Subject: Re: Password identifiers, protocol aging and SCRAM protocol
To: Michael Paquier <michael.paquier@gmail.com>
References: <947b9aff-8fdb-dbf5-a99c-0ffd4523a73f@2ndquadrant.com>
 <CA+TgmoaeBqkXhmuu5n1AbTyC7Lz9WPHMkOxnF_hvbqpz-Sf_sA@mail.gmail.com>
 <20161117003628.xonaz4p3lavrif6u@alap3.anarazel.de>
 <CA+TgmoZjjvDvdwkDDwVdi5D+GkDheU87y0YRug5wHwODrmcyAQ@mail.gmail.com>
 <CAB7nPqRkUxmNzkho_5hNQhoH-CutPvSM7pvMToZkJt8QVRM08g@mail.gmail.com>
 <CAB7nPqQ3SasLdKfUDFFCdpDLxXG6+4+_8MEgivWzGGaZP4MkAQ@mail.gmail.com>
 <CA+TgmoYydfT0ZwPaCMZannstRG207Ymf3s_aWTxkNJx9SBfm4Q@mail.gmail.com>
 <CAB7nPqTAKNSBT6zzX8H0R8EwJ24Y8YsPmOqb3j38uzCoU_3+=A@mail.gmail.com>
 <CAB7nPqSNMvJO50nJFoprf-wMMa281gJ-G6hfOr+krm8Zh8WLBg@mail.gmail.com>
 <CAB7nPqRF=kVxqtC+Ei_t7eTrMti_0P+xUugSOd_7-rcLvREYzw@mail.gmail.com>
 <e139fcbc-cfb2-3a64-93ac-afd5ba342960@iki.fi>
 <CAB7nPqSqEwRgmVCS_OW3sJn6baymQ6MsO3kKMRvHLC0RZaKaYA@mail.gmail.com>
 <21eecdb8-365b-8347-1ae2-5278d1fe798c@iki.fi>
 <CAB7nPqT2UGWm0ukdomC+mG-co6nmKer62vuSGRxwtc+jS8uQPA@mail.gmail.com>
 <CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>, Andres Freund <andres@anarazel.de>,
 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
 David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>,
 David Fetter <david@fetter.org>, Alvaro Herrera <alvherre@2ndquadrant.com>,
 Magnus Hagander <magnus@hagander.net>,
 Julian Markwort <julian.markwort@uni-muenster.de>,
 Stephen Frost <sfrost@snowman.net>,
 PostgreSQL mailing lists <pgsql-hackers@postgresql.org>,
 Valery Popov <v.popov@postgrespro.ru>
From: Heikki Linnakangas <hlinnaka@iki.fi>
Message-ID: <762f4875-a87e-cf0b-c06b-b357294d8be1@iki.fi>
Date: Fri, 9 Dec 2016 10:11:17 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Icedove/45.4.0
MIME-Version: 1.0
In-Reply-To: 
 <CAB7nPqQtD7jOpYCsB4Ga=Cz+tgh4Ngac6NAV-WLs9zxaw0Uu7w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

Couple of things I should write down before I forget:

1. It's a bit cumbersome that the scram verifiers stored in 
pg_authid.rolpassword don't have any clear indication that they're scram 
verifiers. MD5 hashes are readily identifiable by the "md5" prefix. I 
think we should use a "scram-sha-256:" for scram verifiers.

Actually, I think it'd be awfully nice to also prefix plaintext 
passwords with "plain:", but I'm not sure it's worth breaking the 
compatibility, if there are tools out there that peek into rolpassword. 
Thoughts?

2. It's currently not possible to use the plaintext "password" 
authentication method, for a user that has a SCRAM verifier in 
rolpassword. That seems like an oversight. We can't do MD5 
authentication with a SCRAM verifier, but "password" we could.

- Heikki


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers