Date: Wed, 9 Nov 2016 09:13:09 +0300
From: Victor Wagner <vitus@wagner.pp.ru>
To: pgsql-hackers@postgresql.org
Subject: Re: Password identifiers, protocol aging and SCRAM
 protocol
Message-ID: <20161109091309.6437a8b3@fafnir.local.vm>
In-Reply-To: 
 <CAB7nPqTxH8Nnvo0ii4w6881cT3OODgJcE7RFk-WaS+mYD-7pyg@mail.gmail.com>
References: 
 <CAB7nPqSL_V+0nD5i-XH_x1o5HTt2bT53vVwPUTHz8YT0hYRoPg@mail.gmail.com>
	<CAB7nPqQzQnO11P_j1rEOzFjMRYNiDsAkzAbt111Srs-EONb9Zw@mail.gmail.com>
	<CAB7nPqRevzWkivfXZxpsBeKXhyUgHR+41mWKs78Fu=7srYFg4w@mail.gmail.com>
	<f606bf4d-6791-1b3a-a7e9-b676544b7f75@pgmasters.net>
	<CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
	<79774ac1-df34-6b20-1659-c020c3842ce1@iki.fi>
	<f28a48ef-cc89-3de6-131e-3d32e7267d4c@iki.fi>
	<CAB7nPqTxyM+3YbQuevYVZ9MzCBYFAyzSqH2Pk5BaRBy-4GdjfQ@mail.gmail.com>
	<CAB7nPqS6Pfz5+3CieROcXRUDRN41bZ274JfGiTMfhZtKku2HDg@mail.gmail.com>
	<CAB7nPqRy3krN8quR9XujMVVHYtXJ0_60nqgVc6oUk8ygyVkZsA@mail.gmail.com>
	<4f3a9e71-cb1b-ca44-a780-36d503671e45@iki.fi>
	<CAB7nPqRW5JvH8jj+zNjBL72EYDyj3qPdNGYWvuHNq9-BR63R_w@mail.gmail.com>
	<d60f8ddb-3ba5-2402-8951-7ae23ba0974b@iki.fi>
	<CAB7nPqQpek5pUUinmZNMr+n9+vgaUqaxZJ9zWRoMKM8e1uHRHw@mail.gmail.com>
	<CAB7nPqTxH8Nnvo0ii4w6881cT3OODgJcE7RFk-WaS+mYD-7pyg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On Tue, 18 Oct 2016 16:35:27 +0900
Michael Paquier <michael.paquier@gmail.com> wrote:

 Hi
> Attached is a rebased patch set for SCRAM, with the following things:
> - 0001, moving all the SHA2 functions to src/common/ and introducing a
> PG-like interface. No actual changes here.

It seems, that client nonce generation in this patch is not
RFC-compliant.

RFC 5802 states that SCRAM nonce should be

a sequence of random printable ASCII
      characters excluding ','

while this patch uses sequence of random bytes from pg_strong_random
function with zero byte appended.

It could cause following problems

1. If zero byte happens inside random sequence, nonce would be shorter
than expected, or even empty.

2. If one of bytes happens to be ASCII Code of comma, than server
to the client-first message, which includes copy of client nonce,
appended by server nonce,
as one of unquoted comman-separated field, would be parsed incorrectly.


Regards, Victor
-- 

		
-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers