Subject: Re: Add "password_protocol" connection parameter to libpq
To: Jeff Davis <pgsql@j-davis.com>, Stephen Frost <sfrost@snowman.net>,
 Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org
References: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com>
 <20190809030021.GG3194@paquier.xyz>
 <3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com>
 <20190809100922.GI3194@paquier.xyz>
 <20190809132850.GL16436@tamriel.snowman.net>
 <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
From: "Jonathan S. Katz" <jkatz@postgresql.org>
Openpgp: preference=signencrypt
Autocrypt: addr=jkatz@postgresql.org; keydata=
 mQINBFtShwABEAC7PNHDUOTYuifpUCk23KqfxdQQkn4nkoxOXRK0+rAj36FiwqGB4TJFuOVZ
 sDFAEiSlC8Jt4y5Cs7B5tetT8JNd2cs6zp/udMJJDz9d65O9PDpdlMgAmIiTzpLlSdx8FG56
 DTksaDv1d8j3cTJPSE4/fWSxqzA7o3Y9UuL7atZPrzfImgpRKs0of7elIHwOa8GucjyhYqcR
 h60wFBJc2KXqQdDYRTZy43DSnY/0VNc0omiH355fustvpm+m5HjD3w7qZyfN3fpKJpnX1LCF
 f3MnPHaDGITIYGRCBXvf0UqUtD6OEVWPv2C2gyqWMIpWmZTOgDufltKyIByKBoS9x0PlFkij
 04X3KODCngt+N8Ssc9OICc6QSxhjoP48PYPdmiTmkrGuf0LX084wj1xeo1NX7XxZK39F6dTJ
 DhsIiW0sNS0xMxQHLHG9VLbPjx3SANQBh6BuryPz5ZupW9/TIDmkvprtU/oXfKgtfYm3fxmk
 EctxbWrEPsFTFPyuMqQu6l+xyQv0s1VLZfjNWaua6H1/gGoIt6kRnn5qMXDVVpijuWkHbv7G
 ngaQMd258UrrOEHnnjzhQ7jxMWV9D+emxbAtlIxnYvCWlV4IwAQhEHfvudqYaIY3hNWrvQ6H
 GB2KXoTZYN9g5djm14/5nj1IU5zOcovkjJnKhoo9iStnpFF2cwARAQABtCdKb25hdGhhbiBT
 LiBLYXR6IDxqa2F0ekBwb3N0Z3Jlc3FsLm9yZz6JAlQEEwEIAD4CGwMFCQeGH4AFCwkIBwIG
 FQoJCAsCBBYCAwECHgECF4AWIQT6hLaVryv3miBkP/HxBJxynxxlJwUCW1KJJQAKCRDxBJxy
 nxxlJwjrD/kBgqsW4QpNpTFw7ifRokZV08CCX4huPBJQ91rrv+UEWlEcotFBHVkYyHnpzARl
 tcZxhJ9CbFxjniH9cOTty5T/O1yolbOHtZSW8Z8aWV6BVEbjMb+BFxSSLm7RnvJdzQbGCZq2
 ZZvfVpB6z3EHYph4KDdVKvMFjoLskxmdS1DE0tE3zTxvoQsi24Q+HOS07kUjs6fsu/WICMfz
 mgO++AWG9Y0CvN0mm4TkujESzyKM9E5irD+leEMIcddl51Aa2c/VMfBXQbRmpHIgUFTmuHQD
 CnQih+9i3OJAksDg66SP8a7yiXv5mwvyDi1EfTGVKYR2j+pwyjwnC3oIbvDMmB3uTn2JIjnT
 iZKPVtAcAylXjubFltihQgNyuShdP4W+kBwZizhUFqUVL8Anx+KoytYmJPfMRFLGuK4obXKq
 a2ZS3k9KB+H+isOx2nFJOsc7V360Zp1DVaNmuiK10TT6QndShSPaqkJqFtCb6r92rZ9sZM/L
 3vtCI4Rrl3Pt1MgtENXupS8gZpJnAYS0j5A1PAZ09r6ANoaeMHspF+5J5fOHeEvqphXr36mm
 a83Vl1t4orPb0+QmmijmlpseDU63M88Aw5p3c4qj7t8Qr2EZ5zrn7/sFn5wOfbs8Nymxafif
 QCnlV2vg9p0m7vSk/yLJ4PFZvs52FgqAGRCdRn0s2EC99bkCDQRbUocAARAAv8ho/toQ9DG3
 j4f9h9n1aRHr2FlviN2Utpy6L8+dfDggO0geilmkGQOolZ2E60gGfye/kUtF9W3NByO4hxDR
 9u6qbOXcdqnuA+cc68EfqlWFJrVtYFxt0h4ElWYOYnIezKthriWch/FY70FGrxs3z8UHOHq5
 0wBW433eTvZm90WixBiXEt2v1DgW4Vr3ymfO7Aap/IYyPuE4JzgudAuAl0HKPyNEHWHG1dAb
 jX1RiCw9gknIDWQOF0B4UAaJctWGVcnZ3A2ULwNGMa1P9ZJlBWf1vcj01aiHMU0yQ7JjJiSp
 vfm9eM0uSLwRdDrJjyl5ZZqVumjdv2SMNQ8GvYRbEMys3GGDSt9zXgfCSUnPnJfYxjzBHRI6
 x44Wfsx8S6hWxepOogCJJ/g67Bk9mY8YV4klWIXDJVOL5jnBC09DbsZG81JaE2QxB8Y7W36Z
 Mroi9XMxg3s805hQAQUvdG/poU8hN8BWdrnTm/+4eQQp7gDY1ePDmGM6bJC+OHOSnFtR/f+7
 0zpKJ10cc7cBygGnl1yR3KjhFyAWUFvP4ZGziKCcpMwXZfe9PGuyA/YOubMphxIn3YsK2wrd
 faKZYX2GMZCZhMMcvx9IpQrxIJgU+VlwXu/O+Lk10VIPcxPJJwmpdI6HzcS8ZgG6IMcC444X
 XTuLaP8j2mgcMvYak3ScCykAEQEAAYkCPAQYAQgAJhYhBPqEtpWvK/eaIGQ/8fEEnHKfHGUn
 BQJbUocAAhsMBQkHhh+AAAoJEPEEnHKfHGUnReMP/RA2UhGQj+G4uBshkRLjpRysabdPqgQB
 dEBk6wYbio88Wg/2/hgY7UzmDDEwX3sZfQDcrI6+vIobI8uqstZID+WgAAa1JLfChMyVQnSy
 0zfWMOABXscc5tGuvFRZvJklTissMFjXUwaREEKp4ZikTvJ/62MCjSdtrUhnPLvoTsHTKRKD
 ichE+b5A54alwsubTijw12O6N22r5IjZiiSZV0u7dsShyKw+7wCSax9fuBoE43NMYf+dnjMK
 nerAQYUcZWYMnk+EC8RaqYAxv6XZ2tKx1AkGGktwkQIBwrz9IlDSvJ3LWJ2UIIuLRTdngNgg
 GIL4zzuUa2F56FqskQIuYMaNETk6LYfalBDQ6TVLAcgCPQxp4k4i/PRsZ3lZ2ZhRHRYciOvm
 kp+I6EfHwllQpYrWs1thluBGqlJSVJgKl0IOFvKLsQ6KKfqzAwh6FxrO5qajp4viNIgtWoFw
 O5Bp0jgFTbH2OrMWIRfUdUCH1Djbuo65svhNj7FNsQVYzHDI+Nd1I/LOBoPc3UorRMF2M4JV
 kUR7skOHWUbPTSNUr7qc14NSMY3PKjGeVGAsBVHBPvmRx/Ss2tW/TpJWpxg4pmquFQSXuaYh
 Yf4FN8Sxy320pcr+FqN8AhZkYJcNY82OTtR5VEKRC/mYcyq61qXIKqngydn79bJjGxHipxyF FmEC
Message-ID: <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org>
Date: Fri, 9 Aug 2019 16:27:16 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0)
 Gecko/20100101 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="umfCRmcij2XSn8RcRrMFYuE2vGiiEvtVp"
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--umfCRmcij2XSn8RcRrMFYuE2vGiiEvtVp
Content-Type: multipart/mixed; boundary="npwXkQC7Au03pCZGQzRxUNlPqK6lucIPt";
 protected-headers="v1"
From: "Jonathan S. Katz" <jkatz@postgresql.org>
To: Jeff Davis <pgsql@j-davis.com>, Stephen Frost <sfrost@snowman.net>,
 Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org
Message-ID: <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org>
Subject: Re: Add "password_protocol" connection parameter to libpq
References: <227015d8417f2b4fef03f8966dbfa5cbcc4f44da.camel@j-davis.com>
 <20190809030021.GG3194@paquier.xyz>
 <3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com>
 <20190809100922.GI3194@paquier.xyz>
 <20190809132850.GL16436@tamriel.snowman.net>
 <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
In-Reply-To: <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>

--npwXkQC7Au03pCZGQzRxUNlPqK6lucIPt
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

On 8/9/19 11:51 AM, Jeff Davis wrote:
> On Fri, 2019-08-09 at 09:28 -0400, Stephen Frost wrote:
>> Having an 'any' option, as mentioned before, could be an alternative
>> though.
>=20
> ...
>=20
>> I agree with the point that there isn't any guarantee that it'll
>> always
>> be clear-cut as to which of two methods is "better".
>>
>> From a user perspective, it seems like the main things are "don't
>> send
>> my password in the clear to the server", and "require channel binding
>> to
>> prove there isn't a MITM".  I have to admit that I like the idea of
>> requiring scram to be used and not allowing md5 though.
>=20
> So it seems like we are leaning toward:
>=20
>    password_protocol =3D any | {plaintext,md5,scram-sha-256,scram-sha-
> 256-plus}[,...]

First, thanks for proposing / working on this, I like the idea! :) Happy
to test/review.

As long as this one can handle the current upgrade path that's in place
for going from md5 to SCRAM (which AIUI it should) this makes sense to
me. As stated above, there is a clear hierarchy.

I would almost argue that "plaintext" shouldn't even be an option...if
you have "any" set (arguably default?) then plaintext is available. With
our currently supported versions + driver ecosystem, I hope no one needs
to support a forced plaintext setup.

>=20
> Or maybe:
>=20
>    channel_binding =3D {disable|prefer|require}
>    password_plaintext =3D {disable|enable}
>    password_md5 =3D {disable|enable}
>=20
> That seems reasonable. It's three options, but no normal use case would=

> need to set more than two, because channel binding forces scram-sha-
> 256-plus.

Seems to be a lot to configure. I'm more of a fan of the previous
method; it'd work nicely with how we've presently defined things and
should be easy to put into a DSN/URI/env variable.

Thanks,

Jonathan


--npwXkQC7Au03pCZGQzRxUNlPqK6lucIPt--

--umfCRmcij2XSn8RcRrMFYuE2vGiiEvtVp
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE+oS2la8r95ogZD/x8QSccp8cZScFAl1N1yQACgkQ8QSccp8c
ZSfH/Q//cAgjYHXXBqujbAHzPqzMUa/jww9K5WVygioGewFHwtgfUZeQiQJ9vZBS
//qu3bsILUEwMWcseIz2e69Co3W58b8fcftHP9TMpmkY6v50Cjb9B8tpfF3Qx4J/
hrdtAlCioc4xwm+U6Fj3tcQe+Oz0ESfUH0B3pmyOWTKmZs7jhq6V4cUVGCz+xSW+
c4EUGtluEqF8bvtt58s0UvyWL+rKBjvbkcEnGSz165FZoA7ysH3RqKS+cF+nN+zB
q4/BS8ygW4v540LjHE7Td6ppo+9ru+VC/BFGz3O6xVM0CxcOmO4IELSykoDR6YU8
gCPLCRcfYtCyuJewueYULGroU2wdRuZm/m9piXmkv9G67XGSEWNdV9+F+A0wC3Li
oJ43exBlBuk+orDzgwoEZbnW3zbUX3rE0LVTTeoM600/0OHUifnACVkZaRfcKtgZ
zgwypud+KaDs4ihHSvvqIb07cO9anVoDUBJdLWiIthuzRLaFmKk2KfnC6BaQ1NuX
81vZEYlXZlvVRVmjvxZxb83MfF60GlUhtp7DNimpwVoLo3MZX9VQ7vH5HBUfn+nn
vyKAgoCNd0i67ZB7/7jcx/bm1WAFUiBtvCo73ZWAWkZWFlWiyGGGyy2Lp+o/C6Gr
1k4ra0SYmqZCg9h15iWfXUfehcF/J6zEAHt/Q7kPaLBSCXsYyBk=
=JRio
-----END PGP SIGNATURE-----

--umfCRmcij2XSn8RcRrMFYuE2vGiiEvtVp--