Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YUIth-0006NI-Nt for pgsql-hackers@arkaria.postgresql.org; Sat, 07 Mar 2015 17:52:21 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YUIth-0004bI-86 for pgsql-hackers@arkaria.postgresql.org; Sat, 07 Mar 2015 17:52:21 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YUItf-0004aq-AH for pgsql-hackers@postgreSQL.org; Sat, 07 Mar 2015 17:52:19 +0000 Received: from tamriel.snowman.net ([2001:4830:167b::11]) by makus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YUItc-0007Ob-Ha for pgsql-hackers@postgreSQL.org; Sat, 07 Mar 2015 17:52:17 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id D56BE5F7A3; Sat, 7 Mar 2015 12:52:15 -0500 (EST) Date: Sat, 7 Mar 2015 12:52:15 -0500 From: Stephen Frost To: Bruce Momjian Cc: Josh Berkus , PostgreSQL-development Subject: Re: MD5 authentication needs help Message-ID: <20150307175215.GH29780@tamriel.snowman.net> References: <20150304020146.GD24063@momjian.us> <54F7B7C9.1090705@agliodbs.com> <20150305021928.GE24491@momjian.us> <20150305161555.GV29780@tamriel.snowman.net> <20150306230442.GB12967@momjian.us> <20150307000010.GA29780@tamriel.snowman.net> <20150307172737.GH12967@momjian.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="16v/2qlBd61GVM3u" Content-Disposition: inline In-Reply-To: <20150307172737.GH12967@momjian.us> X-Editor: Vim http://www.vim.org/ X-Info: http://www.snowman.net X-Operating-System: Linux/3.13.0-45-generic (x86_64) X-Uptime: 12:51:09 up 44 days, 17:40, 15 users, load average: 0.42, 0.27, 0.24 User-Agent: Mutt/1.5.21 (2010-09-15) X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org --16v/2qlBd61GVM3u Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Bruce Momjian (bruce@momjian.us) wrote: > On Fri, Mar 6, 2015 at 07:00:10PM -0500, Stephen Frost wrote: > > suggested to me as one change we could make that would reduce the risk > > of disk-based attacks while trading that off for a higher risk on the > > side of network-based attacks while not breaking the existing network > > protocol. To make it very clear- it is not a solution but rather a poor > > bandaid. What we really need is a new password based protocol which is > > based on a future-proof, well designed protocol, such as SCRAM. >=20 > Again, agreed. Great. Have you had a chance to review the SCRAM RFC or do you have any questions as it relates to how SCRAM works? I'd love to start a proper discussion about how we go about implementing it. Thanks! Stephen --16v/2qlBd61GVM3u Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJU+zrPAAoJEO1sijiDR2RV3ncQAKDwMEuhUxzD9QkftMXruSKE DfJFUf5f8ZUiG6ElNnqsqhEk9uSdry5pGguocWAMH9LyuEJhu7uTDUvodu0fgSnl OYTGVL0tii3a6xReE5pX0lX07W7upuPBo4KGuxvv+0yEj6ONomg9dPWTq8pALIbP HoOuAV2ikYgfqM33Pm9yUeTbhsYUp87zC4M5NkuMfA1Kx7UQPzRAau1bT5Tq27Te gJhpT5LMmPFL3CvCVmHzkAS3LqbVOkWVhXS8kbe6iJEIADazbqfu+jhGuSM/v+Ap SHVnKbJghmXseTSq9LLKBa3vV9Rf4MlImWbHn2ee8hSQ2fVEuQaXuP3eAFv6O7FU 3szlUbfMxkw3HasozMwDAoiYn0wzKtJGyliBunnWOQDmXaiU0z2ZKtUvVTI0QLfQ G+IVgpi05lLY+hZMbLSNqWl/HhctpIX5FnZc9Rc+T2JXa+fpl0AGN9iGs2VSLjfS Z++S6QU46UziHhgiEKXeSPxPyVmtBjLF3pma6r0Titpo/thgVPBwfq8sNQ8oew9t m/ZDxlEl2ZVxIkt+sXNxOc5HZPMnDkfYulSmDbO1Sc0H5YIFQpBsrM9ve0AgiKCi AgdA9JhRo+MZ1lLbB+BuBvJ90sSqEKYZjqpNeIYHNgS43l/Y5d4LfiA+5K+heZDY 4218FhCBgdCCYOUBc1uz =OysU -----END PGP SIGNATURE----- --16v/2qlBd61GVM3u--