Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIiUh-0002nw-UX for pgsql-bugs@arkaria.postgresql.org; Mon, 22 Apr 2019 23:37:04 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hIiUf-00035y-VC for pgsql-bugs@arkaria.postgresql.org; Mon, 22 Apr 2019 23:37:01 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIiUf-00035q-GN for pgsql-bugs@lists.postgresql.org; Mon, 22 Apr 2019 23:37:01 +0000 Received: from meldrar.postgresql.org ([2a02:c0:301:0:ffff::31]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIiUZ-0001zK-7B for pgsql-bugs@lists.postgresql.org; Mon, 22 Apr 2019 23:37:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Content-Type:In-Reply-To:MIME-Version:Date: Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=t41s5xuLqI7LKtSCPdkZ+MfsAkzZGLAuwv0aAnqMJQU=; b=kby1xQNARBgg6gG8X23AUlYti7 FmTYjMaekdbcFqCH5Nd+3UVhkqvwSXoz/AI7fmUZ33ZItVjP3mMr2YRgdkoR5SuDXGXrCR9MdA+OP Xz1h6DTpAz98OLBQOSe1atU4pG3UZCzJ8cC0u2jmUCk2peVJdAxrfUkpxWZJDdgbnluDo2pvkVkt+ aiFvLdNTFKqHVZWanC0gzElvjrD2KHcSdYxGQKN+D3j0oDjIr40EAh/TfDsMxGhbuKDTYIxbHTfdg eOF0l3Zq6ts/1iJgUZOpf37eBVkkxmT1+x2wWNumkdy29svRS+DuhrCd3s3noyIbHHUb39aJNDiJS vmVb1DFQ==; Received: from pool-96-250-83-19.nycmny.fios.verizon.net ([96.250.83.19] helo=Ph33r-Retina.home) by meldrar.postgresql.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIiUU-0001AM-AC; Mon, 22 Apr 2019 23:36:53 +0000 Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords To: Tom Lane Cc: Michael Paquier , pgsql-bugs@lists.postgresql.org, Stephen Frost References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org> <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org> <20190422015051.GA3433@paquier.xyz> <3033.1555940554@sss.pgh.pa.us> <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org> <30284.1555972921@sss.pgh.pa.us> From: "Jonathan S. Katz" Openpgp: preference=signencrypt Autocrypt: addr=jkatz@postgresql.org; keydata= mQINBFtShwABEAC7PNHDUOTYuifpUCk23KqfxdQQkn4nkoxOXRK0+rAj36FiwqGB4TJFuOVZ sDFAEiSlC8Jt4y5Cs7B5tetT8JNd2cs6zp/udMJJDz9d65O9PDpdlMgAmIiTzpLlSdx8FG56 DTksaDv1d8j3cTJPSE4/fWSxqzA7o3Y9UuL7atZPrzfImgpRKs0of7elIHwOa8GucjyhYqcR h60wFBJc2KXqQdDYRTZy43DSnY/0VNc0omiH355fustvpm+m5HjD3w7qZyfN3fpKJpnX1LCF f3MnPHaDGITIYGRCBXvf0UqUtD6OEVWPv2C2gyqWMIpWmZTOgDufltKyIByKBoS9x0PlFkij 04X3KODCngt+N8Ssc9OICc6QSxhjoP48PYPdmiTmkrGuf0LX084wj1xeo1NX7XxZK39F6dTJ DhsIiW0sNS0xMxQHLHG9VLbPjx3SANQBh6BuryPz5ZupW9/TIDmkvprtU/oXfKgtfYm3fxmk EctxbWrEPsFTFPyuMqQu6l+xyQv0s1VLZfjNWaua6H1/gGoIt6kRnn5qMXDVVpijuWkHbv7G ngaQMd258UrrOEHnnjzhQ7jxMWV9D+emxbAtlIxnYvCWlV4IwAQhEHfvudqYaIY3hNWrvQ6H GB2KXoTZYN9g5djm14/5nj1IU5zOcovkjJnKhoo9iStnpFF2cwARAQABtCdKb25hdGhhbiBT LiBLYXR6IDxqa2F0ekBwb3N0Z3Jlc3FsLm9yZz6JAlQEEwEIAD4CGwMFCQeGH4AFCwkIBwIG FQoJCAsCBBYCAwECHgECF4AWIQT6hLaVryv3miBkP/HxBJxynxxlJwUCW1KJJQAKCRDxBJxy nxxlJwjrD/kBgqsW4QpNpTFw7ifRokZV08CCX4huPBJQ91rrv+UEWlEcotFBHVkYyHnpzARl tcZxhJ9CbFxjniH9cOTty5T/O1yolbOHtZSW8Z8aWV6BVEbjMb+BFxSSLm7RnvJdzQbGCZq2 ZZvfVpB6z3EHYph4KDdVKvMFjoLskxmdS1DE0tE3zTxvoQsi24Q+HOS07kUjs6fsu/WICMfz mgO++AWG9Y0CvN0mm4TkujESzyKM9E5irD+leEMIcddl51Aa2c/VMfBXQbRmpHIgUFTmuHQD CnQih+9i3OJAksDg66SP8a7yiXv5mwvyDi1EfTGVKYR2j+pwyjwnC3oIbvDMmB3uTn2JIjnT iZKPVtAcAylXjubFltihQgNyuShdP4W+kBwZizhUFqUVL8Anx+KoytYmJPfMRFLGuK4obXKq a2ZS3k9KB+H+isOx2nFJOsc7V360Zp1DVaNmuiK10TT6QndShSPaqkJqFtCb6r92rZ9sZM/L 3vtCI4Rrl3Pt1MgtENXupS8gZpJnAYS0j5A1PAZ09r6ANoaeMHspF+5J5fOHeEvqphXr36mm a83Vl1t4orPb0+QmmijmlpseDU63M88Aw5p3c4qj7t8Qr2EZ5zrn7/sFn5wOfbs8Nymxafif QCnlV2vg9p0m7vSk/yLJ4PFZvs52FgqAGRCdRn0s2EC99bkCDQRbUocAARAAv8ho/toQ9DG3 j4f9h9n1aRHr2FlviN2Utpy6L8+dfDggO0geilmkGQOolZ2E60gGfye/kUtF9W3NByO4hxDR 9u6qbOXcdqnuA+cc68EfqlWFJrVtYFxt0h4ElWYOYnIezKthriWch/FY70FGrxs3z8UHOHq5 0wBW433eTvZm90WixBiXEt2v1DgW4Vr3ymfO7Aap/IYyPuE4JzgudAuAl0HKPyNEHWHG1dAb jX1RiCw9gknIDWQOF0B4UAaJctWGVcnZ3A2ULwNGMa1P9ZJlBWf1vcj01aiHMU0yQ7JjJiSp vfm9eM0uSLwRdDrJjyl5ZZqVumjdv2SMNQ8GvYRbEMys3GGDSt9zXgfCSUnPnJfYxjzBHRI6 x44Wfsx8S6hWxepOogCJJ/g67Bk9mY8YV4klWIXDJVOL5jnBC09DbsZG81JaE2QxB8Y7W36Z Mroi9XMxg3s805hQAQUvdG/poU8hN8BWdrnTm/+4eQQp7gDY1ePDmGM6bJC+OHOSnFtR/f+7 0zpKJ10cc7cBygGnl1yR3KjhFyAWUFvP4ZGziKCcpMwXZfe9PGuyA/YOubMphxIn3YsK2wrd faKZYX2GMZCZhMMcvx9IpQrxIJgU+VlwXu/O+Lk10VIPcxPJJwmpdI6HzcS8ZgG6IMcC444X XTuLaP8j2mgcMvYak3ScCykAEQEAAYkCPAQYAQgAJhYhBPqEtpWvK/eaIGQ/8fEEnHKfHGUn BQJbUocAAhsMBQkHhh+AAAoJEPEEnHKfHGUnReMP/RA2UhGQj+G4uBshkRLjpRysabdPqgQB dEBk6wYbio88Wg/2/hgY7UzmDDEwX3sZfQDcrI6+vIobI8uqstZID+WgAAa1JLfChMyVQnSy 0zfWMOABXscc5tGuvFRZvJklTissMFjXUwaREEKp4ZikTvJ/62MCjSdtrUhnPLvoTsHTKRKD ichE+b5A54alwsubTijw12O6N22r5IjZiiSZV0u7dsShyKw+7wCSax9fuBoE43NMYf+dnjMK nerAQYUcZWYMnk+EC8RaqYAxv6XZ2tKx1AkGGktwkQIBwrz9IlDSvJ3LWJ2UIIuLRTdngNgg GIL4zzuUa2F56FqskQIuYMaNETk6LYfalBDQ6TVLAcgCPQxp4k4i/PRsZ3lZ2ZhRHRYciOvm kp+I6EfHwllQpYrWs1thluBGqlJSVJgKl0IOFvKLsQ6KKfqzAwh6FxrO5qajp4viNIgtWoFw O5Bp0jgFTbH2OrMWIRfUdUCH1Djbuo65svhNj7FNsQVYzHDI+Nd1I/LOBoPc3UorRMF2M4JV kUR7skOHWUbPTSNUr7qc14NSMY3PKjGeVGAsBVHBPvmRx/Ss2tW/TpJWpxg4pmquFQSXuaYh Yf4FN8Sxy320pcr+FqN8AhZkYJcNY82OTtR5VEKRC/mYcyq61qXIKqngydn79bJjGxHipxyF FmEC Message-ID: <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org> Date: Mon, 22 Apr 2019 19:36:45 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <30284.1555972921@sss.pgh.pa.us> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="TGIyaHEWnnDNMyc5Xf6HLwO396HCJocfc" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --TGIyaHEWnnDNMyc5Xf6HLwO396HCJocfc Content-Type: multipart/mixed; boundary="3oGiDrJSh9tMj4SV2uPEEn125uU0bUGpc"; protected-headers="v1" From: "Jonathan S. Katz" To: Tom Lane Cc: Michael Paquier , pgsql-bugs@lists.postgresql.org, Stephen Frost Message-ID: <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org> Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org> <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org> <20190422015051.GA3433@paquier.xyz> <3033.1555940554@sss.pgh.pa.us> <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org> <30284.1555972921@sss.pgh.pa.us> In-Reply-To: <30284.1555972921@sss.pgh.pa.us> --3oGiDrJSh9tMj4SV2uPEEn125uU0bUGpc Content-Type: multipart/mixed; boundary="------------7F84F35565C3435A179CD20D" Content-Language: en-US This is a multi-part message in MIME format. --------------7F84F35565C3435A179CD20D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 4/22/19 6:42 PM, Tom Lane wrote: > "Jonathan S. Katz" writes: >> OK, so I have something that sort of works, i.e: >=20 >> if (strncmp(shadow_pass, "md5", 3) =3D=3D 0 && >> strlen(shadow_pass) =3D=3D MD5_PASSWD_LEN && >> strspn(shadow_pass, MD5_PASSWD_CHARSET) =3D=3D MD5_PASSWD_LEN >> ) >=20 >> where MD5_PASSWD_CHARSET =3D "mabcdef0123456789" >=20 >> ...but you may notice something: the CHARSET contains an "m" as we sto= re >> that "md5" prefix on the md5 hashed passwords. >=20 > Yeah, that's silly; why not >=20 > strspn(shadow_pass + 3, MD5_PASSWD_CHARSET) =3D=3D MD5_PASSWD_LEN = - 3 >=20 > It's not like this code isn't very well aware of the first 3 characters= > being not like the others. I like that :) Please see attached patch, which is diff'd from the one upthread. I tested using the following: /* Log in with "abc" */ CREATE ROLE test1 PASSWORD 'md5cdde562ece166a02f5392b656dcf2502' LOGIN; /* Logs in with "md5cdde562ece166a02f5392b656dcf250g" */ CREATE ROLE test2 PASSWORD 'md5cdde562ece166a02f5392b656dcf250g' LOGIN; /* Logs in with "md5cdde562ece166a02f5392b656dcf250m" */ CREATE ROLE test3 PASSWORD 'md5cdde562ece166a02f5392b656dcf250m' LOGIN; I debated adding a test...without being able to simulate a log in, I don't know if it tests much other than "yes, you can store an invalid md5 hash and it treats it as plaintext." Thanks, Jonathan --------------7F84F35565C3435A179CD20D Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="0001-Provide-additional-check-to-determine-if-a-password-.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename*0="0001-Provide-additional-check-to-determine-if-a-password-.pa"; filename*1="tch" RnJvbSBhYjIwNWU2ZmE4MjA4MWQ0YjAwZmE4YjY3YjBmMzMxNjNmOTUwY2M0IE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiAiSm9uYXRoYW4gUy4gS2F0eiIgPGpvbmF0aGFuLmth dHpAZXhjb3ZlbnR1cmVzLmNvbT4KRGF0ZTogTW9uLCAyMiBBcHIgMjAxOSAxOToyNzoxNSAt MDQwMApTdWJqZWN0OiBbUEFUQ0hdIFByb3ZpZGUgYWRkaXRpb25hbCBjaGVjayB0byBkZXRl cm1pbmUgaWYgYSBwYXNzd29yZCBpcyBhCiB2YWxpZCBNRDUgaGFzaC4KClRoZSBwcmVzZW50 IGNoZWNrIGluICJnZXRfcGFzc3dvcmRfdHlwZSIgb25seSBjaGVja3MgaWYgYSBwYXNzd29y ZCBjb250YWlucwp0aGUgIm1kNSIgcHJlZml4IGFuZCBpcyBvZiBsZW5ndGggTUQ1X1BBU1NX RF9MRU4uIEhvd2V2ZXIsIHRoaXMgbWVhbiB0aGF0CnRoZXJlIGNvdWxkIGJlIGludmFsaWQg bWQ1IGNoYXJhY3RlcnMgc3RvcmVkIGluIHRoZSBkaWdlc3QuCgpUaGlzIGZpeCBleHBsaWNp dGx5IGNoZWNrcyB0byBzZWUgaWYgYSBwYXNzd29yZCBwcmVmaXhlZCB3aXRoICJtZDUiIGFj dHVhbGx5CmNvbnRhaW5zIHRoZSB2YWxpZCBzZXQgb2YgY2hhcmFjdGVycyB0aGF0IGNhbiBi ZSB1c2VkIGluIGEgTUQ1IGhhc2guCi0tLQogc3JjL2JhY2tlbmQvbGlicHEvY3J5cHQuYyB8 IDMgKystCiBzcmMvaW5jbHVkZS9jb21tb24vbWQ1LmggIHwgMSArCiAyIGZpbGVzIGNoYW5n ZWQsIDMgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyYy9i YWNrZW5kL2xpYnBxL2NyeXB0LmMgYi9zcmMvYmFja2VuZC9saWJwcS9jcnlwdC5jCmluZGV4 IGRiMTlmNTFjODAuLjU2MTc4NjIyNDMgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL2xpYnBx L2NyeXB0LmMKKysrIGIvc3JjL2JhY2tlbmQvbGlicHEvY3J5cHQuYwpAQCAtOTYsNyArOTYs OCBAQCBnZXRfcGFzc3dvcmRfdHlwZShjb25zdCBjaGFyICpzaGFkb3dfcGFzcykKIAl1aW50 OAkJc3RvcmVkX2tleVtTQ1JBTV9LRVlfTEVOXTsKIAl1aW50OAkJc2VydmVyX2tleVtTQ1JB TV9LRVlfTEVOXTsKIAotCWlmIChzdHJuY21wKHNoYWRvd19wYXNzLCAibWQ1IiwgMykgPT0g MCAmJiBzdHJsZW4oc2hhZG93X3Bhc3MpID09IE1ENV9QQVNTV0RfTEVOKQorCWlmIChzdHJu Y21wKHNoYWRvd19wYXNzLCAibWQ1IiwgMykgPT0gMCAmJiBzdHJsZW4oc2hhZG93X3Bhc3Mp ID09IE1ENV9QQVNTV0RfTEVOICYmCisJCQkJc3Ryc3BuKHNoYWRvd19wYXNzICsgMywgTUQ1 X1BBU1NXRF9DSEFSU0VUKSA9PSBNRDVfUEFTU1dEX0xFTiAtIDMpCiAJCXJldHVybiBQQVNT V09SRF9UWVBFX01ENTsKIAlpZiAoc3RybmNtcChzaGFkb3dfcGFzcywgIlNDUkFNLVNIQS0y NTYkIiwgc3RybGVuKCJTQ1JBTS1TSEEtMjU2JCIpKSA9PSAwICYmCiAJCQkJcGFyc2Vfc2Ny YW1fdmVyaWZpZXIoc2hhZG93X3Bhc3MsICZpdGVyYXRpb25zLCAmZW5jb2RlZF9zYWx0LCBz dG9yZWRfa2V5LCBzZXJ2ZXJfa2V5KSkKZGlmZiAtLWdpdCBhL3NyYy9pbmNsdWRlL2NvbW1v bi9tZDUuaCBiL3NyYy9pbmNsdWRlL2NvbW1vbi9tZDUuaAppbmRleCBjZDU0Yzg3NGIxLi44 MGI3NDc1ZjQwIDEwMDY0NAotLS0gYS9zcmMvaW5jbHVkZS9jb21tb24vbWQ1LmgKKysrIGIv c3JjL2luY2x1ZGUvY29tbW9uL21kNS5oCkBAIC0xNiw2ICsxNiw3IEBACiAjaWZuZGVmIFBH X01ENV9ICiAjZGVmaW5lIFBHX01ENV9ICiAKKyNkZWZpbmUgTUQ1X1BBU1NXRF9DSEFSU0VU CSIwMTIzNDU2Nzg5YWJjZGVmIgogI2RlZmluZSBNRDVfUEFTU1dEX0xFTgkzNQogCiBleHRl cm4gYm9vbCBwZ19tZDVfaGFzaChjb25zdCB2b2lkICpidWZmLCBzaXplX3QgbGVuLCBjaGFy ICpoZXhzdW0pOwotLSAKMi4xNC4zIChBcHBsZSBHaXQtOTgpCgo= --------------7F84F35565C3435A179CD20D-- --3oGiDrJSh9tMj4SV2uPEEn125uU0bUGpc-- --TGIyaHEWnnDNMyc5Xf6HLwO396HCJocfc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE+oS2la8r95ogZD/x8QSccp8cZScFAly+UA0ACgkQ8QSccp8c ZSeBGg/+NHV9kekG8bPfWK+6ScpneLxsL3B+xipdHZYZTizhwQXYcMI2ZQcWW7Rt TjiGOAk4GfBhEZUv7jxkN3KmsNVu+ZxjoTUoOgPqWAmdWsxBXOMjRwYarlhuduul ve2IOydZ3Hj8XFpcXamNEBYxAwwiumiu/6KBpXVnHkrtsWVI8utkz7nW5SWWp8ER 86s4xCTSsj0VDIVOc8dick4xRGRauqf4KKyJFNC6fllFucfdUKEcO9pUXnYbPU/a fVbCgs5rRYYJH2tkfAHH46L8j1TU5QftyQoZc6gXyzS4zjFlmfo9zNquJeshaU2z TtYQD0/bjSeGHHUclzEN6hbv52cj62kcGXVPQ7OMv88KJ17YR1pZ25+yz84O0Dgc ZE8GUiMQg9kDvs4cRhmqZ4Z2tAh8csbIK1O4a9GnShd2jvh6m8lAZcsluXIx69j/ lEDhjSn1Rg4F4wQZE1bOg6ETZe6CxvWHNZ8SXEuLfxnm3K1syljwTRADoF5Ikd5C zlSkIi/zmxNj9WPLElmVGLdm+E9NNXnQd6wIO8/ZcfZTr+vWJxg7t9vTygA+nbQ0 sfg3Lf3lR2TecQSt9u92AfO7b6uCTeA2EVrI0WFp5AoyxcuZ/scBIwjF48vfk+rL jOvNFXNF7tTFtcumUoa9Nwhd3NFUU0Nq4k3TKeLA0dL1LlICOcU= =3BFW -----END PGP SIGNATURE----- --TGIyaHEWnnDNMyc5Xf6HLwO396HCJocfc--