Re: reducing our reliance on MD5

On 02/11/2015 03:14 PM, Magnus Hagander wrote:
>
> [snip]
> The hash value in pg_authid already contains "md5" as a prefix. No
> need for another column.

Yes, but for variable length mechanism names (i.e. not just 3 chars) it
would become increasingly difficult to differentiate between the algo
name and the stored credentials.... especially if we delegated the list
of available mechanisms to an external library and/or in the case of
upgrades.
(variable-length matching based on a table of available mechs and
using strncmp isn't complicated, admittedly .... but why bother?)

... plus we have already added many new columns to store the new
"capabilities" in, as opposed to a bitmask.

I might well be overlooking something else, of course.

Regards,

/ J.L.