From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Mon, 22 Apr 2019 18:42:01 -0400
Message-ID: <30284.1555972921@sss.pgh.pa.us> (raw)
In-Reply-To: <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
<3033.1555940554@sss.pgh.pa.us>
<5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
"Jonathan S. Katz" <jkatz@postgresql.org> writes:
> OK, so I have something that sort of works, i.e:
> if (strncmp(shadow_pass, "md5", 3) == 0 &&
> strlen(shadow_pass) == MD5_PASSWD_LEN &&
> strspn(shadow_pass, MD5_PASSWD_CHARSET) == MD5_PASSWD_LEN
> )
> where MD5_PASSWD_CHARSET = "mabcdef0123456789"
> ...but you may notice something: the CHARSET contains an "m" as we store
> that "md5" prefix on the md5 hashed passwords.
Yeah, that's silly; why not
strspn(shadow_pass + 3, MD5_PASSWD_CHARSET) == MD5_PASSWD_LEN - 3
It's not like this code isn't very well aware of the first 3 characters
being not like the others.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, jkatz@postgresql.org, michael@paquier.xyz, sfrost@snowman.net
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <30284.1555972921@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox