extensibility53.3. Implementation53.4. GIN tips and tricks53.5. Limitations53.6. Examples章54. 数据库物理存储54.1. 数据库文件布局54.2. TOAST54.3. 自由空间映射54.4. 可见映射54.5. 数据库分页文件章55. BKI后端接口55.1. BKI 文件格式55.2. BKI命令55.3. 系统初始化的BKI文件的结构55.4. 例子章56. 规划器如何使用统计信息56.1. 行预期的例子VIII. 附录A. PostgreSQL错误代码B. 日期/时间支持B.1. 日期/时间输入解析B.2. 日期/时间关键字B.3. 日期/时间配置文件B.4. 日期单位的历史C. SQL关键字D. SQL ConformanceD.1. Supported FeaturesD.2. Unsupported FeaturesE. Release NotesRelease-0-01Release-0-02Release-0-03Release-1-0Release-1-01Release-1-02Release-1-09Release-6-0Release-6-1Release-6-1-1Release-6-2Release-6-2-1Release-6-3Release-6-3-1Release-6-3-2Release-6-4Release-6-4-1Release-6-4-2Release-6-5Release-6-5-1Release-6-5-2Release-6-5-3Release-7-0Release-7-0-1Release-7-0-2Release-7-0-3Release-7-1Release-7-1-1Release-7-1-2Release-7-1-3Release-7-2Release-7-2-1Release-7-2-2Release-7-2-3Release-7-2-4Release-7-2-5Release-7-2-6Release-7-2-7Release-7-2-8Release-7-3Release-7-3-1Release-7-3-10Release-7-3-11Release-7-3-12Release-7-3-13Release-7-3-14Release-7-3-15Release-7-3-16Release-7-3-17Release-7-3-18Release-7-3-19Release-7-3-2Release-7-3-20Release-7-3-21Release-7-3-3Release-7-3-4Release-7-3-5Release-7-3-6Release-7-3-7Release-7-3-8Release-7-3-9Release-7-4Release-7-4-1Release-7-4-10Release-7-4-11Release-7-4-12Release-7-4-13Release-7-4-14Release-7-4-15Release-7-4-16Release-7-4-17Release-7-4-18Release-7-4-19Release-7-4-2Release-7-4-20Release-7-4-21Release-7-4-22Release-7-4-23Release-7-4-24Release-7-4-25Release-7-4-26Release-7-4-27Release-7-4-28Release-7-4-29Release-7-4-3Release-7-4-30Release-7-4-4Release-7-4-5Release-7-4-6Release-7-4-7Release-7-4-8Release-7-4-9Release-8-0Release-8-0-1Release-8-0-10Release-8-0-11Release-8-0-12Release-8-0-13Release-8-0-14Release-8-0-15Release-8-0-16Release-8-0-17Release-8-0-18Release-8-0-19Release-8-0-2Release-8-0-20Release-8-0-21Release-8-0-22Release-8-0-23Release-8-0-24Release-8-0-25Release-8-0-26Release-8-0-3Release-8-0-4Release-8-0-5Release-8-0-6Release-8-0-7Release-8-0-8Release-8-0-9Release-8-1Release-8-1-1Release-8-1-10Release-8-1-11Release-8-1-12Release-8-1-13Release-8-1-14Release-8-1-15Release-8-1-16Release-8-1-17Release-8-1-18Release-8-1-19Release-8-1-2Release-8-1-20Release-8-1-21Release-8-1-22Release-8-1-23Release-8-1-3Release-8-1-4Release-8-1-5Release-8-1-6Release-8-1-7Release-8-1-8Release-8-1-9Release-8-2Release-8-2-1Release-8-2-10Release-8-2-11Release-8-2-12Release-8-2-13Release-8-2-14Release-8-2-15Release-8-2-16Release-8-2-17Release-8-2-18Release-8-2-19Release-8-2-2Release-8-2-20Release-8-2-21Release-8-2-3Release-8-2-4Release-8-2-5Release-8-2-6Release-8-2-7Release-8-2-8Release-8-2-9Release-8-3Release-8-3-1Release-8-3-10Release-8-3-11Release-8-3-12Release-8-3-13Release-8-3-14Release-8-3-15Release-8-3-2Release-8-3-3Release-8-3-4Release-8-3-5Release-8-3-6Release-8-3-7Release-8-3-8Release-8-3-9Release-8-4Release-8-4-1Release-8-4-2Release-8-4-3Release-8-4-4Release-8-4-5Release-8-4-6Release-8-4-7Release-8-4-8Release-9-0Release-9-0-1Release-9-0-2Release-9-0-3Release-9-0-4F. 额外提供的模块F.1. adminpackF.2. auto_explainF.3. btree_ginF.4. btree_gistF.5. chkpassF.6. citextF.7. cubeF.8. dblinkContrib-dblink-connectContrib-dblink-connect-uContrib-dblink-disconnectContrib-dblinkContrib-dblink-execContrib-dblink-openContrib-dblink-fetchContrib-dblink-closeContrib-dblink-get-connectionsContrib-dblink-error-messageContrib-dblink-send-queryContrib-dblink-is-busyContrib-dblink-get-notifyContrib-dblink-get-resultContrib-dblink-cancel-queryContrib-dblink-get-pkeyContrib-dblink-build-sql-insertContrib-dblink-build-sql-deleteContrib-dblink-build-sql-updateF.9. dict_intF.10. dict_xsynF.11. earthdistanceF.12. fuzzystrmatchF.13. hstoreF.14. intaggF.15. intarrayF.16. isnF.17. loF.18. ltreeF.19. oid2nameF.20. pageinspectF.21. passwordcheckF.22. pg_archivecleanupF.23. pgbenchF.24. pg_buffercacheF.25. pgcryptoF.26. pg_freespacemapF.27. pgrowlocksF.28. pg_standbyF.29. pg_stat_statementsF.30. pgstattupleF.31. pg_trgmF.32. pg_upgradeF.33. segF.34. spiF.35. sslinfoF.36. tablefuncF.37. test_parserF.38. tsearch2F.39. unaccentF.40. uuid-osspF.41. vacuumloF.42. xml2G. 外部项目G.1. 客户端接口G.2. 过程语言G.3. 扩展H. The Source Code RepositoryH.1. Getting The Source Via GitI. 文档I.1. DocBookI.2. 工具集I.3. 制作文档I.4. 文档写作I.5. 风格指导J. 首字母缩略词参考书目BookindexIndex
文字

F.25. pgcrypto

The pgcrypto module provides cryptographic functions for PostgreSQL.

F.25.1. General hashing functions

F.25.1.1. digest()

digest(data text, type text) returns bytea
digest(data bytea, type text) returns bytea

Computes a binary hash of the given data. type is the algorithm to use. Standard algorithms are md5, sha1, sha224, sha256, sha384 and sha512. If pgcrypto was built with OpenSSL, more algorithms are available, as detailed in Table F-18.

If you want the digest as a hexadecimal string, use encode() on the result. For example:

CREATE OR REPLACE FUNCTION sha1(bytea) returns text AS $$
    SELECT encode(digest($1, 'sha1'), 'hex')
$$ LANGUAGE SQL STRICT IMMUTABLE;

F.25.1.2. hmac()

hmac(data text, key text, type text) returns bytea
hmac(data bytea, key text, type text) returns bytea

Calculates hashed MAC for data with key key. type is the same as in digest().

This is similar to digest() but the hash can only be recalculated knowing the key. This prevents the scenario of someone altering data and also changing the hash to match.

If the key is larger than the hash block size it will first be hashed and the result will be used as key.

F.25.2. Password hashing functions

The functions crypt() and gen_salt() are specifically designed for hashing passwords. crypt() does the hashing and gen_salt() prepares algorithm parameters for it.

The algorithms in crypt() differ from usual hashing algorithms like MD5 or SHA1 in the following respects:

  1. They are slow. As the amount of data is so small, this is the only way to make brute-forcing passwords hard.

  2. They use a random value, called the salt, so that users having the same password will have different encrypted passwords. This is also an additional defense against reversing the algorithm.

  3. They include the algorithm type in the result, so passwords hashed with different algorithms can co-exist.

  4. Some of them are adaptive — that means when computers get faster, you can tune the algorithm to be slower, without introducing incompatibility with existing passwords.

Table F-15 lists the algorithms supported by the crypt() function.

Table F-15. Supported algorithms for crypt()

Algorithm Max password length Adaptive? Salt bits Description
bf 72 yes 128 Blowfish-based, variant 2a
md5 unlimited no 48 MD5-based crypt
xdes 8 yes 24 Extended DES
des 8 no 12 Original UNIX crypt

F.25.2.1. crypt()

crypt(password text, salt text) returns text

Calculates a crypt(3)-style hash of password. When storing a new password, you need to use gen_salt() to generate a new salt value. To check a password, pass the stored hash value as salt, and test whether the result matches the stored value.

Example of setting a new password:

UPDATE ... SET pswhash = crypt('new password', gen_salt('md5'));

Example of authentication:

SELECT pswhash = crypt('entered password', pswhash) FROM ... ;

This returns true if the entered password is correct.

F.25.2.2. gen_salt()

gen_salt(type text [, iter_count integer ]) returns text

Generates a new random salt string for use in crypt(). The salt string also tells crypt() which algorithm to use.

The type parameter specifies the hashing algorithm. The accepted types are: des, xdes, md5 and bf.

The iter_count parameter lets the user specify the iteration count, for algorithms that have one. The higher the count, the more time it takes to hash the password and therefore the more time to break it. Although with too high a count the time to calculate a hash may be several years — which is somewhat impractical. If the iter_count parameter is omitted, the default iteration count is used. Allowed values for iter_count depend on the algorithm and are shown in Table F-16.

Table F-16. Iteration counts for crypt()

Algorithm Default Min Max
xdes 725 1 16777215
bf 6 4 31

For xdes there is an additional limitation that the iteration count must be an odd number.

To pick an appropriate iteration count, consider that the original DES crypt was designed to have the speed of 4 hashes per second on the hardware of that time. Slower than 4 hashes per second would probably dampen usability. Faster than 100 hashes per second is probably too fast.

Table F-17 gives an overview of the relative slowness of different hashing algorithms. The table shows how much time it would take to try all combinations of characters in an 8-character password, assuming that the password contains either only lower case letters, or upper- and lower-case letters and numbers. In the crypt-bf entries, the number after a slash is the iter_count parameter of gen_salt.

Table F-17. Hash algorithm speeds

Algorithm Hashes/sec For [a-z] For [A-Za-z0-9]
crypt-bf/8 28 246 years 251322 years
crypt-bf/7 57 121 years 123457 years
crypt-bf/6 112 62 years 62831 years
crypt-bf/5 211 33 years 33351 years
crypt-md5 2681 2.6 years 2625 years
crypt-des 362837 7 days 19 years
sha1 590223 4 days 12 years
md5 2345086 1 day 3 years

Notes:

  • The machine used is a 1.5GHz Pentium 4.

  • crypt-des and crypt-md5 algorithm numbers are taken from John the Ripper v1.6.38 -test output.

  • md5 numbers are from mdcrack 1.2.

  • sha1 numbers are from lcrack-20031130-beta.

  • crypt-bf numbers are taken using a simple program that loops over 1000 8-character passwords. That way I can show the speed with different numbers of iterations. For reference: john -test shows 213 loops/sec for crypt-bf/5. (The very small difference in results is in accordance with the fact that the crypt-bf implementation in pgcrypto is the same one used in John the Ripper.)

Note that "try all combinations" is not a realistic exercise. Usually password cracking is done with the help of dictionaries, which contain both regular words and various mutations of them. So, even somewhat word-like passwords could be cracked much faster than the above numbers suggest, while a 6-character non-word-like password may escape cracking. Or not.

F.25.3. PGP encryption functions

The functions here implement the encryption part of the OpenPGP (RFC 4880) standard. Supported are both symmetric-key and public-key encryption.

An encrypted PGP message consists of 2 parts, or packets:

  • Packet containing a session key — either symmetric-key or public-key encrypted.

  • Packet containing data encrypted with the session key.

When encrypting with a symmetric key (i.e., a password):

  1. The given password is hashed using a String2Key (S2K) algorithm. This is rather similar to crypt() algorithms — purposefully slow and with random salt — but it produces a full-length binary key.

  2. If a separate session key is requested, a new random key will be generated. Otherwise the S2K key will be used directly as the session key.

  3. If the S2K key is to be used directly, then only S2K settings will be put into the session key packet. Otherwise the session key will be encrypted with the S2K key and put into the session key packet.

