Horton

RE: Replace current implementations in crypt() and gen_salt() to OpenSSL

Koshi Shibagaki (Fujitsu) <shibagaki.koshi@fujitsu.com>

View thread View on postgr.es
From: "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>
To: 'Daniel Gustafsson' <daniel@yesql.se>, Peter Eisentraut <peter@eisentraut.org>
Cc: "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2024-02-20T09:56:27Z
Lists: pgsql-hackers 
Let me confirm the discussion in threads. I think there are two topics.
1. prohibit the use of ciphers disallowed in FIPS mode at the level of block 
cipher (crypt-bf, etc...) in crypt() and gen_salt()
2. adding new "crypt-aes" module.

If this is correct, I would like to make a patch for the first topic, as I think
I can handle it. 
Daniel, please let me know if you have been making a patch based on the idea.


Also, I think the second one should be discussed in a separate thread, so could 
you split it into a separate thread?

Thank you

-----------------------------------------------
Fujitsu Limited
Shibagaki Koshi
shibagaki.koshi@fujitsu.com

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support