Horton

Re: Password identifiers, protocol aging and SCRAM protocol

Heikki Linnakangas <hlinnaka@iki.fi>

View thread View on postgr.es
From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: David Steele <david@pgmasters.net>, Tom Lane <tgl@sss.pgh.pa.us>, Robert Haas <robertmhaas@gmail.com>, David Fetter <david@fetter.org>, Alvaro Herrera <alvherre@2ndquadrant.com>, Magnus Hagander <magnus@hagander.net>, Peter Eisentraut <peter.eisentraut@2ndquadrant.com>, Julian Markwort <julian.markwort@uni-muenster.de>, Stephen Frost <sfrost@snowman.net>, PostgreSQL mailing lists <pgsql-hackers@postgresql.org>, Valery Popov <v.popov@postgrespro.ru>
Date: 2016-09-28T10:03:31Z
Lists: pgsql-hackers 
On 09/28/2016 12:53 PM, Heikki Linnakangas wrote:
> On 09/26/2016 09:02 AM, Michael Paquier wrote:
>>> * [PATCH 2/8] Move encoding routines to src/common/
>>>>
>>>> I wonder if it is confusing to have two of encode.h/encode.c.  Perhaps
>>>> they should be renamed to make them distinct?
>> Yes it may be a good idea to rename that, like encode_utils.[c|h] for
>> the new files.
>
> Looking at these encoding functions, the SCRAM protocol actually uses
> base64 for everything.

Oh, one more thing. The SCRAM spec says:

> The use of base64 in SCRAM is restricted to the canonical form with
> no whitespace.

Our b64_encode routine does use whitespace, so we can't use it as is for 
SCRAM. As the patch stands, we might never output anything long enough 
to create linefeeds, but let's be tidy. The base64 implementation is 
about 100 lines of code, so perhaps we should just leave 
src/backend/utils/encode.c alone, and make a new copy of the base64 
routines in src/common.

- Heikki

Commits

  1. Support SCRAM-SHA-256 authentication (RFC 5802 and 7677).

  2. Refactor SHA2 functions and move them to src/common/.

  3. Replace isMD5() with a more future-proof way to check if pw is encrypted.

  4. Remove bogus notice that older clients might not work with MD5 passwords.

  5. Refactor the code for verifying user's password.

  6. Replace PostmasterRandom() with a stronger source, second attempt.

  7. Remove support for (insecure) crypt authentication.