When encrypting with a public key:

  1. A new random session key is generated.

  2. It is encrypted using the public key and put into the session key packet.

In either case the data to be encrypted is processed as follows:

  1. Optional data-manipulation: compression, conversion to UTF-8, and/or conversion of line-endings.

  2. The data is prefixed with a block of random bytes. This is equivalent to using a random IV.

  3. An SHA1 hash of the random prefix and data is appended.

  4. All this is encrypted with the session key and placed in the data packet.

F.25.3.1. pgp_sym_encrypt()

pgp_sym_encrypt(data text, psw text [, options text ]) returns bytea
pgp_sym_encrypt_bytea(data bytea, psw text [, options text ]) returns bytea

Encrypt data with a symmetric PGP key psw. The options parameter can contain option settings, as described below.

F.25.3.2. pgp_sym_decrypt()

pgp_sym_decrypt(msg bytea, psw text [, options text ]) returns text
pgp_sym_decrypt_bytea(msg bytea, psw text [, options text ]) returns bytea

Decrypt a symmetric-key-encrypted PGP message.

Decrypting bytea data with pgp_sym_decrypt is disallowed. This is to avoid outputting invalid character data. Decrypting originally textual data with pgp_sym_decrypt_bytea is fine.

The options parameter can contain option settings, as described below.

F.25.3.3. pgp_pub_encrypt()

pgp_pub_encrypt(data text, key bytea [, options text ]) returns bytea
pgp_pub_encrypt_bytea(data bytea, key bytea [, options text ]) returns bytea

Encrypt data with a public PGP key key. Giving this function a secret key will produce a error.

The options parameter can contain option settings, as described below.

F.25.3.4. pgp_pub_decrypt()

pgp_pub_decrypt(msg bytea, key bytea [, psw text [, options text ]]) returns text
pgp_pub_decrypt_bytea(msg bytea, key bytea [, psw text [, options text ]]) returns bytea

Decrypt a public-key-encrypted message. key must be the secret key corresponding to the public key that was used to encrypt. If the secret key is password-protected, you must give the password in psw. If there is no password, but you want to specify options, you need to give an empty password.

Decrypting bytea data with pgp_pub_decrypt is disallowed. This is to avoid outputting invalid character data. Decrypting originally textual data with pgp_pub_decrypt_bytea is fine.

The options parameter can contain option settings, as described below.

F.25.3.5. pgp_key_id()

pgp_key_id(bytea) returns text

pgp_key_id extracts the key ID of a PGP public or secret key. Or it gives the key ID that was used for encrypting the data, if given an encrypted message.

It can return 2 special key IDs:

  • SYMKEY

    The message is encrypted with a symmetric key.

  • ANYKEY

    The message is public-key encrypted, but the key ID has been removed. That means you will need to try all your secret keys on it to see which one decrypts it. pgcrypto itself does not produce such messages.

Note that different keys may have the same ID. This is rare but a normal event. The client application should then try to decrypt with each one, to see which fits — like handling ANYKEY.

F.25.3.6. armor(), dearmor()

armor(data bytea) returns text
dearmor(data text) returns bytea

These functions wrap/unwrap binary data into PGP ASCII-armor format, which is basically Base64 with CRC and additional formatting.

F.25.3.7. Options for PGP functions

Options are named to be similar to GnuPG. An option's value should be given after an equal sign; separate options from each other with commas. For example:

pgp_sym_encrypt(data, psw, 'compress-algo=1, cipher-algo=aes256')

All of the options except convert-crlf apply only to encrypt functions. Decrypt functions get the parameters from the PGP data.

The most interesting options are probably compress-algo and unicode-mode. The rest should have reasonable defaults.

F.25.3.7.1. cipher-algo

Which cipher algorithm to use.

Values: bf, aes128, aes192, aes256 (OpenSSL-only: 3descast5)
Default: aes128
Applies to: pgp_sym_encrypt, pgp_pub_encrypt

F.25.3.7.2. compress-algo

Which compression algorithm to use. Only available if PostgreSQL was built with zlib.

Values:
  0 - no compression
  1 - ZIP compression
  2 - ZLIB compression (= ZIP plus meta-data and block CRCs)
Default: 0
Applies to: pgp_sym_encrypt, pgp_pub_encrypt

F.25.3.7.3. compress-level

How much to compress. Higher levels compress smaller but are slower. 0 disables compression.

Values: 0, 1-9
Default: 6
Applies to: pgp_sym_encrypt, pgp_pub_encrypt

F.25.3.7.4. convert-crlf

Whether to convert \n into \r\n when encrypting and \r\n to \n when decrypting. RFC 4880 specifies that text data should be stored using \r\n line-feeds. Use this to get fully RFC-compliant behavior.

Values: 0, 1
Default: 0
Applies to: pgp_sym_encrypt, pgp_pub_encrypt, pgp_sym_decrypt, pgp_pub_decrypt

F.25.3.7.5. disable-mdc

Do not protect data with SHA-1. The only good reason to use this option is to achieve compatibility with ancient PGP products, predating the addition of SHA-1 protected packets to RFC 4880. Recent gnupg.org and pgp.com software supports it fine.

Values: 0, 1
Default: 0
Applies to: pgp_sym_encrypt, pgp_pub_encrypt

F.25.3.7.6. enable-session-key

Use separate session key. Public-key encryption always uses a separate session key; this is for symmetric-key encryption, which by default uses the S2K key directly.

Values: 0, 1
Default: 0
Applies to: pgp_sym_encrypt

F.25.3.7.7. s2k-mode

Which S2K algorithm to use.

Values:
  0 - Without salt.  Dangerous!
  1 - With salt but with fixed iteration count.
  3 - Variable iteration count.
Default: 3
Applies to: pgp_sym_encrypt

F.25.3.7.8. s2k-digest-algo

Which digest algorithm to use in S2K calculation.

Values: md5, sha1
Default: sha1
Applies to: pgp_sym_encrypt

F.25.3.7.9. s2k-cipher-algo

Which cipher to use for encrypting separate session key.

Values: bf, aes, aes128, aes192, aes256
Default: use cipher-algo
Applies to: pgp_sym_encrypt

F.25.3.7.10. unicode-mode

Whether to convert textual data from database internal encoding to UTF-8 and back. If your database already is UTF-8, no conversion will be done, but the message will be tagged as UTF-8. Without this option it will not be.

Values: 0, 1
Default: 0
Applies to: pgp_sym_encrypt, pgp_pub_encrypt

F.25.3.8. Generating PGP keys with GnuPG

To generate a new key:

gpg --gen-key

The preferred key type is "DSA and Elgamal".

For RSA encryption you must create either DSA or RSA sign-only key as master and then add an RSA encryption subkey with gpg --edit-key.

To list keys:

gpg --list-secret-keys

To export a public key in ASCII-armor format:

gpg -a --export KEYID > public.key

To export a secret key in ASCII-armor format:

gpg -a --export-secret-keys KEYID > secret.key

You need to use dearmor() on these keys before giving them to the PGP functions. Or if you can handle binary data, you can drop -a from the command.

For more details see man gpg, The GNU Privacy Handbook and other documentation on http://www.gnupg.org.

F.25.3.9. Limitations of PGP code

  • No support for signing. That also means that it is not checked whether the encryption subkey belongs to the master key.

  • No support for encryption key as master key. As such practice is generally discouraged, this should not be a problem.

  • No support for several subkeys. This may seem like a problem, as this is common practice. On the other hand, you should not use your regular GPG/PGP keys with pgcrypto, but create new ones, as the usage scenario is rather different.

F.25.4. Raw encryption functions

These functions only run a cipher over data; they don't have any advanced features of PGP encryption. Therefore they have some major problems:

  1. They use user key directly as cipher key.

  2. They don't provide any integrity checking, to see if the encrypted data was modified.

  3. They expect that users manage all encryption parameters themselves, even IV.

  4. They don't handle text.

So, with the introduction of PGP encryption, usage of raw encryption functions is discouraged.

encrypt(data bytea, key bytea, type text) returns bytea
decrypt(data bytea, key bytea, type text) returns bytea

encrypt_iv(data bytea, key bytea, iv bytea, type text) returns bytea
decrypt_iv(data bytea, key bytea, iv bytea, type text) returns bytea

Encrypt/decrypt data using the cipher method specified by type. The syntax of the type string is:

algorithm [ - mode ] [ /pad: padding ]

where algorithm is one of:

  • bf — Blowfish

  • aes — AES (Rijndael-128)

and mode is one of:

  • cbc — next block depends on previous (default)

  • ecb — each block is encrypted separately (for testing only)

and padding is one of:

  • pkcs — data may be any length (default)

  • none — data must be multiple of cipher block size

So, for example, these are equivalent:

encrypt(data, 'fooz', 'bf')
encrypt(data, 'fooz', 'bf-cbc/pad:pkcs')

In encrypt_iv and decrypt_iv, the iv parameter is the initial value for the CBC mode; it is ignored for ECB. It is clipped or padded with zeroes if not exactly block size. It defaults to all zeroes in the functions without this parameter.

F.25.5. Random-data functions

gen_random_bytes(count integer) returns bytea

Returns count cryptographically strong random bytes. At most 1024 bytes can be extracted at a time. This is to avoid draining the randomness generator pool.

F.25.6. Notes

F.25.6.1. Configuration

pgcrypto configures itself according to the findings of the main PostgreSQL configure script. The options that affect it are --with-zlib and --with-openssl.

When compiled with zlib, PGP encryption functions are able to compress data before encrypting.

When compiled with OpenSSL, there will be more algorithms available. Also public-key encryption functions will be faster as OpenSSL has more optimized BIGNUM functions.

Table F-18. Summary of functionality with and without OpenSSL

Functionality Built-in With OpenSSL
MD5 yes yes
SHA1 yes yes
SHA224/256/384/512 yes yes (Note 1)
Other digest algorithms no yes (Note 2)
Blowfish yes yes
AES yes yes (Note 3)
DES/3DES/CAST5 no yes
Raw encryption yes yes
PGP Symmetric encryption yes yes
PGP Public-Key encryption yes yes

Notes:

  1. SHA2 algorithms were added to OpenSSL in version 0.9.8. For older versions, pgcrypto will use built-in code.

  2. Any digest algorithm OpenSSL supports is automatically picked up. This is not possible with ciphers, which need to be supported explicitly.

  3. AES is included in OpenSSL since version 0.9.7. For older versions, pgcrypto will use built-in code.

F.25.6.2. NULL handling

As is standard in SQL, all functions return NULL, if any of the arguments are NULL. This may create security risks on careless usage.

F.25.6.3. Security limitations

All pgcrypto functions run inside the database server. That means that all the data and passwords move between pgcrypto and client applications in clear text. Thus you must:

  1. Connect locally or use SSL connections.

  2. Trust both system and database administrator.

If you cannot, then better do crypto inside client application.

F.25.6.4. Useful reading

  • http://www.gnupg.org/gph/en/manual.html

    The GNU Privacy Handbook.

  • http://www.openwall.com/crypt/

    Describes the crypt-blowfish algorithm.

  • http://www.stack.nl/~galactus/remailers/passphrase-faq.html

    How to choose a good password.

  • http://world.std.com/~reinhold/diceware.html

    Interesting idea for picking passwords.

  • http://www.interhack.net/people/cmcurtin/snake-oil-faq.html

    Describes good and bad cryptography.

F.25.6.5. Technical references

  • http://www.ietf.org/rfc/rfc4880.txt

    OpenPGP message format.

  • http://www.ietf.org/rfc/rfc1321.txt

    The MD5 Message-Digest Algorithm.

  • http://www.ietf.org/rfc/rfc2104.txt

    HMAC: Keyed-Hashing for Message Authentication.

  • http://www.usenix.org/events/usenix99/provos.html

    Comparison of crypt-des, crypt-md5 and bcrypt algorithms.

  • http://csrc.nist.gov/cryptval/des.htm

    Standards for DES, 3DES and AES.

  • http://en.wikipedia.org/wiki/Fortuna_(PRNG)

    Description of Fortuna CSPRNG.

  • http://jlcooke.ca/random/

    Jean-Luc Cooke Fortuna-based /dev/random driver for Linux.

  • http://research.cyber.ee/~lipmaa/crypto/

    Collection of cryptology pointers.

F.25.7. Author

Marko Kreen

pgcrypto uses code from the following sources:

Algorithm Author Source origin
DES crypt David Burren and others FreeBSD libcrypt
MD5 crypt Poul-Henning Kamp FreeBSD libcrypt
Blowfish crypt Solar Designer www.openwall.com
Blowfish cipher Simon Tatham PuTTY
Rijndael cipher Brian Gladman OpenBSD sys/crypto
MD5 and SHA1 WIDE Project KAME kame/sys/crypto
SHA256/384/512 Aaron D. Gifford OpenBSD sys/crypto
BIGNUM math Michael J. Fromberger dartmouth.edu/~sting/sw/imath

上一篇:下一篇: