Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIktF-0000ZK-7O for pgsql-bugs@arkaria.postgresql.org; Tue, 23 Apr 2019 02:10:33 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hIktC-0007Sd-Uz for pgsql-bugs@arkaria.postgresql.org; Tue, 23 Apr 2019 02:10:30 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIktC-0007SU-1W for pgsql-bugs@lists.postgresql.org; Tue, 23 Apr 2019 02:10:30 +0000 Received: from out5-smtp.messagingengine.com ([66.111.4.29]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIkt8-0005l8-Rc for pgsql-bugs@lists.postgresql.org; Tue, 23 Apr 2019 02:10:29 +0000 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 97FEE2108A; Mon, 22 Apr 2019 22:10:25 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 22 Apr 2019 22:10:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm1; bh=DOmcZ9MrE7qq7JP+JR71P+96qvj vwpht9AR2xJ2sqmU=; b=jxIC29sgJ4sddst3EIsxTluaq6R0sDtsREBIs3AuK77 GppWFtNgVzZ5rTw7dUSzYrfufq8o1b6X/ckHUvQOFnzNuyiOsEmJNjC0KNlz29e8 FIF7KivlAF3BcVG6ivREtXzKlkIZVT6IL3PTkxNM47r2EW68r4tQVANSlxi37ynh 9kAtx0YJO8B8XLgVTddGKXraT/0WVjTd0/ulCRTog8lsy1fNVD8TzfaL/eVH9sY2 R0jR/BQ/j07IomBADTunBy/nbo+LCt7PKP38xtdqPJCU3AzJDVkV9DmHm0ToqqUr d5EoVXDtdW28cr/5EEQDI8D8qX/JfqE15kFWsILIlQQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=DOmcZ9 MrE7qq7JP+JR71P+96qvjvwpht9AR2xJ2sqmU=; b=7zbY5ScEDrFKo5CqpyGqaO gG5srYjsYKVFLPobjZ+CjJDgAgkcymQHHrBL8UIiNcuxYl7qxjNZ/2KYI8XyU+TG 5DQsd6M12i+hZ/+KVuRjJaLa3q95HbkwbJqCx7oipTLuC5lk5+LZKmYZs/ZFJ5DF cUFypKP1+2VhoHxBY95TA61rFQBrLK1y1wQa3lueqcfsBXsa8n7K5Zot/d+5HE2C jc7LWB0DmQhpH9kM8JuN+/vLBR75B57jBc/PTFTDbEZPK05druXUDzGOLTsyDf4j CRooOpFwUie4gQ9ZAncMxVL0s5MmihEwna/at+Q9CQRRALHdpyb78q+MeD6qqr7w == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddrgeejgdegiecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenfg hrlhcuvffnffculdejtddmnecujfgurhepfffhvffukfhfgggtuggjsehgtderredttddv necuhfhrohhmpefoihgthhgrvghlucfrrghquhhivghruceomhhitghhrggvlhesphgrqh huihgvrhdrgiihiieqnecukfhppeduuddurddutddvrddukedtrddukeehnecurfgrrhgr mhepmhgrihhlfhhrohhmpehmihgthhgrvghlsehprghquhhivghrrdighiiinecuvehluh hsthgvrhfuihiivgeptd X-ME-Proxy: Received: from paquier.xyz (ee0822lan1.rev.em-net.ne.jp [111.102.180.185]) by mail.messagingengine.com (Postfix) with ESMTPA id 1A039103C8; Mon, 22 Apr 2019 22:10:22 -0400 (EDT) Date: Tue, 23 Apr 2019 11:10:18 +0900 From: Michael Paquier To: "Jonathan S. Katz" Cc: Tom Lane , pgsql-bugs@lists.postgresql.org, Stephen Frost Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords Message-ID: <20190423021018.GF2712@paquier.xyz> References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org> <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org> <20190422015051.GA3433@paquier.xyz> <3033.1555940554@sss.pgh.pa.us> <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org> <30284.1555972921@sss.pgh.pa.us> <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org> <20190423010142.GE2712@paquier.xyz> <10698.1555981849@sss.pgh.pa.us> <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MP5ln1Rcf9Bvi+ZW" Content-Disposition: inline In-Reply-To: <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --MP5ln1Rcf9Bvi+ZW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Apr 22, 2019 at 09:16:49PM -0400, Jonathan S. Katz wrote: > +1; that's why I left the comparison in. >=20 > (e.g. "md512345678901234567890123456789012zzz" would pass without strlen). That's a hard morning... Yes you are right and I can see the failure. By the way, grouping everything in one patch looks more adapted to me as this tightens all the checks for the different verifier types. -- Michael --MP5ln1Rcf9Bvi+ZW Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAly+dAoACgkQnvQgOdby QH2H7Q/+Nc3VtGM/Ac77p99qnt8iaMzlyw3bIQoghNWjD/EGBFr4zEmqQ+URdO/y WVRS/eVZKsk51vGHFSYPEYF4R72xvM3GCC6ipuU5ztsurp6Rjhs+OH0KzKwZwPqa 2e6QFXXif3ruxlWJmvLwHaElKzwBDKtEuxrrYhf9xwNQgOSPodxdqpcP+pe9up2V AlLncbKjpeUd4suFWKkS4xydOukbZHSuSkAbs3em8UbE+mAaC+LUVFFrDY7SAWUf 2ag4mEZ1zIaDLXLHsHeKErUc3VVGGG+l+XAyC37y+S/d06Mak0wWT0+6Iq3BNJNS Lk49ON2iYUfT7oDOd+1O4a6UmlrVr9sNhhV1UrgjYuWxlkRxG1u+8zEzOtrhIu2X WLH/sGTftQrsbIYa93EtxVkYV12eyLNdINEY0YSnwkwWwVFtddOWf+ArxeVD4cyP IL4MRoOoCXIJbktHgwlCU08p7bZU0tl+p7yAnKr9NJcfdDVy8vxWzqRuY2wxBQbV Zpt0NgYPcCj2PW0wJg19pmV8SNIEmdfbzpb1BgI8IVJLd4QUsW1Oid136I9QVdV8 IvlKz0RhLZaRApPUtUoJQRcWqy9mM49UD54qYzhZZ3qEfH5rzXiNUmFz/pwwDEIg UMOPDrbBmVFV9YUb7hRIROaALbQfh+1g4RRRx88y16vXYkhHAgQ= =T/J8 -----END PGP SIGNATURE----- --MP5ln1Rcf9Bvi+ZW--