Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZO7qh-0004pN-2l for pgsql-hackers@arkaria.postgresql.org; Sat, 08 Aug 2015 17:23:59 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZO7qf-0007Z6-Vv for pgsql-hackers@arkaria.postgresql.org; Sat, 08 Aug 2015 17:23:58 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZO7qe-0007Yw-9J for pgsql-hackers@postgresql.org; Sat, 08 Aug 2015 17:23:56 +0000 Received: from mail-wi0-x22b.google.com ([2a00:1450:400c:c05::22b]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.84) (envelope-from ) id 1ZO7qW-00081z-RT for pgsql-hackers@postgresql.org; Sat, 08 Aug 2015 17:23:55 +0000 Received: by wicne3 with SMTP id ne3so91908517wic.1 for ; Sat, 08 Aug 2015 10:23:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=qYWsV2JBUkLA+CbYifIRA9koNSk7tEbPVLPZu+fJW8k=; b=w0tHdXiDGFrrxpfjF6L2rLBBd/1eD6lhpz9iY+cBL4fRnJe4TT0XystNAf+/DJa/sY bpO636ooyhj2Pli50kb4/4LtVMx53Y8SBpoiJiJGjXQ/dqnV81lcB6SAVBpzudxM5l+r AMF4WDwcFjrDLFwQbbjQ8bVbPjh866fGUzuMH+w3a/2LOmhgiGc5uZ27igg3Ijxhckzt THXapKxglfF3T8Rrt9Dbw9nxyUfKUFDjUhMfVlOebfnbaOQF/vHwHixLNswMmpqe9gAn J84oNmhpH/MbyVupgRY1lDOPr3aOLBHVy0/vbEvT2V5Vp2zrsqQfDkHGr1eCUUic0A9d lrSA== X-Received: by 10.180.85.194 with SMTP id j2mr8624757wiz.11.1439054625788; Sat, 08 Aug 2015 10:23:45 -0700 (PDT) Received: from [192.168.1.105] (dsl-hkibrasgw1-58c38f-82.dhcp.inet.fi. [88.195.143.82]) by smtp.gmail.com with ESMTPSA id fo1sm4643622wib.24.2015.08.08.10.23.44 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 08 Aug 2015 10:23:45 -0700 (PDT) Message-ID: <55C63B1E.2040101@iki.fi> Date: Sat, 08 Aug 2015 20:23:42 +0300 From: Heikki Linnakangas User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.8.0 MIME-Version: 1.0 To: Robert Haas , Michael Paquier CC: pgsql-hackers Subject: Re: WIP: SCRAM authentication References: <55192AFE.6080106@iki.fi> <55C4FCC2.3000503@iki.fi> In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Pg-Spam-Score: -2.3 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-hackers Precedence: bulk Sender: pgsql-hackers-owner@postgresql.org On 08/08/2015 04:27 PM, Robert Haas wrote: > I don't see that there's any good reason to allow the same password to > be stored in the catalog encrypted more than one way, Sure there is. If you want to be able to authenticate using different mechanism, you need the same password "encrypted" in different ways. SCRAM uses verifier that's derived from the password in one way, MD5 authentication needs an MD5 hash, and yet other protocols have other requirements. > and I don't think there's any good reason to introduce the PASSWORD > VERIFIER terminology. I think we should store (1) your password, > either encrypted or unencrypted; and (2) the method used to encrypt > it. And that's it. Like Joe and Stephen, I actually find it highly confusing that we call the MD5 hash an "encrypted password". The term "password verifier" is fairly common in the specifications of authentication mechanisms. I think we should adopt it. - Heikki -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers