To: pgsql-hackers <pgsql-hackers@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Subject: SCRAM salt length
Organization: 2ndQuadrant
Message-ID: <12cc9297-7e05-932f-d863-765e5626ead4@2ndquadrant.com>
Date: Wed, 16 Aug 2017 09:10:51 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.2.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

The SCRAM salt length is currently set as

/* length of salt when generating new verifiers */
#define SCRAM_DEFAULT_SALT_LEN     12

without further comment.

I suspect that this length was chosen based on the example in RFC 5802
(SCRAM-SHA-1) section 5.  But the analogous example in RFC 7677
(SCRAM-SHA-256) section 3 uses a length of 16.  Should we use that instead?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers