Horton

Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Joe Conway <mail@joeconway.com>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "Hayato Kuroda (Fujitsu)" <kuroda.hayato@fujitsu.com>, Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2025-01-21T21:05:09Z
Lists: pgsql-hackers 
> On 21 Jan 2025, at 21:59, Tom Lane <tgl@sss.pgh.pa.us> wrote:

> (If we end up inventing a FIPS-mode flag, I would fully expect
> interested vendors to patch our code to force it on when the
> OS-level flag is set, which is exactly what they will have done
> to OpenSSL.  We should design our behavior with that in mind.)

This patch is essentially a FIPS-mode flag as it's designed to block the
built-in non-certified code in pgcrypto which ensures that OpenSSL is used for
all crypto operations.  When setting this GUC to "fips" it will match the
OpenSSL setting, disable built-in crypto when OpenSSL has FIPS enabled and
allow it when OpenSSL has FIPS disabled.  Setting it to off will disable
built-in crypto regardless of FIPS mode in OpenSSL.

--
Daniel Gustafsson

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support