| From: | Bruce Momjian <bruce(at)momjian(dot)us> |
|---|---|
| To: | Jeffrey Walton <noloader(at)gmail(dot)com> |
| Cc: | pgsql-bugs(at)postgresql(dot)org |
| Subject: | Re: postmaster.c and random keys/salts |
| Date: | 2013-11-19 18:25:29 |
| Message-ID: | 20131119182529.GQ28149@momjian.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On Wed, Nov 13, 2013 at 03:23:29AM -0500, Jeffrey Walton wrote:
> The following is used to key a channel (it appears to be used in the
> AUTH_REQ_MD5 in fe-auth.c).
>
> Four bytes is a tad bit small, and time based does not leave much to
> the imagination. Also, it looks like its susceptible to VM roillbacks.
Yes, it is too small. The odds of salt replay are in the 10k-connection
range. However, to fix it, we would need a new wire protocol version.
:-(
--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ Everyone has their own god. +
| From | Date | Subject | |
|---|---|---|---|
| Next Message | oleg_ispu | 2013-11-19 19:49:24 | BUG #8607: ilike operator |
| Previous Message | Tom Lane | 2013-11-19 17:52:11 | Re: BUG #8605: Regular expression lazy quantification issue |