From: Michael Paquier <michael@paquier.xyz>
To: * Neustradamus * <neustradamus@hotmail.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Cc: Jacob Champion <jchampion@timescale.com>
Subject: Re: RFC 9266: Channel Bindings for TLS 1.3 support
Date: Fri, 29 Jul 2022 14:44:47 +0900
Message-ID: <YuNzz767HkB79sys@paquier.xyz> (raw)
In-Reply-To: <PA4PR01MB992243D329F60932DE56BAAFCB969@PA4PR01MB9922.eurprd01.prod.exchangelabs.com>
References: <PA4PR01MB992243D329F60932DE56BAAFCB969@PA4PR01MB9922.eurprd01.prod.exchangelabs.com>
Hi,
On Thu, Jul 28, 2022 at 08:33:50PM +0000, * Neustradamus * wrote:
> Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
> - https://datatracker.ietf.org/doc/html/rfc9266
>
> Little details, to know easily:
> - tls-unique for TLS =< 1.2
tls-unique is not planned, as we have already tls-server-end-point for
TLS1.2 and Postgres requires a certificate, anyway.
> - tls-exporter for TLS = 1.3
>
> It is linked to:
> - https://github.com/postgres/postgres/search?q=tls-unique
So, tls-exporter has been made an official thing, finally. I was
wondering when this was going to happen. Jacob Champion has given me
a patch to support that, based on OpenSSL's SSL_export_keying_material()
to do the job. The base integration is not complicated, but I still
need to think a bit more about it when it comes to the min/max TLS
protocols we allow in libpq, for example, and polish the whole with
tests. We don't force any failures depending on the other connection
parameters for tls-server-end-point, so I suspect that we should be
fine with keeping things at their simplest.
I should be able to get something sent to the mailing lists for the
commit fest of September, so as we could have this feature in v16~.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: michael@paquier.xyz, neustradamus@hotmail.com, pgsql-bugs@lists.postgresql.org, jchampion@timescale.com
Subject: Re: RFC 9266: Channel Bindings for TLS 1.3 support
In-Reply-To: <YuNzz767HkB79sys@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox