Subject: Re: Add "password_protocol" connection parameter to libpq
To: Jeff Davis <pgsql@j-davis.com>, Michael Paquier <michael@paquier.xyz>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Stephen Frost <sfrost@snowman.net>, pgsql-hackers@postgresql.org
References: <20190809030021.GG3194@paquier.xyz>
 <3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com>
 <20190809100922.GI3194@paquier.xyz>
 <20190809132850.GL16436@tamriel.snowman.net>
 <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
 <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org>
 <daf0017a1a5c2caabf88a4e00f66b4fcbdfeccad.camel@j-davis.com>
 <7a7a2f07-d013-eb80-85ba-9edaaf845038@2ndquadrant.com>
 <95b40ddcb3897772f075e6891521ee3f06f443d1.camel@j-davis.com>
 <93653d2b-7cf7-6992-7d3e-600ffd461354@2ndquadrant.com>
 <20190813025634.GF2551@paquier.xyz>
 <67726b008fa31d00d9a38257b3d1673b8afff2dd.camel@j-davis.com>
From: "Jonathan S. Katz" <jkatz@postgresql.org>
Openpgp: preference=signencrypt
Autocrypt: addr=jkatz@postgresql.org; keydata=
 mQINBFtShwABEAC7PNHDUOTYuifpUCk23KqfxdQQkn4nkoxOXRK0+rAj36FiwqGB4TJFuOVZ
 sDFAEiSlC8Jt4y5Cs7B5tetT8JNd2cs6zp/udMJJDz9d65O9PDpdlMgAmIiTzpLlSdx8FG56
 DTksaDv1d8j3cTJPSE4/fWSxqzA7o3Y9UuL7atZPrzfImgpRKs0of7elIHwOa8GucjyhYqcR
 h60wFBJc2KXqQdDYRTZy43DSnY/0VNc0omiH355fustvpm+m5HjD3w7qZyfN3fpKJpnX1LCF
 f3MnPHaDGITIYGRCBXvf0UqUtD6OEVWPv2C2gyqWMIpWmZTOgDufltKyIByKBoS9x0PlFkij
 04X3KODCngt+N8Ssc9OICc6QSxhjoP48PYPdmiTmkrGuf0LX084wj1xeo1NX7XxZK39F6dTJ
 DhsIiW0sNS0xMxQHLHG9VLbPjx3SANQBh6BuryPz5ZupW9/TIDmkvprtU/oXfKgtfYm3fxmk
 EctxbWrEPsFTFPyuMqQu6l+xyQv0s1VLZfjNWaua6H1/gGoIt6kRnn5qMXDVVpijuWkHbv7G
 ngaQMd258UrrOEHnnjzhQ7jxMWV9D+emxbAtlIxnYvCWlV4IwAQhEHfvudqYaIY3hNWrvQ6H
 GB2KXoTZYN9g5djm14/5nj1IU5zOcovkjJnKhoo9iStnpFF2cwARAQABtCdKb25hdGhhbiBT
 LiBLYXR6IDxqa2F0ekBwb3N0Z3Jlc3FsLm9yZz6JAlQEEwEIAD4CGwMFCQeGH4AFCwkIBwIG
 FQoJCAsCBBYCAwECHgECF4AWIQT6hLaVryv3miBkP/HxBJxynxxlJwUCW1KJJQAKCRDxBJxy
 nxxlJwjrD/kBgqsW4QpNpTFw7ifRokZV08CCX4huPBJQ91rrv+UEWlEcotFBHVkYyHnpzARl
 tcZxhJ9CbFxjniH9cOTty5T/O1yolbOHtZSW8Z8aWV6BVEbjMb+BFxSSLm7RnvJdzQbGCZq2
 ZZvfVpB6z3EHYph4KDdVKvMFjoLskxmdS1DE0tE3zTxvoQsi24Q+HOS07kUjs6fsu/WICMfz
 mgO++AWG9Y0CvN0mm4TkujESzyKM9E5irD+leEMIcddl51Aa2c/VMfBXQbRmpHIgUFTmuHQD
 CnQih+9i3OJAksDg66SP8a7yiXv5mwvyDi1EfTGVKYR2j+pwyjwnC3oIbvDMmB3uTn2JIjnT
 iZKPVtAcAylXjubFltihQgNyuShdP4W+kBwZizhUFqUVL8Anx+KoytYmJPfMRFLGuK4obXKq
 a2ZS3k9KB+H+isOx2nFJOsc7V360Zp1DVaNmuiK10TT6QndShSPaqkJqFtCb6r92rZ9sZM/L
 3vtCI4Rrl3Pt1MgtENXupS8gZpJnAYS0j5A1PAZ09r6ANoaeMHspF+5J5fOHeEvqphXr36mm
 a83Vl1t4orPb0+QmmijmlpseDU63M88Aw5p3c4qj7t8Qr2EZ5zrn7/sFn5wOfbs8Nymxafif
 QCnlV2vg9p0m7vSk/yLJ4PFZvs52FgqAGRCdRn0s2EC99bkCDQRbUocAARAAv8ho/toQ9DG3
 j4f9h9n1aRHr2FlviN2Utpy6L8+dfDggO0geilmkGQOolZ2E60gGfye/kUtF9W3NByO4hxDR
 9u6qbOXcdqnuA+cc68EfqlWFJrVtYFxt0h4ElWYOYnIezKthriWch/FY70FGrxs3z8UHOHq5
 0wBW433eTvZm90WixBiXEt2v1DgW4Vr3ymfO7Aap/IYyPuE4JzgudAuAl0HKPyNEHWHG1dAb
 jX1RiCw9gknIDWQOF0B4UAaJctWGVcnZ3A2ULwNGMa1P9ZJlBWf1vcj01aiHMU0yQ7JjJiSp
 vfm9eM0uSLwRdDrJjyl5ZZqVumjdv2SMNQ8GvYRbEMys3GGDSt9zXgfCSUnPnJfYxjzBHRI6
 x44Wfsx8S6hWxepOogCJJ/g67Bk9mY8YV4klWIXDJVOL5jnBC09DbsZG81JaE2QxB8Y7W36Z
 Mroi9XMxg3s805hQAQUvdG/poU8hN8BWdrnTm/+4eQQp7gDY1ePDmGM6bJC+OHOSnFtR/f+7
 0zpKJ10cc7cBygGnl1yR3KjhFyAWUFvP4ZGziKCcpMwXZfe9PGuyA/YOubMphxIn3YsK2wrd
 faKZYX2GMZCZhMMcvx9IpQrxIJgU+VlwXu/O+Lk10VIPcxPJJwmpdI6HzcS8ZgG6IMcC444X
 XTuLaP8j2mgcMvYak3ScCykAEQEAAYkCPAQYAQgAJhYhBPqEtpWvK/eaIGQ/8fEEnHKfHGUn
 BQJbUocAAhsMBQkHhh+AAAoJEPEEnHKfHGUnReMP/RA2UhGQj+G4uBshkRLjpRysabdPqgQB
 dEBk6wYbio88Wg/2/hgY7UzmDDEwX3sZfQDcrI6+vIobI8uqstZID+WgAAa1JLfChMyVQnSy
 0zfWMOABXscc5tGuvFRZvJklTissMFjXUwaREEKp4ZikTvJ/62MCjSdtrUhnPLvoTsHTKRKD
 ichE+b5A54alwsubTijw12O6N22r5IjZiiSZV0u7dsShyKw+7wCSax9fuBoE43NMYf+dnjMK
 nerAQYUcZWYMnk+EC8RaqYAxv6XZ2tKx1AkGGktwkQIBwrz9IlDSvJ3LWJ2UIIuLRTdngNgg
 GIL4zzuUa2F56FqskQIuYMaNETk6LYfalBDQ6TVLAcgCPQxp4k4i/PRsZ3lZ2ZhRHRYciOvm
 kp+I6EfHwllQpYrWs1thluBGqlJSVJgKl0IOFvKLsQ6KKfqzAwh6FxrO5qajp4viNIgtWoFw
 O5Bp0jgFTbH2OrMWIRfUdUCH1Djbuo65svhNj7FNsQVYzHDI+Nd1I/LOBoPc3UorRMF2M4JV
 kUR7skOHWUbPTSNUr7qc14NSMY3PKjGeVGAsBVHBPvmRx/Ss2tW/TpJWpxg4pmquFQSXuaYh
 Yf4FN8Sxy320pcr+FqN8AhZkYJcNY82OTtR5VEKRC/mYcyq61qXIKqngydn79bJjGxHipxyF FmEC
Message-ID: <1e34ce7a-9d4c-dd99-3781-e0a3203f5aef@postgresql.org>
Date: Tue, 13 Aug 2019 16:51:57 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0)
 Gecko/20100101 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <67726b008fa31d00d9a38257b3d1673b8afff2dd.camel@j-davis.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="dJOBzBKbimE8yVa5vtFmjbZPSE28kzO7I"
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--dJOBzBKbimE8yVa5vtFmjbZPSE28kzO7I
Content-Type: multipart/mixed; boundary="BQPYjIr03JlLSH4X0YhynazNAzXRUKXvX";
 protected-headers="v1"
From: "Jonathan S. Katz" <jkatz@postgresql.org>
To: Jeff Davis <pgsql@j-davis.com>, Michael Paquier <michael@paquier.xyz>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Stephen Frost <sfrost@snowman.net>, pgsql-hackers@postgresql.org
Message-ID: <1e34ce7a-9d4c-dd99-3781-e0a3203f5aef@postgresql.org>
Subject: Re: Add "password_protocol" connection parameter to libpq
References: <20190809030021.GG3194@paquier.xyz>
 <3bbf5968ea705700a2605d6db74d8510bea7940b.camel@j-davis.com>
 <20190809100922.GI3194@paquier.xyz>
 <20190809132850.GL16436@tamriel.snowman.net>
 <609482826475e0063c7d71b2449ae31c0d61b232.camel@j-davis.com>
 <071e45a6-97f7-1614-371c-98ecb03aed65@postgresql.org>
 <daf0017a1a5c2caabf88a4e00f66b4fcbdfeccad.camel@j-davis.com>
 <7a7a2f07-d013-eb80-85ba-9edaaf845038@2ndquadrant.com>
 <95b40ddcb3897772f075e6891521ee3f06f443d1.camel@j-davis.com>
 <93653d2b-7cf7-6992-7d3e-600ffd461354@2ndquadrant.com>
 <20190813025634.GF2551@paquier.xyz>
 <67726b008fa31d00d9a38257b3d1673b8afff2dd.camel@j-davis.com>
In-Reply-To: <67726b008fa31d00d9a38257b3d1673b8afff2dd.camel@j-davis.com>

--BQPYjIr03JlLSH4X0YhynazNAzXRUKXvX
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

On 8/13/19 12:25 PM, Jeff Davis wrote:
> On Tue, 2019-08-13 at 11:56 +0900, Michael Paquier wrote:
>> I tend to prefer #2 as well and that's the kind of approach we were
>> tending to agree on when we discussed this issue during the v11 beta
>> for the downgrade issues with libpq.  And as you say extend it so as
>> we can apply filtering of more AUTH_REQ requests, inclusing GSS and
>> krb5.
>=20
> Can you please offer a concrete proposal? I know the proposals I've put=

> out aren't perfect (otherwise there wouldn't be three of them), so if
> you have something better, please share.

I think all of them get at the same thing, i.e. specifying which
password protocol you want to use, and a lot of it is a matter of how
much onus we want to put on the user.

Back to the thee proposals[1], I've warmed up to #3 a bit. I do think it
puts more onus on the client to set the correct knobs to get the desired
outcome, but what I like is the specific `channel_binding=3Drequire`
attribute.

However, I don't think it's completely future proof to adding a new hash
digest. If we wanted to prevent someone from using scram-sha-256 in a
scram-sha-512 world, we'd likely need an option for that.

Alternatively, we could combine 2 & 3, e.g.:

  channel_binding =3D {disable|prefer|require}

  # comma-separated list of protocols that are ok to the user, remove
  # ones you don't want. empty means all is ok
  password_protocol =3D "plaintext,md5,scram-sha-256,scram-sha-256-plus"

If the client selects "channel_binding=3Drequire" but does not include a
protocol that supports it, we should error. Likewise, if the client does
something like "channel_binding=3Drequire" and
"password_protocol=3Dscram-sha-256,scram-sha-256-plus" but the server
refuses to do channel binding, we should error.

I think this gives us both future-proofing against newer password digest
methods + the fix for the downgrade issue.

I would not be opposed to extending "password_protocol" to read
"auth_protocol" or the like and work for everything covered in AUTH_REQ,
but I would need to think about it some more.

Thanks,

Jonathan

[1]
https://www.postgresql.org/message-id/daf0017a1a5c2caabf88a4e00f66b4fcbdf=
eccad.camel%40j-davis.com


--BQPYjIr03JlLSH4X0YhynazNAzXRUKXvX--

--dJOBzBKbimE8yVa5vtFmjbZPSE28kzO7I
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE+oS2la8r95ogZD/x8QSccp8cZScFAl1TIu0ACgkQ8QSccp8c
ZSc7whAAiS79E6eI6BAWfFyGkuZfFYBlbQ+cnzLTM2ait+qhJWjeZ+YhM7L6nXzb
V4OI0/14h2mSEua4Y4WHmRj4xcw3QGDmOh8wHMLvpz3MnlWcoUsE6zv0PQpmzEJM
/eOtvh+3PzTM4Y4d0dPfAIVW8O4K9GDxlNJKQGaStSESDmUdD7uiV1MPId+6wpwp
iku2yl28nBXrVLARxt0fKml5lBwkZ3w4yfgYCZPUhCTTK4SxuqSeNISCf0Ex7AZB
5VPaiijo7a11FNaP5wUPZYGHt0AC+Jusou9aye9YU5V8Ni82ezfYYGwxYu0yp8pI
p2oBOwDgeZ0pwAZyqZQquyPbP1HALHnm1sdL64KJB96zLcA50MVX5reKN0Yfkj+7
uesHTD7AeNPSc7MgSSnBLtqZuSSkwfXn/6LpYOjaR7JqTrjTzHz4V4o/twtOZyoN
hyKa1qyLUJQS/d5Hf2x55pkxZVA3q7L0V9jMSIZfXyMeh0V1y55+9FTc2f4br0zf
rosxsjY2yfVCP21HSARAFMbI6A9JgoQlZCEMXp/aExyT5J1ysmhkNVVrhS6KA09M
Q/Nf+mLV21opA+3/tZpYqVO4jCgRKfZ5wcQ7MvuuZuYvSAtCWlkB8FlwVSMRPfbo
Em4zkSLNiAZ/2wsIgiLOdnZIOnJfLRIcxZCgOyMqIHUY4L1zJsI=
=xOjD
-----END PGP SIGNATURE-----

--dJOBzBKbimE8yVa5vtFmjbZPSE28kzO7I--