| From: | Joe Conway <mail(at)joeconway(dot)com> |
|---|---|
| To: | Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> |
| Cc: | Daniel Gustafsson <daniel(at)yesql(dot)se>, Peter Eisentraut <peter(at)eisentraut(dot)org>, Robert Haas <robertmhaas(at)gmail(dot)com>, "Koshi Shibagaki (Fujitsu)" <shibagaki(dot)koshi(at)fujitsu(dot)com>, "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: Replace current implementations in crypt() and gen_salt() to OpenSSL |
| Date: | 2024-10-29 17:34:08 |
| Message-ID: | 0372c1ab-41cb-4e86-9e72-03b51576f26a@joeconway.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On 10/29/24 12:52, Jacob Champion wrote:
> On Sat, Oct 26, 2024 at 11:10 AM Joe Conway <mail(at)joeconway(dot)com> wrote:
>> Rather than depend on figuring out if we are in FIPS_mode in a portable
>> way, I think the GUC is simpler and sufficient. Why not do that and just
>> use a better name, e.g. legacy_crypto_enabled or something similar
>> (bike-shedding welcomed) as in the attached.
>
> While it's definitely simpler, I read the original request as "forbid
> non-FIPS crypto if the system tells us to", and I don't think this
> proposal does that.
No, you just have to be able to configure the system in such a way that
the non-FIPs crypto is not available. This is entirely sufficient for that.
--
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tristan Partin | 2024-10-29 17:40:06 | Re: RFC: Extension Packaging & Lookup |
| Previous Message | Tom Lane | 2024-10-29 17:19:22 | Re: Alias of VALUES RTE in explain plan |