pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Michael Paquier <michael.paquier@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: David Steele <david@pgmasters.net>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: David Fetter <david@fetter.org>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Julian Markwort <julian.markwort@uni-muenster.de>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Valery Popov <v.popov@postgrespro.ru>
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Mon, 17 Oct 2016 17:41:09 +0300
Message-ID: <2eae485f-febd-72df-089a-ca95fc9fc89f@iki.fi> (raw)
In-Reply-To: <4e0ae28b-b61a-248c-d96c-207c9befc125@iki.fi>
References: <CAB7nPqSL_V+0nD5i-XH_x1o5HTt2bT53vVwPUTHz8YT0hYRoPg@mail.gmail.com>
	<47be24f5-12a5-7af8-efc0-9486a7dbd413@iki.fi>
	<CAB7nPqQzQnO11P_j1rEOzFjMRYNiDsAkzAbt111Srs-EONb9Zw@mail.gmail.com>
	<CAB7nPqRevzWkivfXZxpsBeKXhyUgHR+41mWKs78Fu=7srYFg4w@mail.gmail.com>
	<f606bf4d-6791-1b3a-a7e9-b676544b7f75@pgmasters.net>
	<CAB7nPqRhhJGhEeQn8omtS0x2s5YyjEuAtV1vdPt-7WVuC6OpcA@mail.gmail.com>
	<79774ac1-df34-6b20-1659-c020c3842ce1@iki.fi>
	<f28a48ef-cc89-3de6-131e-3d32e7267d4c@iki.fi>
	<CAB7nPqTxyM+3YbQuevYVZ9MzCBYFAyzSqH2Pk5BaRBy-4GdjfQ@mail.gmail.com>
	<CAB7nPqS6Pfz5+3CieROcXRUDRN41bZ274JfGiTMfhZtKku2HDg@mail.gmail.com>
	<CAB7nPqRy3krN8quR9XujMVVHYtXJ0_60nqgVc6oUk8ygyVkZsA@mail.gmail.com>
	<4f3a9e71-cb1b-ca44-a780-36d503671e45@iki.fi>
	<CAB7nPqRW5JvH8jj+zNjBL72EYDyj3qPdNGYWvuHNq9-BR63R_w@mail.gmail.com>
	<d60f8ddb-3ba5-2402-8951-7ae23ba0974b@iki.fi>
	<CAB7nPqQpek5pUUinmZNMr+n9+vgaUqaxZJ9zWRoMKM8e1uHRHw@mail.gmail.com>
	<4e0ae28b-b61a-248c-d96c-207c9befc125@iki.fi>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 10/17/2016 12:27 PM, Heikki Linnakangas wrote:
> On 10/17/2016 12:18 PM, Michael Paquier wrote:
>> You removed the part of pgcrypto in charge of randomness, nice move. I
>> was wondering about how to do with the perfc and the unix_std at some
>> point, and ripping them off as you did is fine for me.
>
> Yeah. I didn't understand the need for the perfc stuff. Are there
> Windows systems that don't have the Crypto APIs? I doubt it, but the
> buildfarm will tell us in a moment if there are.
>
> And if we don't have a good source of randomness like /dev/random, I
> think it's better to fail, than try to collect entropy ourselves (which
> is what unix_std did). If there's a platform where that doesn't work,
> someone will hopefully send us a patch, rather than silently fall back
> to an iffy implementation.

Looks like Tom's old HP-UX box, pademelon, is not happy about this. Does 
(that version of) HP-UX not have /dev/urandom?

I think we're going to need a bit more logging if no randomness source 
is available. What we have now is just "could not generate random query 
cancel key", which isn't very informative. Perhaps we should also call 
pg_strong_random() once at postmaster startup, to check that it works, 
instead of starting up but not accepting any connections.

- Heikki



-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (149+ messages)  latest in thread

Message-ID: <2eae485f-febd-72df-089a-ca95fc9fc89f@iki.fi>
Permalink:  ../2eae485f-febd-72df-089a-ca95fc9fc89f@iki.fi/
Also on:    postgresql.org/message-id/2eae485f-febd-72df-089a-ca95fc9fc89f@iki.fi

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: hlinnaka@iki.fi, michael.paquier@gmail.com, tgl@sss.pgh.pa.us, david@pgmasters.net, robertmhaas@gmail.com, david@fetter.org, alvherre@2ndquadrant.com, magnus@hagander.net, peter.eisentraut@2ndquadrant.com, julian.markwort@uni-muenster.de, sfrost@snowman.net, v.popov@postgrespro.ru
  Subject: Re: Password identifiers, protocol aging and SCRAM protocol
  In-Reply-To: <2eae485f-febd-72df-089a-ca95fc9fc89f@iki.fi>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox