Date: Tue, 23 Apr 2019 10:42:00 -0400
From: Stephen Frost <sfrost@snowman.net>
To: raf@raf.org
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Message-ID: <20190423144159.GP6197@tamriel.snowman.net>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
 <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
 <20190422015051.GA3433@paquier.xyz>
 <3033.1555940554@sss.pgh.pa.us>
 <20190422135215.GG6197@tamriel.snowman.net>
 <20190422214924.pytigrzlq7mkdyzq@raf.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="oY7iPV5ugNyXwy1n"
Content-Disposition: inline
In-Reply-To: <20190422214924.pytigrzlq7mkdyzq@raf.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--oY7iPV5ugNyXwy1n
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* raf@raf.org (raf@raf.org) wrote:
> Stephen Frost wrote:
> > I agree we should also handle md5 better.  I realize this needs to be
> > back-patched and so we have to deal with the existing catalog structure,
> > but this really screams out, in my mind anyway, that we shouldn't have
> > ever tried to just stash the password-encoding-type into the password
> > field and that we should have pulled it out into its own column, so that
> > we aren't having to guess about things as important as a password.
>=20
> I don't think there's anything wrong with prefixing a
> password hash with an identifier for the password
> hashing scheme (and any parameters for that scheme).
> This is done all the time in many systems. It just has
> to be unambiguoous.

There isn't a way to make it unambiguous given that we accept
more-or-less anything as a plaintext password though, that would be the
issue here..

Thanks!

Stephen

--oY7iPV5ugNyXwy1n
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJcvyQ3AAoJEO1sijiDR2RVMB8QAJR/qxJivFH1DOFT7i7Bxlq6
egX9xJrvNVetTIOMPzMyrU+115lTmRx0TFfbEtcvkSGOkb8R7bDKhQya/VIRabfA
MI6bB4Em7FwmWFNltPi3hVr7xq2brzh0bjWgr8QAy09tLCqEU1PaJepHtiXt5hoG
PjwtWwlQ+KfX50/tE5nR+UHsWktIyjd0xI2TY0nDDv/3H9U+LKmosWYmaT/b9R0U
lBpgyWgTlq8gdLi2/pCJtyyb9suwxyxrbf+HuCwxxmjshWHSzBrB78/QlfNdV0O9
/WODUyYccUE60C8UCfAOW7is5Yhc3V09Q50dhYvs5Y+d5zjvwluoXhv/oHVUnALe
+Lc1p4A4eMXgoGsSszp+PcST+HxSaHiDhp0F2ZXfXqQ/RIHTf50+sUDcpQIfLNgg
DYb/s4mVlsoHQbnWygqD78pfLycJYN4UyoNokXUk/qt+QL0M9YoY+n/NEyxblv9o
qJ7BFM5m7ZsC6+4iPiaD/z9N5bya/Dx179kcXkpUzr7SY9+REPEMEeF5WbzQSdNr
OjFWPCnyzLZdrySSW05DLUmY16W0omnbvvEBEEm+LhK+17Hu+DY2gZV7gUImA/y2
/5ZCJC8uYH6dTIh+tqQiaMeOtXyQoINxkkTePUCXeWXGGUWyVeOEj9sPNDywqCn6
/F3inP3nocAz2vUo2Ksl
=AD22
-----END PGP SIGNATURE-----

--oY7iPV5ugNyXwy1n--