Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1hIkET-0007UT-I2
	for pgsql-bugs@arkaria.postgresql.org; Tue, 23 Apr 2019 01:28:25 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.89)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1hIkER-0001Rn-Ve
	for pgsql-bugs@arkaria.postgresql.org; Tue, 23 Apr 2019 01:28:23 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1hIkER-0001Rg-NV
	for pgsql-bugs@lists.postgresql.org; Tue, 23 Apr 2019 01:28:23 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1hIkEP-0004cH-JA
	for pgsql-bugs@lists.postgresql.org; Tue, 23 Apr 2019 01:28:23 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id x3N1SJZT011305;
	Mon, 22 Apr 2019 21:28:19 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Jonathan S. Katz" <jkatz@postgresql.org>
cc: Michael Paquier <michael@paquier.xyz>, pgsql-bugs@lists.postgresql.org,
        Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-reply-to: <9ce16763-836c-041e-06aa-af3e955444cd@postgresql.org>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
 <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
 <20190422015051.GA3433@paquier.xyz> <3033.1555940554@sss.pgh.pa.us>
 <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
 <30284.1555972921@sss.pgh.pa.us>
 <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org>
 <20190423010142.GE2712@paquier.xyz>
 <9ce16763-836c-041e-06aa-af3e955444cd@postgresql.org>
Comments: In-reply-to "Jonathan S. Katz" <jkatz@postgresql.org>
	message dated "Mon, 22 Apr 2019 21:26:01 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11303.1555982899.1@sss.pgh.pa.us>
Date: Mon, 22 Apr 2019 21:28:19 -0400
Message-ID: <11304.1555982899@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Precedence: bulk

"Jonathan S. Katz" <jkatz@postgresql.org> writes:
> I did purposely keep the SCRAM + MD5 changes as separate patches as I
> felt they were both atomic, but I have no strong opinions on that.

FWIW, it looks like one patch to me: tighten our checks on whether
supposedly-encoded passwords fit the encoding rules.

			regards, tom lane