Date: Tue, 23 Apr 2019 09:06:19 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Stephen Frost <sfrost@snowman.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, "Jonathan S. Katz" <jkatz@postgresql.org>,
	pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Message-ID: <20190423000619.GD2712@paquier.xyz>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
 <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
 <20190422015051.GA3433@paquier.xyz>
 <3033.1555940554@sss.pgh.pa.us>
 <20190422135215.GG6197@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="mR8QP4gmHujQHb1c"
Content-Disposition: inline
In-Reply-To: <20190422135215.GG6197@tamriel.snowman.net>
Precedence: bulk


--mR8QP4gmHujQHb1c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Mon, Apr 22, 2019 at 09:52:15AM -0400, Stephen Frost wrote:
> I recall having exactly that debate when SCRAM was being worked on and
> the push-back basically being that it was more work and we'd have to
> have additional syntax for ALTER USER, et al.  I wish I had had more
> time to spend on that discussion.  Water under the bridge now, but
> hopefully we learn from this and maybe someone refactors how this works
> sometime soon (or, at least, whenever we add the next password
> encoding).

I am not sure that this would have been more work for ALTER TABLE as
we could have relied on just password_encryption to do the work as we
do now.  The reluctance was to have more additional columns in
pg_authid as far as I recall, and I sided with having a separate
catalog, and more independent verifier type checks in the catalogs, as
you may recall, which would have also eased password rollups for a
given role.
--
Michael

--mR8QP4gmHujQHb1c
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAly+VvsACgkQnvQgOdby
QH0zPQ//THkUrytt+8Pw81HxX1DPR97nGwlC0uWJoxnPeYSGiYb1+HB+1jyV60j0
EtP1bEasRAjRrrnMtLKX3imghB6pYErwBOMaXs+aq74PXbdOwtuJtvo/f1/x0Yg+
7S410K9PvXJwOhbm4K6TqIfikJ1SnWNm10/QwDRFOS/P1zejALHDNw19+d3vcwGt
pXugC3Y9XpIttmQJj4S72o7d5HkWuwcxvXpgxqCbg9VOdqUT9PhTcuK5JqFMJJ5N
NUyt3F8pYQtSM8oF2IKHAgh6I5oiHZY5sE/YbNtzpGNtE0gL6a+JlrWc0y/Dt+tc
brTAjl+PjHIgTAbRVZJLDb2v4IAW5NIk4cx2pMj3awelB8/nhj7Y/gbeO/ogzbRP
5WJzm9tgLDKwBMJSJSG5n+DJZ6AnY2Elt1Znge3wyHjEIvzIsYk35fbrfJKFa/1l
cIueR271uJSkrO95TUh17NwRVHiKXjK2JYBo7k4MsYouQCqPPiP/Gyw8Jq9L4yQu
oXNYOHpbKoYFmAbVwq/9IfppJLpBpimM4OW8ivlaJp2DL7dpt114iLL9vn845l6x
dK3ZcRDx2Ne9I6nA+hWbURxomTMaG3DMbPiFpO8bEZhD+OOzEyxMzKzStvdGN4Yc
OthVX2SjkKYvYWd36dSVMll2l7Jx2TZMh7/Q4Fm43mxfQcdoABY=
=lIGW
-----END PGP SIGNATURE-----

--mR8QP4gmHujQHb1c--