From: Robbie Harwood <rharwood@redhat.com>
To: Stephen Frost <sfrost@snowman.net>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: PostgreSQL mailing lists <pgsql-hackers@postgresql.org>
Cc: Nico Williams <nico@cryptonector.com>
Subject: Re: [PATCH v18] GSSAPI encryption support
Date: Mon, 06 Aug 2018 17:23:28 -0400
Message-ID: <jlgd0uvyysv.fsf@redhat.com> (raw)
In-Reply-To: <20180806143633.GJ27724@tamriel.snowman.net>
References: <jlg1tgq1ktm.fsf@thriss.redhat.com>
<jlg1se287n3.fsf@redhat.com>
<jlg602phyn5.fsf@redhat.com>
<82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi>
<20180806143633.GJ27724@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> * Heikki Linnakangas (hlinnaka@iki.fi) wrote:
>
>> What is the point of this patch? What's the advantage of GSSAPI
>> encryption over SSL? I was hoping to find the answer by reading the
>> documentation changes, but all I can see is "how" to set it up, and
>> nothing about "why".
>
> If you've already got an existing Kerberos environment, then it's a
> lot nicer to leverage that rather than having to also implement a full
> PKI to support and use SSL-based encryption.
>
> There's also something to be said for having alternatives to OpenSSL.
This exactly.
If you're in a position where you're using Kerberos (or most other
things from the GSSAPI) for authentication, the encryption comes at
little to no additional setup cost. And then you get all the security
benefits outlined in the docs changes.
Thanks,
--Robbie
Attachments:
signature.asc (application/pgp-signature, 832B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: rharwood@redhat.com, sfrost@snowman.net, hlinnaka@iki.fi, nico@cryptonector.com
Subject: Re: [PATCH v18] GSSAPI encryption support
In-Reply-To: <jlgd0uvyysv.fsf@redhat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox