Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTEoN-00087J-Qj for pgsql-hackers@arkaria.postgresql.org; Wed, 04 Mar 2015 19:18:27 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YTEoN-0004O2-7p for pgsql-hackers@arkaria.postgresql.org; Wed, 04 Mar 2015 19:18:27 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YTEoL-0004La-PQ for pgsql-hackers@postgresql.org; Wed, 04 Mar 2015 19:18:25 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by makus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTEoF-0000Ay-Er for pgsql-hackers@postgresql.org; Wed, 04 Mar 2015 19:18:23 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 122435F7AF; Wed, 4 Mar 2015 14:18:18 -0500 (EST) Date: Wed, 4 Mar 2015 14:18:17 -0500 From: Stephen Frost To: Heikki Linnakangas Cc: Magnus Hagander , Bruce Momjian , PostgreSQL-development Subject: Re: MD5 authentication needs help Message-ID: <20150304191817.GI29780@tamriel.snowman.net> References: <20150304020146.GD24063@momjian.us> <20150304155230.GW29780@tamriel.snowman.net> <20150304160322.GY29780@tamriel.snowman.net> <20150304161116.GA29780@tamriel.snowman.net> <54F751E9.9050008@iki.fi> <20150304185928.GH29780@tamriel.snowman.net> <54F759DE.2020109@iki.fi> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ryzE6lWh7t42NE6A" Content-Disposition: inline In-Reply-To: <54F759DE.2020109@iki.fi> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-45-generic (x86_64) X-Uptime: 14:16:39 up 41 days, 19:05, 8 users, load average: 0.18, 0.18, 0.15 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --ryzE6lWh7t42NE6A Content-Type: text/plain; charset=us-ascii Content-Disposition: inline * Heikki Linnakangas (hlinnaka@iki.fi) wrote: > I'm not sure how expensive a brute force attack on SRP would be, > using a stolen backup tape. There doesn't seem to be an iterations > count similar to SCRAM. But note that SRP's resistance to > brute-forcing the authentication handshake is of a different kind. > It's not just expensive, but outright impossible. (Don't ask me how > that works; I'm not well-versed in the maths involved.) That's a big > advantage because it means that it's OK to use a fairly weak > password like 'foobar123' that would be trivially cracked with a > dictionary attack. If it's actually impossible then that's certainly interesting.. I don't get how that's possible, but ok. > (You can still connect to the server and try > different passwords, but the server can log that and throttle how > many guesses / minute it let's you do) Wouldn't that be nice... Wish we did it. :( Thanks, Stephen --ryzE6lWh7t42NE6A Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJU91p5AAoJEO1sijiDR2RVtAAP/i/hdlnbRMyleOgTSQIxSuZN skRZLX2pSn33ThcZv2wT75AlfvburDVZ2Tvat1CkpOMr2gmsy5lcE3ImaypMzUMb s/hXTJZQK79MWGkBdSDpfj+VY768MgVNQIKCSqnpctSag6BsjbVCssCYOw79LzJQ Xgtg/T6iZOiEqMo3fM8e3vL196NLd1+6V4NeqmyMi/ttMKT9wBF8BTz9a7kVOAwd JZBP07ukD0iXvdjF4EMvy7iUjxjogWO2w0aTzZTjkQFhctveWzB1/MPwZupTBiaH IMGbL50R+xIgimdTsdy6fubFPbdyEACoYCiAQYJIwX7mlyXjW/yYJ8e30NP5FZIy BQvYlhHyb/h8F/VcRSznSSDTXJaF5O4IaXlk8chKtcIUAQHaj8Kc3SHHNqAOKY1s tivAIkuze2ID9D6+2GtAh3VB9mfs6L+D2yyVvDJ4ALZgcnGZ1xuHK74brJn4o/vu GX7i1kx31fJrM533FuOzYQz3E7YaZQ+b3Z+jDA8ddgkqY/LLBFciyKCQ8v/uEbKl 605AGnwIS/PMvQ5GHAjbPcBk290LKv4jjZQ1XRoXxZLaFX+Bp8G2+gN9HUvP3pyu B3WdVc3ZT0BZBFOvfjiI1serMgbCgWru5ZE7/PdrYMJ5MEt+rle1RaXXg82tqEPH Ivlv6jzvp08r7rbhuHSh =GlMu -----END PGP SIGNATURE----- --ryzE6lWh7t42NE6A--