pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Noah Misch <noah@leadboat.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Victor Wagner <vitus@wagner.pp.ru>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: peter.eisentraut@2ndquadrant.com
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Wed, 18 Jan 2017 05:23:56 +0000
Message-ID: <20170118052356.GA5952@gust> (raw)
In-Reply-To: <CAB7nPqRsiwYOiOB+raZBqckh4obLBZgX43EkaGVomVVFpwH6DA@mail.gmail.com>
References: <CAB7nPqTxyM+3YbQuevYVZ9MzCBYFAyzSqH2Pk5BaRBy-4GdjfQ@mail.gmail.com>
	<CAB7nPqS6Pfz5+3CieROcXRUDRN41bZ274JfGiTMfhZtKku2HDg@mail.gmail.com>
	<CAB7nPqRy3krN8quR9XujMVVHYtXJ0_60nqgVc6oUk8ygyVkZsA@mail.gmail.com>
	<4f3a9e71-cb1b-ca44-a780-36d503671e45@iki.fi>
	<CAB7nPqRW5JvH8jj+zNjBL72EYDyj3qPdNGYWvuHNq9-BR63R_w@mail.gmail.com>
	<d60f8ddb-3ba5-2402-8951-7ae23ba0974b@iki.fi>
	<CAB7nPqQpek5pUUinmZNMr+n9+vgaUqaxZJ9zWRoMKM8e1uHRHw@mail.gmail.com>
	<CAB7nPqTxH8Nnvo0ii4w6881cT3OODgJcE7RFk-WaS+mYD-7pyg@mail.gmail.com>
	<20161109091309.6437a8b3@fafnir.local.vm>
	<CAB7nPqRsiwYOiOB+raZBqckh4obLBZgX43EkaGVomVVFpwH6DA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On Tue, Nov 15, 2016 at 07:52:06AM +0900, Michael Paquier wrote:
> On Sat, Nov 5, 2016 at 9:36 PM, Michael Paquier <michael.paquier@gmail.com> wrote:
> > On Sat, Nov 5, 2016 at 12:58 AM, Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote:
> > pg_hba.conf uses "scram" as keyword, but scram refers to a family of
> > authentication methods. There is as well SCRAM-SHA-1, SCRAM-SHA-256
> > (what this patch does). Hence wouldn't it make sense to use
> > scram_sha256 in pg_hba.conf instead? If for example in the future
> > there is a SHA-512 version of SCRAM we could switch easily to that and
> > define scram_sha512.
> 
> OK, I have added more docs regarding the use of scram in pg_hba.conf,
> particularly in client-auth.sgml to describe what scram is better than
> md5 in terms of protection, and also completed the data of pg_hba.conf
> about the new keyword used in it.

The latest versions document this precisely, but I agree with Peter's concern
about plain "scram".  Suppose it's 2025 and PostgreSQL support SASL mechanisms
OAUTHBEARER, SCRAM-SHA-256, SCRAM-SHA-256-PLUS, and SCRAM-SHA3-512.  What
should the pg_hba.conf options look like at that time?  I don't think having a
single "scram" option fits in such a world.  I see two strategies that fit:

1. Single "sasl" option, with a GUC, similar to ssl_ciphers, controlling the
   mechanisms to offer.
2. Separate options "scram_sha_256", "scram_sha3_512", "oauthbearer", etc.


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (149+ messages)  latest in thread

Message-ID: <20170118052356.GA5952@gust>
Permalink:  ../20170118052356.GA5952@gust/
Also on:    postgresql.org/message-id/20170118052356.GA5952@gust

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: noah@leadboat.com, michael.paquier@gmail.com, vitus@wagner.pp.ru, peter.eisentraut@2ndquadrant.com
  Subject: Re: Password identifiers, protocol aging and SCRAM protocol
  In-Reply-To: <20170118052356.GA5952@gust>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox