From: Stephen Frost <sfrost@snowman.net>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Robbie Harwood <rharwood@redhat.com>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Nico Williams <nico@cryptonector.com>
Subject: Re: [PATCH v18] GSSAPI encryption support
Date: Mon, 6 Aug 2018 10:36:34 -0400
Message-ID: <20180806143633.GJ27724@tamriel.snowman.net> (raw)
In-Reply-To: <82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlg1se287n3.fsf@redhat.com>
<jlg602phyn5.fsf@redhat.com>
<82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi>
Heikki,
* Heikki Linnakangas (hlinnaka@iki.fi) wrote:
> Sorry if this sounds facetious, but:
>
> What is the point of this patch? What's the advantage of GSSAPI encryption
> over SSL? I was hoping to find the answer by reading the documentation
> changes, but all I can see is "how" to set it up, and nothing about "why".
If you've already got an existing Kerberos environment, then it's a lot
nicer to leverage that rather than having to also implement a full PKI
to support and use SSL-based encryption.
There's also something to be said for having alternatives to OpenSSL.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, hlinnaka@iki.fi, rharwood@redhat.com, nico@cryptonector.com
Subject: Re: [PATCH v18] GSSAPI encryption support
In-Reply-To: <20180806143633.GJ27724@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox