<entry>yes</entry>
      <entry>up to 32</entry>
      <entry>80</entry>
      <entry>Adapted from publicly available reference implementation
       <ulink url="https://www.akkadia.org/drepper/SHA-crypt.txt">Unix crypt using SHA-256 and SHA-512
       </ulink>
      </entry>
     </row>
     <row>
      <entry><literal>sha512crypt</literal></entry>
      <entry>unlimited</entry>
      <entry>yes</entry>
      <entry>up to 32</entry>
      <entry>123</entry>
      <entry>Adapted from publicly available reference implementation
       <ulink url="https://www.akkadia.org/drepper/SHA-crypt.txt">Unix crypt using SHA-256 and SHA-512
       </ulink>
      </entry>
     </row>

    </tbody>
   </tgroup>
  </table>

  <sect3 id="pgcrypto-password-hashing-funcs-crypt">
   <title><function>crypt()</function></title>

   <indexterm>
    <primary>crypt</primary>
   </indexterm>

<synopsis>
crypt(password text, salt text) returns text
</synopsis>

   <para>
    Calculates a crypt(3)-style hash of <parameter>password</parameter>.
    When storing a new password, you need to use
    <function>gen_salt()</function> to generate a new <parameter>salt</parameter> value.
    To check a password, pass the stored hash value as <parameter>salt</parameter>,
    and test whether the result matches the stored value.
   </para>
   <para>
    Example of setting a new password:
<programlisting>
UPDATE ... SET pswhash = crypt('new password', gen_salt('md5'));
</programlisting>
   </para>
   <para>
    Example of authentication:
<programlisting>
SELECT (pswhash = crypt('entered password', pswhash)) AS pswmatch FROM ... ;
</programlisting>
    This returns <literal>true</literal> if the entered password is correct.
   </para>
  </sect3>

  <sect3 id="pgcrypto-password-hashing-funcs-gen-salt">
   <title><function>gen_salt()</function></title>

  <indexterm>
   <primary>gen_salt</primary>
  </indexterm>

<synopsis>
gen_salt(type text [, iter_count integer ]) returns text
</synopsis>

   <para>
    Generates a new random salt string for use in <function>crypt()</function>.
    The salt string also tells <function>crypt()</function> which algorithm to use.
   </para>

   <para>
    The <parameter>type</parameter> parameter specifies the hashing algorithm.
    The accepted types are: <literal>des</literal>, <literal>xdes</literal>,
    <literal>md5</literal>, <literal>bf</literal>, <literal>sha256crypt</literal> and
    <literal>sha512crypt</literal>. The last two, <literal>sha256crypt</literal> and
    <literal>sha512crypt</literal> are modern <literal>SHA-2</literal> based password hashes.
   </para>

   <para>
    The <parameter>iter_count</parameter> parameter lets the user specify the iteration
    count, for algorithms that have one.
    The higher the count, the more time it takes to hash
    the password and therefore the more time to break it.  Although with
    too high a count the time to calculate a hash may be several years
    &mdash; which is somewhat impractical.  If the <parameter>iter_count</parameter>
    parameter is omitted, the default iteration count is used.
    Allowed values for <parameter>iter_count</parameter> depend on the algorithm and
    are shown in <xref linkend="pgcrypto-icfc-table"/>.
   </para>

   <table id="pgcrypto-icfc-table">
    <title>Iteration Counts for <function>crypt()</function></title>
    <tgroup cols="4">
     <thead>
      <row>
       <entry>Algorithm</entry>
       <entry>Default</entry>
       <entry>Min</entry>
       <entry>Max</entry>
      </row>
     </thead>
     <tbody>
      <row>
       <entry><literal>xdes</literal></entry>
       <entry>725</entry>
       <entry>1</entry>
       <entry>16777215</entry>
      </row>
      <row>
       <entry><literal>bf</literal></entry>
       <entry>6</entry>
       <entry>4</entry>
       <entry>31</entry>
      </row>
      <row>
       <entry><literal>sha256crypt, sha512crypt</literal></entry>
       <entry>5000</entry>
       <entry>1000</entry>
       <entry>999999999</entry>