Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fmgco-0006U7-Rd for pgsql-hackers@arkaria.postgresql.org; Mon, 06 Aug 2018 14:36:47 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fmgcn-0005tr-Gr for pgsql-hackers@arkaria.postgresql.org; Mon, 06 Aug 2018 14:36:45 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fmgcn-0005tk-64 for pgsql-hackers@lists.postgresql.org; Mon, 06 Aug 2018 14:36:45 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by makus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fmgcc-0003Ko-OP for pgsql-hackers@postgresql.org; Mon, 06 Aug 2018 14:36:44 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 2E25D5F79F; Mon, 6 Aug 2018 10:36:34 -0400 (EDT) Date: Mon, 6 Aug 2018 10:36:34 -0400 From: Stephen Frost To: Heikki Linnakangas Cc: Robbie Harwood , PostgreSQL mailing lists , Nico Williams Subject: Re: [PATCH v18] GSSAPI encryption support Message-ID: <20180806143633.GJ27724@tamriel.snowman.net> References: <82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="RWkQX+Yo2m4WvNiI" Content-Disposition: inline In-Reply-To: <82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --RWkQX+Yo2m4WvNiI Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Heikki, * Heikki Linnakangas (hlinnaka@iki.fi) wrote: > Sorry if this sounds facetious, but: >=20 > What is the point of this patch? What's the advantage of GSSAPI encryption > over SSL? I was hoping to find the answer by reading the documentation > changes, but all I can see is "how" to set it up, and nothing about "why". If you've already got an existing Kerberos environment, then it's a lot nicer to leverage that rather than having to also implement a full PKI to support and use SSL-based encryption. There's also something to be said for having alternatives to OpenSSL. Thanks! Stephen --RWkQX+Yo2m4WvNiI Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJbaFzxAAoJEO1sijiDR2RVjfIP/3VRSEMW9oT9lIPtb1pF2t1A rGYcbCKgdzLmmDXYUhd4vjDw5kQz//NPGMiIy742385+OdsIBvKgKJVat/LbAFP3 SOkI5i0zK3ow5SYywBhgx9NR8ZCXksSYyN3Lj6hUbRGbtlSBZjAhTWrexS0J8N80 MREmJ9F/I2bZad1pNdsa1KdTr2T5KcL2mn4khcfJ21ORQopAusBm3dzBsUudFMrN DcgfZizmelB8Wt0gN0bmSZFbtIHRvpSYzaVA/CoMq8pgjTBIOX8Iv7AGZcml9y5I KLZAGh2ALYbwAIgMZ0ENBb92ZFLTNI+a8n3iiSr4t7/hL5EzU2SbTg2tipEhHksf 8/HHN1vPmgAmJoPJa+VKcp2KtBiMAeo6gILjEJ+ubBVN9M90mEHN8ALKcx4w7gzi pIt2qdU2RQemDoo/epXFIMfTz+vxK4+PbcbBeykDYmjuMvVy73dKIn+FJtNL/BoP EA1PzsHdyMmnctH76Y44gGRCCoWJewQtosgSUgv5AMdx3ntY8hOJEqwWcu8pByIk mBEvbpSR+yk3udAnEPyjmBctXm2ZzocbCAV3+F0Fi7C0M9pxbJOapyaEaUzUAS6b UcmLNDlaMpDtOTTq/cEmaNLcWtIJFGIJ55fhh9AYPf7NqmAKj1TU7xh266mm97in CC0eDIvU4vRjuSGjOGPe =EpzV -----END PGP SIGNATURE----- --RWkQX+Yo2m4WvNiI--