Re: SCRAM with channel binding downgrade attack

Peter Eisentraut <peter.eisentraut@2ndquadrant.com>

From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>

To: Bruce Momjian <bruce@momjian.us>

Cc: Heikki Linnakangas <hlinnaka@iki.fi>, Michael Paquier <michael@paquier.xyz>, Magnus Hagander <magnus@hagander.net>, PostgreSQL-development <pgsql-hackers@postgresql.org>, Stephen Frost <sfrost@snowman.net>

Date: 2018-10-08T10:42:39Z

Lists: pgsql-hackers

On 05/10/2018 19:01, Bruce Momjian wrote:
> On Fri, Oct  5, 2018 at 04:53:34PM +0200, Peter Eisentraut wrote:
>> On 23/05/2018 08:46, Heikki Linnakangas wrote:
>>> "tls-unique" and "tls-server-end-point" are overly technical to users. 
>>> They don't care which one is used, there's no difference in security. 
>>
>> A question was raised about this in a recent user group meeting.
>>
>> When someone steals the server certificate from the real database server
>> and sets up a MITM with that certificate, this would pass
>> tls-server-end-point channel binding, because both the MITM and the real
>> server have the same certificate.  But with tls-unique they would have
>> different channel binding data, so the channel binding would detect this.
>>
>> Is that not correct?
> 
> Not correct.  First, they need to steal the server certificate and
> _private_ key that goes with the certificate to impersonate the owner of
> the certificate.

Right, I meant to imply that.

> If that happens, with tls-server-end-point, a MITM
> could replay what the real server sends to the MITM.  You are right that
> tls-unique makes it harder for a MITM to reproduce the TLS shared key
> which is mixed with the password hash to prove the server knows the
> password hash.

So you appear to be saying the above *is* correct?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

Commits

doc: update PG 11 release notes
- 6eb612fea9d0 12.0 cited
Fix misspelled pg_trgm contrib name in PostgreSQL 11 release notes
- 3abc5a67edfd 12.0 landed
Doc: clarify release note text about v11's new window function features.
- 510421c45fb4 11.0 landed
- 11a3aeeb5e17 12.0 landed
Improve wording of release notes item
- bee6a683a5c3 11.0 landed
Fix typos in release notes
- fb6accd27b99 11.0 landed
Doc: preliminary list of PG11 major features.
- 4aad161c9a6d 11.0 landed
Make numeric power() handle NaNs according to the modern POSIX spec.
- d1fc750b5199 11.0 landed
Various improvements of skipping index scan during vacuum technics
- 8e12f4a250d2 11.0 cited
Revert back-branch changes in power()'s behavior for NaN inputs.
- f74d83b3034f 10.4 cited
Avoid wrong results for power() with NaN input on more platforms.
- 6bdf1303b34b 11.0 cited
Avoid wrong results for power() with NaN input on some platforms.
- 61b200e2f582 11.0 cited
Skip full index scan during cleanup of B-tree indexes when possible
- 857f9c36cda5 11.0 cited
Rewrite the code that applies scan/join targets to paths.
- 11cf92f6e2e1 11.0 cited
Postpone generate_gather_paths for topmost scan/join rel.
- 3f90ec8597c3 11.0 cited
Add casts from jsonb
- c0cbe00fee6d 11.0 cited
Make plpgsql use its DTYPE_REC code paths for composite-type variables.
- 4b93f57999a2 11.0 cited
Don't allow VACUUM VERBOSE ANALYZE VERBOSE.
- 921059bd66c7 11.0 cited
Pass InitPlan values to workers via Gather (Merge).
- e89a71fb449a 11.0 cited
Account for the effect of lossy pages when costing bitmap scans.
- 5edc63bda68a 11.0 cited
Allow no-op GiST support functions to be omitted.
- d3a4f89d8a3e 11.0 cited
Rearm statement_timeout after each executed query.
- f8e5f156b30e 11.0 cited
Push limit through subqueries to underlying sort, where possible.
- 1f6d515a67ec 11.0 cited