Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fmmyh-0003ZE-5Z for pgsql-hackers@arkaria.postgresql.org; Mon, 06 Aug 2018 21:23:47 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fmmyf-00062H-3W for pgsql-hackers@arkaria.postgresql.org; Mon, 06 Aug 2018 21:23:45 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fmmye-00062A-SJ for pgsql-hackers@lists.postgresql.org; Mon, 06 Aug 2018 21:23:44 +0000 Received: from mx1.redhat.com ([209.132.183.28]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fmmyU-000671-V1 for pgsql-hackers@postgresql.org; Mon, 06 Aug 2018 21:23:43 +0000 Received: from smtp.corp.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E041A36807; Mon, 6 Aug 2018 21:23:31 +0000 (UTC) Received: from localhost (ovpn-112-60.rdu2.redhat.com [10.10.112.60]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9F96C30001E9; Mon, 6 Aug 2018 21:23:31 +0000 (UTC) From: Robbie Harwood To: Stephen Frost , Heikki Linnakangas Cc: PostgreSQL mailing lists , Nico Williams Subject: Re: [PATCH v18] GSSAPI encryption support In-Reply-To: <20180806143633.GJ27724@tamriel.snowman.net> References: <82e75cb9-9676-6852-74de-1454a5cc97d7@iki.fi> <20180806143633.GJ27724@tamriel.snowman.net> Date: Mon, 06 Aug 2018 17:23:28 -0400 Message-ID: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.84 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 06 Aug 2018 21:23:31 +0000 (UTC) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --=-=-= Content-Type: text/plain Stephen Frost writes: > * Heikki Linnakangas (hlinnaka@iki.fi) wrote: > >> What is the point of this patch? What's the advantage of GSSAPI >> encryption over SSL? I was hoping to find the answer by reading the >> documentation changes, but all I can see is "how" to set it up, and >> nothing about "why". > > If you've already got an existing Kerberos environment, then it's a > lot nicer to leverage that rather than having to also implement a full > PKI to support and use SSL-based encryption. > > There's also something to be said for having alternatives to OpenSSL. This exactly. If you're in a position where you're using Kerberos (or most other things from the GSSAPI) for authentication, the encryption comes at little to no additional setup cost. And then you get all the security benefits outlined in the docs changes. Thanks, --Robbie --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAltovFAACgkQJTL5F2qV pELpKA/5AScrOI66zD6X+VzfL4RF1CI4U4wU+qyxpw0wzvkCx3yVByiLoR1qZ5T+ YXk79k4Uh6+3mmYxQtCJ2ULMDuF8S13frBHc+eD8s0YVFe36ZMrI8Frs/btbNjzE Ev775JUnbga3PzyF4Sifi07/65MQQDfe5yaWSbD/lsK8U9rT/JyuG8hScKydvDW4 kykH9oYOJT6YUcF9/nbveOZZ5y0Y3GELLhK7nEshrrfC4Ix0TBPYAT8jWwqf7FWi VVVWGAqly1MQJN/6fZxFKjHGnkNfIqW2eF3SQJjaiRfLr1/8z3Zcqt90aGqo/Gcg hCCH5yZ6XElSCKo/T50mKB/Kh2ljW5uUDYVDSLlYGeR2y5f0Gal44DibnOYHKhND w8We7cE3AGsS/0HnXUwUW0An/aDUupvWGlJpE3orxzkMx36QPx4CZe11gPTiSxmn aJ8yaQCysbzfTnGHbQcVuhD7eEiCgVPNkUVdpk3e3Y5P5wmlybDHtvzZ2rHHy5tu H1sQtQWmybxCExCMjIOi13egRpuu/NcrUECg5HvUFS2+0KWWPQ3AFIghWNq97lll XTcDyASPHcfmucb1ksqmCYsMH/Mpoc7Ud0oH8UJ0wquIRHg7kBF/Hs5eYvsf5RHK Tu+4+IDCdYjr3VIecoKz+JO96mMLg6HD167koAzUzK5JkdVzNLQ= =LWuG -----END PGP SIGNATURE----- --=-=-=--