Horton

Re: SCRAM salt length

Robert Haas <robertmhaas@gmail.com>

View thread View on postgr.es
From: Robert Haas <robertmhaas@gmail.com>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Michael Paquier <michael.paquier@gmail.com>, Aleksander Alekseev <a.alekseev@postgrespro.ru>, Peter Eisentraut <peter.eisentraut@2ndquadrant.com>, pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2017-08-17T14:03:53Z
Lists: pgsql-hackers 
On Thu, Aug 17, 2017 at 9:21 AM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
> Different thing. That was the nonce length, now we're talking about salt
> length.

Actually that commit (0557a5dc2cf845639d384801b6861ebbd35dc7ee) changed both:

-#define SCRAM_RAW_NONCE_LEN         10
+#define SCRAM_RAW_NONCE_LEN         18

 /* length of salt when generating new verifiers */
-#define SCRAM_DEFAULT_SALT_LEN      10
+#define SCRAM_DEFAULT_SALT_LEN      12

I don't think I understand exactly how they're different; especially,
I don't quite understand how the nonce is used.

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Commits

  1. Increase SCRAM salt length

  2. Make SCRAM salts and nonces longer.