On Sun, Jul 3, 2016 at 4:54 AM, Heikki Linnakangas <hlinn...@iki.fi> wrote: > I took a quick look at the patch set now again, and except that it needs to > have the multiple password verifier support refactored out, I think it's in > a pretty good shape. I don't like the pg_upgrade changes and its support > function, that also seems like an orthogonal or add-on feature that would be > better discussed separately. I think pg_upgrade should just do the upgrade > with as little change to the system as possible, and let the admin > reset/rehash/deprecate the passwords separately, when she wants to switch > all users to SCRAM. So I suggest that we rip out those changes from the > patch set as well.
That's as well what I recall from the consensus at PGCon: only focus on the protocol addition and storage of the scram verifier. It was not mentioned directly but that's what I guess should be done. So no complains here. > In related news, RFC 7677 that describes a new SCRAM-SHA-256 authentication > mechanism, was published in November 2015. It's identical to SCRAM-SHA-1, > which is what this patch set implements, except that SHA-1 has been replaced > with SHA-256. Perhaps we should forget about SCRAM-SHA-1 and jump straight > to SCRAM-SHA-256. That's to consider. I don't thing switching to that is much complicated. > RFC 7677 also adds some verbiage, in response to vulnerabilities that have > been found with the "tls-unique" channel binding mechanism: > >> To be secure, either SCRAM-SHA-256-PLUS and SCRAM-SHA-1-PLUS MUST be >> used over a TLS channel that has had the session hash extension >> [RFC7627] negotiated, or session resumption MUST NOT have been used. > > So that doesn't affect details of the protocol per se, but once we implement > channel binding, we need to check for those conditions somehow (or make sure > that OpenSSL checks for them). Yes. > Michael, do you plan to submit a new version of this patch set for the next > commitfest? I'd like to get this committed early in the 9.7 release cycle, > so that we have time to work on all the add-on stuff before the release. Thanks. That's good news! Yes, I am still on track to submit a patch for CF1. -- Michael -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
