Horton

SCRAM salt length

Peter Eisentraut <peter.eisentraut@2ndquadrant.com>

View thread View on postgr.es
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2017-08-16T13:10:51Z
Lists: pgsql-hackers 
The SCRAM salt length is currently set as

/* length of salt when generating new verifiers */
#define SCRAM_DEFAULT_SALT_LEN     12

without further comment.

I suspect that this length was chosen based on the example in RFC 5802
(SCRAM-SHA-1) section 5.  But the analogous example in RFC 7677
(SCRAM-SHA-256) section 3 uses a length of 16.  Should we use that instead?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

Commits

  1. Increase SCRAM salt length

  2. Make SCRAM salts and nonces longer.