From: Nagy László Zsolt <gandalf@shopzeus.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-admin@postgresql.org
Subject: Re: md5 auth procotol - can it be replayed?
Date: Sat, 7 May 2016 19:53:07 +0200
Message-ID: <572E2B83.10908@shopzeus.com> (raw)
In-Reply-To: <23281.1462638517@sss.pgh.pa.us>
References: <572E0BFE.7040709@shopzeus.com>
<20160507155124.GP10850@tamriel.snowman.net>
<23281.1462638517@sss.pgh.pa.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
>> There is a challenge/response compoent, so the md5 hash which is stored
>> is not what is sent across the wire. That prevents replay attacks when
>> the attacker is simply sniffing the network.
> Worth noting here is that the challenge key space is not all that huge,
> so an attacker who captures a large number of challenge/response pairs
> would have a good probability of being able to answer the next challenge
> successfully. However, if you're concerned about sniffing of your
> database connections happening on that scale, you really ought to be using
> SSL encryption which would make the whole thing moot. In many cases,
> capturing a database session would reveal lots of interesting data passing
> over the wire whether or not you'd captured a usable password --- so I'd
> call it fairly irresponsible to not be using SSL if you think your
> connection is open to sniffing.
Thank you for your responses, this is exactly what I was looking for.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: gandalf@shopzeus.com, tgl@sss.pgh.pa.us, sfrost@snowman.net
Subject: Re: md5 auth procotol - can it be replayed?
In-Reply-To: <572E2B83.10908@shopzeus.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox