From: Jonathan S. Katz <jkatz@postgresql.org>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Mon, 22 Apr 2019 09:04:43 -0400
Message-ID: <17ed1a12-14df-a501-8b58-f4d1eba49e3f@postgresql.org> (raw)
In-Reply-To: <20190422015051.GA3433@paquier.xyz>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
On 4/21/19 9:50 PM, Michael Paquier wrote:
> On Sat, Apr 20, 2019 at 04:12:56PM -0400, Jonathan S. Katz wrote:
>> I modified the "get_password_type" function to perform a SCRAM
>> verification to see if it is a properly hashed SCRAM password. If it is,
>> we treat the password as a SCRAM hashed one. Otherwise, we proceed to
>> the next step, which is to treat it as a plainly stored one.
>
> Since v10, we don't allow the storage of plain verifiers so if a
> string does not match what we think is a correct SCRAM or MD5
> verifier, then it should be processed according to
> password_encryption when storing the verifier or processed according
> to the auth protocol with the HBA entry matching. Your patch looks
> fine to me, I would have just added a test case in password.sql (no
> need to send a new patch I can take care of it).
Thanks for verifying. I'm happy to add the test case -- I first wanted
to ensure I was on the right track.
> Any objections to back-patch that stuff to v10?
+1; I did not try it out, but am very confident that scenario #2 would
demonstrate the bug exists in 10 as well.
Thanks,
Jonathan
Attachments:
[application/pgp-signature] signature.asc (832B, ../17ed1a12-14df-a501-8b58-f4d1eba49e3f@postgresql.org/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: jkatz@postgresql.org, michael@paquier.xyz, sfrost@snowman.net
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <17ed1a12-14df-a501-8b58-f4d1eba49e3f@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox