From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Nagy László Zsolt <gandalf@shopzeus.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: md5 auth procotol - can it be replayed?
Date: Sat, 07 May 2016 12:28:37 -0400
Message-ID: <23281.1462638517@sss.pgh.pa.us> (raw)
In-Reply-To: <20160507155124.GP10850@tamriel.snowman.net>
References: <572E0BFE.7040709@shopzeus.com>
<20160507155124.GP10850@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Stephen Frost <sfrost@snowman.net> writes:
> * Nagy László Zsolt (gandalf@shopzeus.com) wrote:
>> Am I missing something?
> There is a challenge/response compoent, so the md5 hash which is stored
> is not what is sent across the wire. That prevents replay attacks when
> the attacker is simply sniffing the network.
Worth noting here is that the challenge key space is not all that huge,
so an attacker who captures a large number of challenge/response pairs
would have a good probability of being able to answer the next challenge
successfully. However, if you're concerned about sniffing of your
database connections happening on that scale, you really ought to be using
SSL encryption which would make the whole thing moot. In many cases,
capturing a database session would reveal lots of interesting data passing
over the wire whether or not you'd captured a usable password --- so I'd
call it fairly irresponsible to not be using SSL if you think your
connection is open to sniffing.
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, gandalf@shopzeus.com
Subject: Re: md5 auth procotol - can it be replayed?
In-Reply-To: <23281.1462638517@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox