Date: Wed, 9 Oct 2024 14:55:16 -0500
From: Nathan Bossart <nathandbossart@gmail.com>
To: pgsql-hackers@postgresql.org
Subject: sunsetting md5 password support
Message-ID: <ZwbfpJJol7lDWajL@nathan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Archived-At: <https://www.postgresql.org/message-id/ZwbfpJJol7lDWajL%40nathan>
Precedence: bulk

In this message, I propose a multi-year, incremental approach to remove MD5
password support from Postgres.

The problems with MD5 password hashes in Postgres are well-understood, so I
won't discuss them in too much detail here.  But suffice it to say that MD5
has been considered to be unsuitable for use as a cryptographic hash
algorithm for some time [0], and cracking MD5-hashed passwords is trivial
on modern hardware [1].  Furthermore, MD5 password hashes in Postgres are
vulnerable to pass-the-hash attacks [2] [3], i.e., knowing the username and
hashed password is sufficient to authenticate.

The SCRAM-SHA-256 method added in v10 is not subject to these problems and
AFAIK is generally considered far superior.  Since v14, this method has
been the default for the password_encryption parameter, which determines
the algorithm to use to store new passwords on disk (unless the password
has already been hashed by the client, as is recommended).

Given there is a battle-tested alternative to MD5, I propose we take the
following steps.  I am not wedded to the exact details, but I feel that
this would be a reasonably conservative path forward.

 1.  In v18, continue to support MD5 passwords, but place several notes in
     the documentation and release notes that unambiguously indicate that
     MD5 password support is deprecated and will be removed in a future
     release.

 2.  In v19, allow upgrading with MD5 passwords and allow authenticating
     with them, but disallow creating new ones (i.e., restrict/remove
     password_encryption and don't allow setting pre-hashed MD5 passwords).

 3.  In v20, allow upgrading with MD5 passwords, but disallow using them
     for authentication.  Users would only be able to update these
     passwords to SCRAM-SHA-256 after upgrading.

 4.  In v21, disallow upgrading with MD5 passwords.  At this point, there
     should be no remaining MD5 password support in Postgres.

With this plan, the first version with all MD5 password support removed
would be released in 2028.  Considering SCRAM-SHA-256 was first introduced
in 2017 and has been the default for password_encryption since 2021, users
will have had several years to migrate.

Thoughts?

[0] https://en.wikipedia.org/wiki/MD5#Security
[1] https://www.postgresql.org/docs/devel/pgcrypto.html#PGCRYPTO-HASH-SPEED-TABLE
[2] https://hashcat.net/misc/postgres-pth/postgres-pth.pdf
[3] https://www.postgresql.org/docs/devel/auth-password.html

-- 
nathan