From: Michael Paquier <michael@paquier.xyz>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Jeff Davis <pgsql@j-davis.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Add "password_protocol" connection parameter to libpq
Date: Mon, 19 Aug 2019 14:51:00 +0900
Message-ID: <20190819055100.GC18166@paquier.xyz> (raw)
In-Reply-To: <edaeee0d-5367-ad46-6a5a-1357ea595151@postgresql.org>
References: <7a7a2f07-d013-eb80-85ba-9edaaf845038@2ndquadrant.com>
<95b40ddcb3897772f075e6891521ee3f06f443d1.camel@j-davis.com>
<93653d2b-7cf7-6992-7d3e-600ffd461354@2ndquadrant.com>
<20190813025634.GF2551@paquier.xyz>
<67726b008fa31d00d9a38257b3d1673b8afff2dd.camel@j-davis.com>
<1e34ce7a-9d4c-dd99-3781-e0a3203f5aef@postgresql.org>
<20190814023857.GB14446@paquier.xyz>
<54269124d50791eacb71f1fead40422185ae8ddc.camel@j-davis.com>
<20190816012815.GW16436@tamriel.snowman.net>
<edaeee0d-5367-ad46-6a5a-1357ea595151@postgresql.org>
On Fri, Aug 16, 2019 at 02:11:57PM -0400, Jonathan S. Katz wrote:
> To be pedantic, +1 on the channel_binding param.
Seems like we are moving in this direction then. I don't object to
the introduction of this parameter. We would likely want to do
something for downgrade attacks in other cases where channel binding
is not used, still there is verify-ca/full even in this case which
offer similar protections for MITM and eavesdropping.
> I would ask if scram-sha-256-plus makes the list if we have the
> channel_binding param?
No in my opinion.
> If channel_binding = require, it would essentially ignore any non-plus
> options in password_protocol and require scram-sha-256-plus. In a future
> scram-sha-512 world, then having scram-sha-256-plus or
> scram-sha-512-plus options in "password_protocol" then could be
> necessary based on what the user would prefer or require in their
> application.
Not including scram-sha-512-plus or scram-sha-256-plus in the
comma-separated list would be a problem for users willing to give for
example scram-sha-256,scram-sha-512-plus as an authorized list of
protocols but I don't think that it makes much sense as they basically
require an SSL connection for tls-server-end-point per the second
element.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../20190819055100.GC18166@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: michael@paquier.xyz, jkatz@postgresql.org, sfrost@snowman.net, pgsql@j-davis.com, peter.eisentraut@2ndquadrant.com
Subject: Re: Add "password_protocol" connection parameter to libpq
In-Reply-To: <20190819055100.GC18166@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox