| From: | Alessandro Gherardi <alessandro(dot)gherardi(at)yahoo(dot)com> |
|---|---|
| To: | Michael Paquier <michael(at)paquier(dot)xyz> |
| Cc: | "pgsql-general(at)lists(dot)postgresql(dot)org" <pgsql-general(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: scram-sha-256 authentication broken in FIPS mode |
| Date: | 2018-09-07 06:27:33 |
| Message-ID: | 1924578892.946938.1536301653576@mail.yahoo.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-general |
Hi Michael,
I'm attaching the output of diff <updated source file> <original source file>.
> If we could prove that sha2-openssl.c is actually
unreliable even if FIPS is enabled system-wide with either SCRAM
authentication or any of the other hashing functions, then I would be
ready to accept a patch. Now, as far as I can see and heard from other
folks for at least Linux, if FIPS is enabled at the OS level, then
Postgres would use it automatically and SCRAM is able to work.
Not sure why it works on Linux but not on Windows. That the low-level digest APIs can't be used when FIPS is enabled is by design, other people have encountered that problem, e.g., http://openssl.6102.n7.nabble.com/Low-Level-Digest-if-Fips-mode-td54983.html .
Thanks,Alessandro
| Attachment | Content-Type | Size |
|---|---|---|
| be-secure-openssl.c.diff | application/octet-stream | 1.1 KB |
| fe-secure-openssl.c.diff | application/octet-stream | 1.0 KB |
| sha2.h.diff | application/octet-stream | 123 bytes |
| sha2_openssl.c.diff | application/octet-stream | 517 bytes |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | jimmy | 2018-09-07 06:31:44 | Re:Re: Re: How to install pgAgent on windows for postresql-bigsql-10.5 |
| Previous Message | Ron | 2018-09-07 06:21:26 | pgbackrest when data/base is symlinked to another volume |