Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <bruce@momjian.us>) id 1T7CV3-0006KP-9h
	for pgsql-hackers@postgresql.org; Thu, 30 Aug 2012 21:42:05 +0000
Received: from momjian.us ([72.94.173.45])
	by magus.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <bruce@momjian.us>) id 1T7CUz-0006Ad-NF
	for pgsql-hackers@postgresql.org; Thu, 30 Aug 2012 21:42:04 +0000
Received: from bruce by momjian.us with local (Exim 4.72)
	(envelope-from <bruce@momjian.us>)
	id 1T7CUv-0000e8-4L; Thu, 30 Aug 2012 17:41:57 -0400
Date: Thu, 30 Aug 2012 17:41:57 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Euler Taveira <euler@timbira.com>,
	Florian Pflug <fgp@phlo.org>, Pgsql Hackers <pgsql-hackers@postgresql.org>
Subject: Re: libpq compression
Message-ID: <20120830214157.GA32350@momjian.us>
References: <4FDB954F.9010606@timbira.com> <5136.1339799120@sss.pgh.pa.us>
	<5365.1339799869@sss.pgh.pa.us>
	<CABUevEz_V4YYc0tUhkC6KD2GddysM5Z76pcHcMYiMDd7dwMxVQ@mail.gmail.com>
	<11357.1339822502@sss.pgh.pa.us>
	<CABUevEy1sUTOeCjNicUggnMpT7MfgjWud8kQ=wkvJsfbCU8=WQ@mail.gmail.com>
	<19804.1339859730@sss.pgh.pa.us>
	<CABUevExq95H2ejYOCCLtTrLz0xCR_WU8Rq9eg0cOQ5Aj1xp_5g@mail.gmail.com>
	<26283.1339947738@sss.pgh.pa.us>
	<CABUevExLnLXZsaHSCALBj3AKJWPrEiYc1b7Gaxq8YRDck+W_aw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CABUevExLnLXZsaHSCALBj3AKJWPrEiYc1b7Gaxq8YRDck+W_aw@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)
X-Pg-Spam-Score: -2.1 (--)
X-Archive-Number: 201208/1150
X-Sequence-Number: 212971

On Sun, Jun 17, 2012 at 11:45:54PM +0800, Magnus Hagander wrote:
> On Sun, Jun 17, 2012 at 11:42 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > Magnus Hagander <magnus@hagander.net> writes:
> >> Is there a reason why we don't have a parameter on the client
> >> mirroring ssl_ciphers?
> >
> > Dunno, do we need one?  I am not sure what the cipher negotiation process
> > looks like or which side has the freedom to choose.
> 
> I haven't looked into the details, but it seems reasonable that
> *either* side should be able to at least define a list of ciphers it
> *doens't* want to talk with.
> 
> Do we need it - well, it makes sense for the client to be able to say
> "I won't trust 56-bit encryption" before it sends over the password,
> imo..
> 
> 
> >> That, or just have DEFAULT as being the default (which in current
> >> openssl means ALL:!aNULL:!eNULL.
> >
> > If our default isn't the same as the underlying default, I have to
> > question why not.
> 
> Yeah, that's exaclty what I'm questioning here..
> 
> >  But are you sure this "!" notation will work with
> > all openssl versions?
> 
> Uh. We have the ! notation in our default *now*. What openssl also
> supports is the text "DEFAULT", which is currently the equivalent of
> "ALL!aNULL!eNULL". The question, which is valid of course, should be
> if "DEFAULT" works with all openssl versions.
> 
> It would seem reasonable it does, but I haven't investigated.

Do we want to change our ssl_ciphers default to 'DEFAULT'?  Currently it
is 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH'.

-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

  + It's impossible for everything to be true. +