Date: Wed, 12 Aug 2015 16:37:32 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter_e@gmx.net>, Josh Berkus <josh@agliodbs.com>,
 Heikki Linnakangas <hlinnaka@iki.fi>,
 Michael Paquier <michael.paquier@gmail.com>,
 pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20150812203732.GN3685@tamriel.snowman.net>
References: 
 <WM!2607bf41b9a89b33119972f5b4afde40079604473d0e477f1dc436a9fa9e91fbe0abb7b542ebd7beba5c4d754eca070e!@asav-3.01.com>
 <55C79F0A.90601@agliodbs.com>
 <CA+TgmobMFiHiHt2_weFhZ-99kQNQz+h3mkTzm1aOX4ZMwOH-Yg@mail.gmail.com>
 <55CA4085.30101@gmx.net>
 <CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
 <55CB5D38.5090503@gmx.net>
 <CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
 <55CBA425.5070803@gmx.net>
 <20150812200938.GM3685@tamriel.snowman.net>
 <CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="GAVKUSgG5XxJefcs"
Content-Disposition: inline
In-Reply-To: 
 <CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--GAVKUSgG5XxJefcs
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Robert,

* Robert Haas (robertmhaas@gmail.com) wrote:
> On Wed, Aug 12, 2015 at 4:09 PM, Stephen Frost <sfrost@snowman.net> wrote:
> > As for the notion of dropping md5 from 9.6 or even forcing it to be
> > one-or-the-other on a per-role basis, ...
>=20
> Please don't conflate those two things.  They are radically different
> in terms of the amount of upgrade pain that they cause.  The first one
> would be completely insane.

Thanks for the clarification.  I had gotten the (apparently mistaken)
impression[1] that there was some consideration for a hard break from
one release to the next to move from md5 to SCRAM.

Would be great to get comments on the other comments, specifically that
adding SCRAM's password verifier won't seriously change the security of
a user's account or password based on an attack vector where the
contents of pg_authid is compromised.  I do agree with the general
concern that the additional complexity involved in supporting multiple
password verifiers may result in bugs, and likely security ones, but I
really expect the larger risk to be from the SCRAM implementation itself
than how we get data into and back out of our own catalogs.

Thanks!

	Stephen

[1]: CA+TgmoYQ=3D8BR87xgGkEWs8HJSe3KQh5v4fq+bZ2SAZhAnH3MtQ@mail.gmail.com

--GAVKUSgG5XxJefcs
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVy66MAAoJEO1sijiDR2RVEcQP/RYPIr5CrZuRGPDfghjRm2tU
0w7zSjos7W9GdDM+3+4Sq7zYPRfCuu+LNRthkqr75nUi/ra18LAQ6rUfN0Dr7QvN
mgN20fYmE0VL0Bn84BLN18I07IqysWM/8dKgbYK/u/eNlQmtrWLuxoPsNVWHvPyr
2LEQZDiWDWDzBnTpJgsZRoVm8prwggEeoRv05GQXQt5L61TBJE9uLot1tsfQgk0w
+CryByyahT3F6NxIAg8WpdRZwaT3gc89VRCkn8VkDaOsjaBqv2NUO4VvkBARB80k
Zns+ByXdecJvOjOH+5VIZXsizfotmClGeaY3NVpn9W8JwOn0X1ufZ3YV9AlDIAqt
9MmzOHsWlBqkdsEAJpn9eCqpVcAWpXY4sKxfQPKLXa6F49nNdFWqMLTWTiBCPAbl
xoDuuTWb9+kA/ZgNxOQfEkcNq4nOrXRQdtT1mkzEGCrYdC2Hnea+zKywSE584h04
8xBgcrPrIhpuKa80rndGe9H6FihKei7XZfEbPDxVlZhrfoIERdf6AfcmYYFigGlt
X/hjIGaqFvqI8DEo1Cnv/n78tSHb3zxis4kpFJF3z+j/aCqgO5rZTLJhWk0DFGrQ
EBtgM7TV1810YXOqZAkZ71a40ChSlzV4aQCElWVs9WH3dDsVQyVEzE4rIswznuhu
JIPGXCX3TT932GJAfIi9
=St8l
-----END PGP SIGNATURE-----

--GAVKUSgG5XxJefcs--