From: Daniel Gustafsson <dgustafsson@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: pgcrypto: Make it possible to disable built-in crypto
Date: Fri, 24 Jan 2025 13:28:20 +0000
Message-ID: <E1tbJjQ-003HPl-4E@gemulon.postgresql.org> (raw)
pgcrypto: Make it possible to disable built-in crypto
When using OpenSSL and/or the underlying operating system in FIPS
mode no non-FIPS certified crypto implementations should be used.
While that is already possible by just not invoking the built-in
crypto in pgcrypto, this adds a GUC which prohibit the code from
being called. This doesn't change the FIPS status of PostgreSQL
but can make it easier for sites which target FIPS compliance to
ensure that violations cannot occur.
Author: Daniel Gustafsson <daniel@yesql.se>
Author: Joe Conway <mail@joeconway.com>
Reviewed-by: Joe Conway <mail@joeconway.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com>
Discussion: https://postgr.es/m/16b4a157-9ea1-44d0-b7b3-4c85df5de97b@joeconway.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/035f99cbebe5ffcaf52f8370394446cd59621ab7
Modified Files
--------------
contrib/pgcrypto/expected/crypt-des.out | 7 ++++++
contrib/pgcrypto/openssl.c | 26 ++++++++++++++++++++++
contrib/pgcrypto/pgcrypto.c | 31 +++++++++++++++++++++++++++
contrib/pgcrypto/px-crypt.c | 4 ++++
contrib/pgcrypto/px.h | 9 ++++++++
contrib/pgcrypto/sql/crypt-des.sql | 6 ++++++
doc/src/sgml/pgcrypto.sgml | 38 +++++++++++++++++++++++++++++++++
7 files changed, 121 insertions(+)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: dgustafsson@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: pgcrypto: Make it possible to disable built-in crypto
In-Reply-To: <E1tbJjQ-003HPl-4E@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox