pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: José Luis Tallón <jltallon@adv-solutions.net>
To: Robert Haas <robertmhaas@gmail.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Julian Markwort <julian.markwort@uni-muenster.de>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: David Steele <david@pgmasters.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Valery Popov <v.popov@postgrespro.ru>
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Wed, 30 Mar 2016 18:31:11 +0200
Message-ID: <56FBFF4F.9080505@adv-solutions.net> (raw)
In-Reply-To: <CA+TgmoahM22VCuNtM-33WE56WCQ59o_jbF0A3VChdwZ4paaesw@mail.gmail.com>
References: <CAB7nPqSMXU35g=W9X74HVeQp0uvgJxvYOuA4A-A3M+0wfEBv-w@mail.gmail.com>
	<56E6D98F.1070701@pgmasters.net>
	<CAB7nPqQYim-=PBHa19p04wSBbgGT=+ts1qWeQj2FG9HSmBX78Q@mail.gmail.com>
	<CAB7nPqTssJpBUZ8g9oUTPJ6RPLCZYFtPypzdYgHL1gtuskxwkw@mail.gmail.com>
	<56EAF483.3030307@pgmasters.net>
	<CAB7nPqTkoC4NLyyivz2=usUOo47iZnS+2e14nkmVKM3P8hWqwA@mail.gmail.com>
	<CA+TgmoYeui5crJyn4xxCZLUnxjtcZ1bzzF9-YN9NOQ-wr2f_uw@mail.gmail.com>
	<20160318181252.GA3127@tamriel.snowman.net>
	<CA+TgmobPNhnnMjOwG6s7zFznzh7g3JsUkLFvQBnh4+Ua++_6qA@mail.gmail.com>
	<CAB7nPqRChAg7fUMZJ3FJpVjzaq9yYDPzxtBLOHVMnwjDAgyx=w@mail.gmail.com>
	<CA+TgmoY790rphHBogXMbTG6MzSeNdoxdBXebEkAet9ZpZ8gvtw@mail.gmail.com>
	<CAB7nPqSHTF3pSz1_rQFE74gGUg8dpyP2kNGiw-Eu_DHEoi+okA@mail.gmail.com>
	<CABUevExLdymjo_vDCvE4WCsHdp-tjpTMOJgwyQ23y-gFoCAVrQ@mail.gmail.com>
	<56FAB0D3.6070003@uni-muenster.de>
	<CAB7nPqSjwsY4hYaKh-w4u0EB+YaxnQi7R63J9KgwcRe+RbaXTA@mail.gmail.com>
	<CA+TgmoahM22VCuNtM-33WE56WCQ59o_jbF0A3VChdwZ4paaesw@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 03/30/2016 06:14 PM, Robert Haas wrote:
> So basically the use of the ENCRYPTED keyword means "if it does 
> already seem to be the sort of MD5 blob we're expecting, turn it into 
> that". 

If it does NOT already seem to be... I guess?

> And we just rely on the format to distinguish between an MD5 verifier 
> and an unencrypted password. Personally, I think a good start here, 
> and I think you may have something like this in the patch already, 
> would be to split rolpassword into two columns, say rolencryption and 
> rolpassword. 

This inches closer to Michael's suggestion to have multiple verifiers 
per pg_authid user ...

> rolencryption says how the password verifier is encrypted and 
> rolpassword contains the verifier itself. Initially, rolencryption 
> will be 'plain' or 'md5', but later we can add 'scram' as another 
> choice, or maybe it'll be more specific like 'scram-hmac-doodad'.

May I suggest using  "{" <scheme>["."<encoding>] "}" just like Dovecot does?

e.g. "{md5.hex}e748797a605a1c95f3d6b5f140b2d528"

where no "{ ... }" prefix means just fallback to the old method of 
trying to guess what the blob contains?
     This would invalidate PLAIN passwords beginning with "{", though, 
so some measures would be needed.

> And then maybe introduce syntax like this: alter user rhaas set 
> password 'raw-unencrypted-passwordt' using 'verifier-method'; alter 
> user rhaas set password verifier 'verifier-goes-here' using 
> 'verifier-method'; That might require making verifier a key word, 
> which would be good to avoid. Perhaps we could use "password 
> validator" instead? 

I'd like USING best ... though by prepending the schema for ENCRYPTED, 
the required information is already conveyed within the verifier, so no 
need to specify it again :)


Just my .02€


     / J.L.



-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (149+ messages)  latest in thread

Message-ID: <56FBFF4F.9080505@adv-solutions.net>
Permalink:  ../56FBFF4F.9080505@adv-solutions.net/
Also on:    postgresql.org/message-id/56FBFF4F.9080505@adv-solutions.net

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: jltallon@adv-solutions.net, robertmhaas@gmail.com, michael.paquier@gmail.com, julian.markwort@uni-muenster.de, magnus@hagander.net, sfrost@snowman.net, david@pgmasters.net, v.popov@postgrespro.ru
  Subject: Re: Password identifiers, protocol aging and SCRAM protocol
  In-Reply-To: <56FBFF4F.9080505@adv-solutions.net>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox