Date: Wed, 12 Aug 2015 21:22:59 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Josh Berkus <josh@agliodbs.com>
Cc: Robert Haas <robertmhaas@gmail.com>, Peter Eisentraut <peter_e@gmx.net>,
 Heikki Linnakangas <hlinnaka@iki.fi>,
 Michael Paquier <michael.paquier@gmail.com>,
 pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: WIP: SCRAM authentication
Message-ID: <20150813012259.GQ3685@tamriel.snowman.net>
References: <55CA4085.30101@gmx.net>
 <CA+TgmoYVE3Cg_HG=uZ_2NfMBbRstgNVMsOeVxHbfCUZfDhfxaA@mail.gmail.com>
 <55CB5D38.5090503@gmx.net>
 <CA+TgmoZq6T=jsEr5sAW5Q3_63E4zaoim918e5fkb187AVmhr2g@mail.gmail.com>
 <55CBA425.5070803@gmx.net>
 <20150812200938.GM3685@tamriel.snowman.net>
 <CA+TgmoYRkGAYC8XAz91qiwDK=wEqXgUbCoaPgiZDnde0cMSj5Q@mail.gmail.com>
 <20150812203732.GN3685@tamriel.snowman.net>
 <WM!23d4ca1d7810ef17da5bfb2bff2b30680a248a83e6156f0e4af5f37678c7a95b80c95c7478b39152f75efb8a862787fb!@asav-2.01.com>
 <55CBB8D5.7040501@agliodbs.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="OGdp5inFq4AVlqlU"
Content-Disposition: inline
In-Reply-To: <55CBB8D5.7040501@agliodbs.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--OGdp5inFq4AVlqlU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Josh Berkus (josh@agliodbs.com) wrote:
> On 08/12/2015 01:37 PM, Stephen Frost wrote:
> > Would be great to get comments on the other comments, specifically that
> > adding SCRAM's password verifier won't seriously change the security of
> > a user's account or password based on an attack vector where the
> > contents of pg_authid is compromised.  I do agree with the general
> > concern that the additional complexity involved in supporting multiple
> > password verifiers may result in bugs, and likely security ones, but I
> > really expect the larger risk to be from the SCRAM implementation itself
> > than how we get data into and back out of our own catalogs.
>=20
> There's also the concern that the additional complexity will cause
> *users* to make security-compromising mistakes, which I think is the
> greater risk.  Robert has mostly won me over to his point of view on this.

That is certainly an issue to address- but that's one which I believe we
can address a great deal better than what we're doing with the currently
proposed patch.  I do feel we need to provide flexibility and options,
but we also need to consider the simple case and make sure that it
remains simple.

> The only case where I can see multiple verifiers per role making a real
> difference in migrations is for PGAAS hosting.  But the folks from
> Heroku and AWS have been notably silent on this; lemme ping them.

While their insight is certainly valuable, they are certainly not the
only cases of one-user-to-rule-them-all environments.  Further, there's
going to be cases where multiple applications from different languages
are accessing the database through the same account because there's only
one account.

I'd rather not punt on those cases and, further, assume that we'll
always be able to keep it to only one password verifier per account.  As
I tried to outline up-thread, there are a set of features which would be
very nice for us to have which require further information to be saved
beyond even these different password verifiers for each.

As mentioned elsewhere, even SCRAM is possible of having multiple
password verifiers based on the various algorithms used.  In other
words, I doubt the 'only one password verifier per role' approach is
going to work out for us long term in any case.

	Thanks!
=09
		Stephen

--OGdp5inFq4AVlqlU
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVy/FzAAoJEO1sijiDR2RVTpMP/2QNPifWqfIzmcwgMmUiF1ad
CGMEPkRs/RPseBOFtWjpTpoGVgao0Az/w7V97NtdhEyk5N+/6R7C+cwjwDPW4+8L
GAAmVlef3Iv4hVPbDvozPve2A+uh39hbkIXJ16ZhHSEEC14cMGLCTthxmrM1rHz9
ND7RjwxHILNG2rjWsNlwYAEv+M3LQBgSCBrr8ps7XZsGRVmrgLp/P/hO74glfNKx
n5WdJ8HYDMX2fiQ5FS2YS9BsWOX7TuoWPcovrd4F/s0hy7CTge8ji0RBsuEHFUbM
pynkSb2ZduEtCb14iEb9nQglErl7LIAueVHa5WycbX3ShFWu7GxSOO7F3krWrPCm
DALogrm9n0K2jTGhdiaKu+2gck3uhy4ykr4qkkbjBtQ5FhnUxY7GXQyErBYeEPa0
Z2Mrjjcc3Jm+6fwzFTMI00+Xb89me7gbrMgYbljkQa+vxTFhtUlDErDDHDKwu7eB
rEuDT9TkRb88Ws4zip3R3I3jcHjua4WD7idH1buXt0E4+TpqfBMPuAmqm6Mz03ox
La4y9T4zgCpnu3unmYHJ1n/mhV+Mq2QmgANcQ3m8TA8fv5xbbuFFLvyFQgul2H36
xI38cwgv9c6P03vYYEDSluuQtmy7FLSb8ENnbk6IrCxaxfMAkbL1S77XQnGTOgq2
irfSwDklaDkQsD4Q+LeZ
=rYNu
-----END PGP SIGNATURE-----

--OGdp5inFq4AVlqlU--