pg.ddx.io pgsql-hackers@postgresql.org mailing list archive help / color / mirror / Atom feed From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: David Steele <david@pgmasters.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: David Fetter <david@fetter.org>
Cc: Alvaro Herrera <alvherre@2ndquadrant.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Julian Markwort <julian.markwort@uni-muenster.de>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Valery Popov <v.popov@postgrespro.ru>
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
Date: Fri, 9 Dec 2016 10:11:17 +0200
Message-ID: <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi> (raw )
In-Reply-To: <CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com >
References: <947b9aff-8fdb-dbf5-a99c-0ffd4523a73f@2ndquadrant.com >
<CA+TgmoaeBqkXhmuu5n1AbTyC7Lz9WPHMkOxnF_hvbqpz-Sf_sA@mail.gmail.com >
<20161117003628.xonaz4p3lavrif6u@alap3.anarazel.de >
<CA+TgmoZjjvDvdwkDDwVdi5D+GkDheU87y0YRug5wHwODrmcyAQ@mail.gmail.com >
<CAB7nPqRkUxmNzkho_5hNQhoH-CutPvSM7pvMToZkJt8QVRM08g@mail.gmail.com >
<CAB7nPqQ3SasLdKfUDFFCdpDLxXG6+4+_8MEgivWzGGaZP4MkAQ@mail.gmail.com >
<CA+TgmoYydfT0ZwPaCMZannstRG207Ymf3s_aWTxkNJx9SBfm4Q@mail.gmail.com >
<CAB7nPqTAKNSBT6zzX8H0R8EwJ24Y8YsPmOqb3j38uzCoU_3+=A@mail.gmail.com >
<CAB7nPqSNMvJO50nJFoprf-wMMa281gJ-G6hfOr+krm8Zh8WLBg@mail.gmail.com >
<CAB7nPqRF=kVxqtC+Ei_t7eTrMti_0P+xUugSOd_7-rcLvREYzw@mail.gmail.com >
<e139fcbc-cfb2-3a64-93ac-afd5ba342960@iki.fi >
<CAB7nPqSqEwRgmVCS_OW3sJn6baymQ6MsO3kKMRvHLC0RZaKaYA@mail.gmail.com >
<21eecdb8-365b-8347-1ae2-5278d1fe798c@iki.fi >
<CAB7nPqT2UGWm0ukdomC+mG-co6nmKer62vuSGRxwtc+jS8uQPA@mail.gmail.com >
<CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com >
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Couple of things I should write down before I forget:
1. It's a bit cumbersome that the scram verifiers stored in
pg_authid.rolpassword don't have any clear indication that they're scram
verifiers. MD5 hashes are readily identifiable by the "md5" prefix. I
think we should use a "scram-sha-256:" for scram verifiers.
Actually, I think it'd be awfully nice to also prefix plaintext
passwords with "plain:", but I'm not sure it's worth breaking the
compatibility, if there are tools out there that peek into rolpassword.
Thoughts?
2. It's currently not possible to use the plaintext "password"
authentication method, for a user that has a SCRAM verifier in
rolpassword. That seems like an oversight. We can't do MD5
authentication with a SCRAM verifier, but "password" we could.
- Heikki
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
view thread (149+ messages) latest in thread
Message-ID: <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi>
Permalink: ../762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi/
Also on: postgresql.org/message-id/762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi
copy link · copy postgr.es
reply Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: hlinnaka@iki.fi, michael.paquier@gmail.com, robertmhaas@gmail.com, andres@anarazel.de, peter.eisentraut@2ndquadrant.com, david@pgmasters.net, tgl@sss.pgh.pa.us, david@fetter.org, alvherre@2ndquadrant.com, magnus@hagander.net, julian.markwort@uni-muenster.de, sfrost@snowman.net, v.popov@postgrespro.ru
Subject: Re: Password identifiers, protocol aging and SCRAM protocol
In-Reply-To: <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox