From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: SCRAM salt length
Date: Wed, 16 Aug 2017 09:10:51 -0400
Message-ID: <12cc9297-7e05-932f-d863-765e5626ead4@2ndquadrant.com> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
The SCRAM salt length is currently set as
/* length of salt when generating new verifiers */
#define SCRAM_DEFAULT_SALT_LEN 12
without further comment.
I suspect that this length was chosen based on the example in RFC 5802
(SCRAM-SHA-1) section 5. But the analogous example in RFC 7677
(SCRAM-SHA-256) section 3 uses a length of 16. Should we use that instead?
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com
Subject: Re: SCRAM salt length
In-Reply-To: <12cc9297-7e05-932f-d863-765e5626ead4@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox