Date: Sat, 15 May 2021 19:05:35 -0400
From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: Bruce Momjian <bruce@momjian.us>
Cc: Ian Lawrence Barwick <barwick@gmail.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: PG 14 release notes, first draft
Message-ID: <20210515230535.GA3189@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20210513032606.GE11075@momjian.us>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/20210515230535.GA3189%40alvherre.pgsql>
Precedence: bulk

On 2021-May-12, Bruce Momjian wrote:

> OK, updated text:
> 
> 	<listitem>
> 	<!--
> 	Author: Peter Eisentraut <peter@eisentraut.org>
> 	2020-06-10 [c7eab0e97] Change default of password_encryption to scram-sha-256
> 	-->
> 	
> 	<para>
> 	Change the default of the password_encryption server parameter
> 	to scram-sha-256 (Peter Eisentraut)
> 	</para>
> 	
> 	<para>
> 	Previously it was md5.	All new passwords will be stored as SHA256
> 	unless this server variable is changed or the password is already
> 	md5-hashed.  Also, the legacy (and undocumented) boolean-like
> 	values which were previously synonyms of <literal>md5</literal>
> 	are no longer accepted.
> 	</para>
> 	</listitem>

Thanks, looks ok as far as what the original point was about.

I have to say that this sentence is a bit odd: "All new passwords will
be stored as sha256 unless ... the password is already md5-hashed".
Does this mean that if you change a password for a user whose password
was md5, the new one is stored as md5 too even if the setting is
scram-sha-256?  Or if "the password" means an old password, then why is
it a new password?

-- 
Álvaro Herrera       Valdivia, Chile