Date: Wed, 4 Mar 2015 14:21:51 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: PostgreSQL-development <pgsql-hackers@postgreSQL.org>
Subject: Re: MD5 authentication needs help
Message-ID: <20150304192151.GJ29780@tamriel.snowman.net>
References: <20150304020146.GD24063@momjian.us>
 <20150304155230.GW29780@tamriel.snowman.net>
 <20150304173059.GF23933@momjian.us>
 <20150304174354.GC29780@tamriel.snowman.net>
 <20150304175857.GA31979@momjian.us>
 <20150304182731.GG29780@tamriel.snowman.net>
 <20150304191625.GB31979@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="LdLvWi+26WGB/aSG"
Content-Disposition: inline
In-Reply-To: <20150304191625.GB31979@momjian.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--LdLvWi+26WGB/aSG
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Bruce Momjian (bruce@momjian.us) wrote:
> On Wed, Mar  4, 2015 at 01:27:32PM -0500, Stephen Frost wrote:
> > This further makes what is sent over the network not directly
> > susceptible to a replay attack because the server has multiple values
> > available to pick for the salt to use and sends one at random to the
> > client, exactly how our current challenge/response replay-prevention
> > system works.  The downside is that the number of possible values for
> > the server to send to prevent replay attacke is reduced from 2^32 to N.
>=20
> OK, I understand now --- by not using a random session salt, you can
> store a post-hash of what you receive from the client, preventing the
> pg_authid from being resent by a client.  Nice trick, though going from
> 2^32 to N randomness doesn't seem like a win.

You're only looking at it from the network attack vector angle where
clearly that's a reduction in strength.  That is not the only angle and
in many environments the network attack vector is already addressed with
TLS.

=46rom the perspective of what everyone is currently complaining about on
the web, which is the pg_authid compromise vector, it'd be a huge
improvement over the current situation and we wouldn't be breaking any
existing clients, nor does it require having the postmaster see the
user's cleartext password during authentication (which is a common
argument against recommending the 'password' authentication method).

	Thanks,

		Stephen

--LdLvWi+26WGB/aSG
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIbBAEBCgAGBQJU91tOAAoJEO1sijiDR2RVACQP+M5JIyyQIuhV2wZxZvtfXHPK
QMKfIvYEYxDqbM1jLqlGv3SJ0irwXY6OGkQS6/CYFB07hxcNATkB8kBRlY/h3dt1
eqr+yUZdOYkFrFtdyppindbTPRTWH21W+4MjS0W3TQ6Ztv5n6p+YsDTRF4OCIW+e
j5N0CAT/dzAxEbPXpUIeqkP/TumkzW23+WrrdJ0ziFXSySC7vPDvMMa83jEl+wKV
7lR0UC9wc+8LJErpFRXJXwJu7s++KTF5SUGOUiK2UZO4n5HJJ6gh57GLJjqW6iYq
UpuAV3oE92q3UAow1sAM9unVZ7E6zRI9nw0RXXFaKYJNIxgx+gSMs+drrypfHHIe
qNghtOGr6sAPtIrsGmMFy61zQ/taSrx/ONKpFpYnUG422E0ECXzdXip7gYgrttuu
SkFX5o6Nvn4hrM1tQIwB824kJpFBSd0LV5Vxtxh3NQM1sJcC4kGdChUIyGDlRkbg
rD4W5hlmJWRBYZlbAx4Oc7SM/NzCjDeIvHdI6B919S7l1x/MLJT5QMI2RnWN3Gih
r93Jv9ww50Nm8JOKly+LbAqlopoU06ECPAeaYOzjt6L//Hf+5pcwaI5s38j/5H9d
GAK7uCh406mOntQqSiDZva4V6I9b3PxCcjbDrx7sOgPj3xjBemf/z28uli/wQJW2
t7TTQlDaj0TrxuPWWOA=
=QJ+B
-----END PGP SIGNATURE-----

--LdLvWi+26WGB/aSG--