To: sebihoorens@gmail.com, pgsql-docs@lists.postgresql.org
References: <160977988728.3264.12890569380100648489@wrigleys.postgresql.org>
From: "Jonathan S. Katz" <jkatz@postgresql.org>
Subject: Re: scram-sha-256 authentication
Message-ID: <0707a341-0c2e-3fe4-fe65-607bea83aced@postgresql.org>
Date: Tue, 5 Jan 2021 09:12:58 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:78.0)
 Gecko/20100101 Thunderbird/78.6.0
MIME-Version: 1.0
In-Reply-To: <160977988728.3264.12890569380100648489@wrigleys.postgresql.org>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="VoYwre3G6bmX3ayIJUCv6bjWAiwppSYgU"
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--VoYwre3G6bmX3ayIJUCv6bjWAiwppSYgU
Content-Type: multipart/mixed; boundary="rukzHjbdnmBL8DdEg9PJNA1BeDyeAzJu0";
 protected-headers="v1"
From: "Jonathan S. Katz" <jkatz@postgresql.org>
To: sebihoorens@gmail.com, pgsql-docs@lists.postgresql.org
Message-ID: <0707a341-0c2e-3fe4-fe65-607bea83aced@postgresql.org>
Subject: Re: scram-sha-256 authentication
References: <160977988728.3264.12890569380100648489@wrigleys.postgresql.org>
In-Reply-To: <160977988728.3264.12890569380100648489@wrigleys.postgresql.org>

--rukzHjbdnmBL8DdEg9PJNA1BeDyeAzJu0
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

On 1/4/21 12:04 PM, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
>=20
> Page: https://www.postgresql.org/docs/11/auth-password.html
> Description:
>=20
> How do you encode a plain password to the corresponding SCRAM-SHA-256
> encryption? Using online tools I obtain a result in a different format =
the
> in e.g. the "PostgreSQL Administration Cookbook", where the encrypted v=
alue
> starts with "SCRAM-SHA-256$4096:".

It's better to ask these questions in one of the community support
areas[1] as the form on the documentation page is intended for
documentation suggestions/corrections. I will provide some guidance below=
 :)

I am not sure what your end goal is, but there are a few ways to create
the hashed SCRAM verifier:

- Using the \password flag in "psql"
- Using one of the connection drivers that interfaces with libpq's
PQencryptPasswordConn function[2]
  - Some driver's handle the password hashing independently

If those are not acceptable, I also have a talk that goes through an
example for how to create a SCRAM verifier and what the different parts
mean[3] as well as an example of creating the verifier in Python[4].

In terms of how things start above, i.e. "SCRAM-SHA-256$4096:" that
presents the hashing function to use and the number of iterations to use
to hash the password (similar to PBKDF2). The full verifier has the
following components with the following delimters:

	DIGEST$ITERATIONS:SALT$STORED_KEY:SERVER_KEY

Hope this helps,

Jonathan

[1] https://www.postgresql.org/support/
[2]
https://www.postgresql.org/docs/current/libpq-misc.html#LIBPQ-PQENCRYPTPA=
SSWORDCONN
[3]
https://www2.slideshare.net/jkatz05/get-your-insecure-postgresql-password=
s-to-scram
[4] https://gist.github.com/jkatz/e0a1f52f66fa03b732945f6eb94d9c21


--rukzHjbdnmBL8DdEg9PJNA1BeDyeAzJu0--

--VoYwre3G6bmX3ayIJUCv6bjWAiwppSYgU
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEE+oS2la8r95ogZD/x8QSccp8cZScFAl/0c+oFAwAAAAAACgkQ8QSccp8cZSeW
kw/+J0iA2yfa+fy5XXpnIea/wH2GWe6pVfiHgL1wH7+P11Kczrw3VN083pvEVR3zHyWG++PlgSIp
ZyxQR9ar4oyh/RcvCPTk2NEu6H5YsKL3UfOGRensmf5T7mSTBv9hllMQJ5q9uI/XUbbBkK62sOb1
CNF3AlBbF0hOhYGhVQxmsa0kzbpNo1ElepcmzBabjgdcEAuiXWi3vsCS+hlWAytgiKIzMhGgFHyn
IdOHo+Z9hmY+N7ZTbr8/uYco60+sPqPXl4HuL0KlJbKlpOVxi4kkQilbKtj3J2vJKoOWPsXFkOsL
F+lnfx9f5uXXCAxYVe3JKglBAvNsg6cPb2ZyXN6drrSoQn/XAQgmPf/jQyjTcbhwgDcSl7lYsmXn
lOONvwu8PeavjoC4/TdMo1Qs2UCrkVz1BBjmKu9StLtBWVHbsnwds70WMc2bdF3LplWswnr7N55R
ouU97NKji8AAqtFfxZ6IJ5kT9yaq1ni8xzbvklejR1eK4u/LztFbnCm1bVJctaMb9bQNxhl4kD7r
quzlEhZ1jUjMq5wCm0+qxIrsqYfLvkfCTp5k7RpQzdzVbinYEkYITlyjzn4cgEpbh0BDHyjInzqz
WL1U5ZUhiel7es37KjWAAW7uDiv94JGeyMZB0i6hS43AYhc4djKW7DFEwtjxwfKkxkqaiHHKcV3a
V60=
=Zcye
-----END PGP SIGNATURE-----

--VoYwre3G6bmX3ayIJUCv6bjWAiwppSYgU--