Feedback-ID: ia2694551:Fastmail
Date: Fri, 24 Jan 2025 19:06:21 +0100
From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: Bernd Helmle <mailings@oopsware.de>
Cc: Japin Li <japinli@hotmail.com>, 
	PostgreSQL Development <pgsql-hackers@postgresql.org>
Subject: Re: Modern SHA2- based password hashes for pgcrypto
Message-ID: <202501241806.awm2djrgyehi@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1f3f264bd40b6eba7380e7da19013417029a93aa.camel@oopsware.de>
Archived-At: <https://www.postgresql.org/message-id/202501241806.awm2djrgyehi%40alvherre.pgsql>
Precedence: bulk

On 2025-Jan-24, Bernd Helmle wrote:

> So we behave exactly the same way as px_crypt_md5(): It stops after the
> first '$' after the magic byte preamble. For shacrypt, this could be
> the next '$' after the closing one of the non-mandatory 'rounds'
> option, but with your example this doesn't happen since it gets never
> parsed. The salt length will be set to 0.

IMO silently using no salt or 0 iterations because the input is somewhat
broken is bad security and should be rejected.  If we did so in the past
without noticing, that's bad already, but we should not replicate that
behavior any further.

-- 
Álvaro Herrera         PostgreSQL Developer  —  https://www.EnterpriseDB.com/
"Doing what he did amounts to sticking his fingers under the hood of the
implementation; if he gets his fingers burnt, it's his problem."  (Tom Lane)