Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTL1j-0008GD-51 for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Mar 2015 01:56:39 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YTL1h-00051t-SK for pgsql-hackers@arkaria.postgresql.org; Thu, 05 Mar 2015 01:56:37 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YTL1g-00051Y-FE for pgsql-hackers@postgreSQL.org; Thu, 05 Mar 2015 01:56:36 +0000 Received: from mx-out.zmailcloud.com ([192.198.85.98] helo=mx-out-1.zmailcloud.com) by makus.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YTL1Y-0007wO-NE for pgsql-hackers@postgreSQL.org; Thu, 05 Mar 2015 01:56:34 +0000 Received: from smtp.01.com (smtp.01.com [10.10.0.43]) by mx-out-1.zmailcloud.com (Postfix) with ESMTP id 20223563D7F; Wed, 4 Mar 2015 19:56:28 -0600 (CST) Received: from localhost (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id 1B247A03BF; Wed, 4 Mar 2015 19:56:28 -0600 (CST) X-Virus-Scanned: amavisd-new at smtp-out-1.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-1.01.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w70y1klKbuDp; Wed, 4 Mar 2015 19:56:28 -0600 (CST) Received: from smtp.01.com (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id F26B7A039C; Wed, 4 Mar 2015 19:56:27 -0600 (CST) Received: from localhost (localhost [127.0.0.1]) by smtp-out-1.01.com (Postfix) with ESMTP id D2CA6A03BF; Wed, 4 Mar 2015 19:56:27 -0600 (CST) X-Virus-Scanned: amavisd-new at smtp-out-1.01.com Received: from smtp.01.com ([127.0.0.1]) by localhost (smtp-out-1.01.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id YWW_UNk7rM-Z; Wed, 4 Mar 2015 19:56:27 -0600 (CST) Received: from [172.47.23.102] (50-0-89-53.dsl.dynamic.fusionbroadband.com [50.0.89.53]) by smtp-out-1.01.com (Postfix) with ESMTPSA id 6AB8DA039C; Wed, 4 Mar 2015 19:56:27 -0600 (CST) Message-ID: <54F7B7C9.1090705@agliodbs.com> Date: Wed, 04 Mar 2015 17:56:25 -0800 From: Josh Berkus Organization: PostgreSQL Experts Inc. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Bruce Momjian , PostgreSQL-development Subject: Re: MD5 authentication needs help References: <20150304020146.GD24063@momjian.us> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org Catching up here ... On 03/03/2015 06:01 PM, Bruce Momjian wrote: > It feels like MD5 has accumulated enough problems that we need to start > looking for another way to store and pass passwords. The MD5 problems > are: > > 1) MD5 makes users feel uneasy (though our usage is mostly safe) > > 2) The per-session salt sent to the client is only 32-bits, meaning > that it is possible to reply an observed MD5 hash in ~16k connection > attempts. Seems like we could pretty easily increase the size of the salt. Of course, that just increases the required number of connection attempts, without really fixing the problem. > 3) Using the user name for the MD5 storage salt allows the MD5 stored > hash to be used on a different cluster if the user used the same > password. This is a feature as well as a bug. For example, pgBouncer relies on this aspect of md5 auth. > 4) Using the user name for the MD5 storage salt causes the renaming of > a user to break the stored password. Wierdly, in 17 years of Postgres, I've never encountered this issue. So, are we more worried about attackers getting a copy of pg_authid, or sniffing the hash on the wire? -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers