Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d35Fc-0005qo-Uz for pgsql-hackers@arkaria.postgresql.org; Tue, 25 Apr 2017 18:31:49 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1d35Fb-0004j3-Ip for pgsql-hackers@arkaria.postgresql.org; Tue, 25 Apr 2017 18:31:47 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1d35E6-00023K-0d for pgsql-hackers@postgresql.org; Tue, 25 Apr 2017 18:30:14 +0000 Received: from sss.pgh.pa.us ([66.207.139.130]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1d35E2-0003bz-NE for pgsql-hackers@postgresql.org; Tue, 25 Apr 2017 18:30:13 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id v3PITxcG025551; Tue, 25 Apr 2017 14:29:59 -0400 From: Tom Lane To: Robert Haas cc: Heikki Linnakangas , Michael Paquier , Noah Misch , Jeff Janes , Joe Conway , pgsql-hackers Subject: Re: scram and \password In-reply-to: References: <5478ab75-404f-9490-9355-dc1365ce3d7f@iki.fi> <20170410035323.GA2846583@tornado.leadboat.com> <66e776c9-e02c-3683-28df-339f7f64ea66@iki.fi> Comments: In-reply-to Robert Haas message dated "Tue, 25 Apr 2017 14:13:44 -0400" MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <25549.1493144999.1@sss.pgh.pa.us> Content-Transfer-Encoding: quoted-printable Date: Tue, 25 Apr 2017 14:29:59 -0400 Message-ID: <25550.1493144999@sss.pgh.pa.us> X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org Robert Haas writes: > On Tue, Apr 25, 2017 at 11:26 AM, Heikki Linnakangas wr= ote: >> A) Have PQencryptPassword() return an md5 hash. >>=20 >> B) Have PQencryptPassword() return a SCRAM verifier >>=20 >> C) Have PQencryptPassword() return a SCRAM verifier if connected to a v10 >> server, and an md5 hash otherwise. This is tricky, because PQencryptPass= word >> doesn't take a PGconn argument. It could behave like PQescapeString() do= es, >> and choose md5/scram depending on the server version of the last connect= ion >> that was established. > I vote for A - leave PQencryptPassword() as-is, and deprecate it. > Tell people to use the new function going forward. +1. I never much liked that magic behavior of PQescapeString, and don't think we should replicate it elsewhere, so I definitely don't like (C). And I don't think we can do (B) because that will break the functionality altogether when talking to an older server. That leaves (A) plus invent a new function. regards, tom lane --=20 Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers