Horton

Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Joe Conway <mail@joeconway.com>

View thread View on postgr.es
From: Joe Conway <mail@joeconway.com>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Daniel Gustafsson <daniel@yesql.se>, Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2024-10-29T17:34:08Z
Lists: pgsql-hackers 
On 10/29/24 12:52, Jacob Champion wrote:
> On Sat, Oct 26, 2024 at 11:10 AM Joe Conway <mail@joeconway.com> wrote:
>> Rather than depend on figuring out if we are in FIPS_mode in a portable
>> way, I think the GUC is simpler and sufficient. Why not do that and just
>> use a better name, e.g. legacy_crypto_enabled or something similar
>> (bike-shedding welcomed) as in the attached.
> 
> While it's definitely simpler, I read the original request as "forbid
> non-FIPS crypto if the system tells us to", and I don't think this
> proposal does that.


No, you just have to be able to configure the system in such a way that 
the non-FIPs crypto is not available. This is entirely sufficient for that.


-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support