Re: RFC: Make new versions of pgjdbc Java8+

On 03/04/17 17:28, Mark Rotteveel wrote:
> On 2017-04-03 13:36, Álvaro Hernández Tortosa wrote:
>> On 03/04/17 13:05, Dave Cramer wrote:
>> Alvaro,
>>
>>> So why do you want to write in java 8 ?
>>
>> Not a comprehensive or ordered list, but a few reasons:
>>
>> - JDK comes with Base64 and cryptographic functions like PBKDF2 that
>> are needed for SCRAM. In Java6 you either implement yourself or pull
>> external dependencies.
>
> Base64 can also be done using javax.xml.bind.DatatypeConverter
> (although that might be a dependency you don't want given it is not in
> the default modules of Java 9 and is slated for removal in Java 10(?)),

Exactly that's the point. Either I use a dependency now
(commons-codec) of I use DatatypeConverter, which will become
effectively a dependency with Java 9+.

> and otherwise implementing base 64 encoding or decoding is not rocket
> science.

That would be IMVHO, a waste of developer bandwidth. Re-inventing
the wheel is something I won't be doing at all.

> PBKDF2 has been in Java for awhile (see
> http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html,
> search for PBKDF2WithHmacSHA1)

Exception in thread "main" java.security.NoSuchAlgorithmException:
PBKDF2WithHmacSHA256 SecretKeyFactory not available

It is available for SHA1, but not SHA256 (which is the one used by
Postgres).

So it has to be coded by hand if using Java6.

Álvaro

--

Álvaro Hernández Tortosa

-----------
<8K>data