From: Jonathan S. Katz <jkatz@postgresql.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Mon, 22 Apr 2019 10:20:12 -0400
Message-ID: <7e5b5f9e-6cde-b066-837d-9af22e7b1152@postgresql.org> (raw)
In-Reply-To: <3033.1555940554@sss.pgh.pa.us>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
<20190422015051.GA3433@paquier.xyz>
<3033.1555940554@sss.pgh.pa.us>
On 4/22/19 9:42 AM, Tom Lane wrote:
> Michael Paquier <michael@paquier.xyz> writes:
>> On Sat, Apr 20, 2019 at 04:12:56PM -0400, Jonathan S. Katz wrote:
>>> I modified the "get_password_type" function to perform a SCRAM
>>> verification to see if it is a properly hashed SCRAM password. If it is,
>>> we treat the password as a SCRAM hashed one. Otherwise, we proceed to
>>> the next step, which is to treat it as a plainly stored one.
>
>> Any objections to back-patch that stuff to v10?
>
> Patch looks OK as far as it goes, but ISTM it raises an obvious
> question: shouldn't the immediately-preceding test to see if a
> password is MD5 also be trying harder? Currently it only checks
> the length, but verifying that the rest is valid hex data would
> go far towards preventing the same set of problems for MD5.
>
> You might argue that MD5 is deprecated and we shouldn't expend
> any effort on it, but a simple strspn check would only require
> about one more line ...
Yeah, but at least if people look back at it as a reference for how to
properly(?) validate various password hashes it would look better. If it
was any higher effort, I'd say "no" given the status of md5, but this is
fairly innocuous.
I'm happy to put something together in a separate patch. I can take a
look later today.
Jonathan
Attachments:
[application/pgp-signature] signature.asc (832B, ../7e5b5f9e-6cde-b066-837d-9af22e7b1152@postgresql.org/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: jkatz@postgresql.org, tgl@sss.pgh.pa.us, michael@paquier.xyz, sfrost@snowman.net
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-Reply-To: <7e5b5f9e-6cde-b066-837d-9af22e7b1152@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox