From: Bruce Momjian <bruce@momjian.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Date: Tue, 15 Dec 2020 16:02:12 -0500
Message-ID: <20201215210212.GG14596@momjian.us> (raw)
In-Reply-To: <X9hHoQcZ11pBtgnz@paquier.xyz>
References: <20201202213814.GG20285@momjian.us>
<20201214230615.GA14596@momjian.us>
<X9gL7bD9idE2hoFt@paquier.xyz>
<20201215031902.GB14596@momjian.us>
<X9hHoQcZ11pBtgnz@paquier.xyz>
On Tue, Dec 15, 2020 at 02:20:33PM +0900, Michael Paquier wrote:
> On Mon, Dec 14, 2020 at 10:19:02PM -0500, Bruce Momjian wrote:
> > I am going to need someone to help me make these changes. I don't feel
> > I know enough about the crypto API to do it, and it will take me 1+ week
> > to learn it.
>
> I think that designing a correct set of APIs that can be plugged with
> any SSL library is the correct move in the long term. I have on my
> agenda to clean up HMAC as SCRAM uses that with SHA256 and you would
> use that with SHA512. Daniel has mentioned that he has been touching
> this area, and I also got a patch halfly done though pgcrypto needs
> some extra thoughts. So this is still WIP but you could reuse that
> here.
I thought this was going to be a huge job, but once I looked at it, it
was clear exactly what you were saying. Comparing cryptohash.c and
cryptohash_openssl.c I saw exactly what you wanted, and I think I have
completed it in the attached patch. cryptohash.c implemented the hash
in C code if OpenSSL is not present --- I assume you didn't want me to
do that, but rather to split the API so it was easy to add another
implementation.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EnterpriseDB https://enterprisedb.com
The usefulness of a cup is in its emptiness, Bruce Lee
Attachments:
key-alter.diff.gz (application/gzip, 34.1K) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, michael@paquier.xyz, masahiko.sawada@2ndquadrant.com
Subject: Re: Proposed patch for key managment
In-Reply-To: <20201215210212.GG14596@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox