Date: Wed, 2 Mar 2022 09:55:15 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Michael Paquier <michael@paquier.xyz>, Tom Lane <tgl@sss.pgh.pa.us>,
	Jeff Davis <pgsql@j-davis.com>,
	samay sharma <smilingsamay@gmail.com>,
	pgsql-hackers@lists.postgresql.org
Subject: Re: Proposal: Support custom authentication methods using hooks
Message-ID: <Yh+FU5vQZYoaOrMl@momjian.us>
References: <54dc198b56a87e31e9625405383f04a8c6589b8b.camel@j-davis.com>
 <1905579.1645810764@sss.pgh.pa.us>
 <2718414dc095b716e59e126c03af343997d14c7b.camel@j-davis.com>
 <1980351.1645816239@sss.pgh.pa.us>
 <9004b18218eae293f1ee888e49d13d8a6b02810d.camel@j-davis.com>
 <20220228204634.GM10577@tamriel.snowman.net>
 <2738622.1646083128@sss.pgh.pa.us>
 <20220228214255.GO10577@tamriel.snowman.net>
 <Yh28j5PoG+mtAnSH@paquier.xyz>
 <20220301133119.GR10577@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220301133119.GR10577@tamriel.snowman.net>
Archived-At: <https://www.postgresql.org/message-id/Yh%2BFU5vQZYoaOrMl%40momjian.us>
Precedence: bulk

On Tue, Mar  1, 2022 at 08:31:19AM -0500, Stephen Frost wrote:
> > The last time I played with this area is the recent error handling
> > improvement with cryptohashes but MD5 has actually helped here in
> > detecting the problem as a patched OpenSSL would complain if trying to
> > use MD5 as hash function when FIPS is enabled.
> 
> Having to continue to deal with md5 as an algorithm when it's known to
> be notably less secure and so much so that organizations essentially ban
> its use for exactly what we're using it for, in fact, another reason to

Really?  I thought it was publicly-visible MD5 hashes that were the
biggest problem.  Our 32-bit salt during the connection is a problem, of
course.

> remove it, not a reason to keep it.  Better code coverage testing of
> error paths is the answer to making sure that our error handling behaves
> properly.

What is the logic to removing md5 but keeping 'password'?

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.