Re: [JDBC] Channel binding support for SCRAM-SHA-256

From: Robert Haas <robertmhaas(at)gmail(dot)com>
To: Michael Paquier <michael(dot)paquier(at)gmail(dot)com>
Cc: Stephen Frost <sfrost(at)snowman(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Álvaro Hernández Tortosa <aht(at)8kdata(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>, PostgreSQL JDBC List <pgsql-jdbc(at)postgresql(dot)org>
Subject: Re: [JDBC] Channel binding support for SCRAM-SHA-256
Date: 2017-06-06 15:35:49
Message-ID: CA+TgmoYH=T1Hp9p0n3aT6b=A5kjtTb1GmwXDiGTtoLz3coWe9Q@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers pgsql-jdbc

On Tue, Jun 6, 2017 at 2:32 AM, Michael Paquier
<michael(dot)paquier(at)gmail(dot)com> wrote:
>>> At the end,
>>> everything has been rejected as Postgres enforces the use of the
>>> newest one when doing the SSL handshake.
>>
>> TLS implementations, or TLS versions? What does the TLS version have
>> to do with this issue?
>
> I really mean *version* here.

I don't think it's true that we force the latest TLS version to be
used. The comment says:

/*
* We use SSLv23_method() because it can negotiate use of the highest
* mutually supported protocol version, while alternatives like
* TLSv1_2_method() permit only one specific version. Note
that we don't
* actually allow SSL v2 or v3, only TLS protocols (see below).
*/

IIUC, this is specifically so that we don't force the use of TLS 1.2
or TLS 1.1 or TLS 1.0.

It could well be that there's something I don't understand here.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Kevin Hale Boyes 2017-06-06 15:37:10 Re: sketchy partcollation handling
Previous Message Bruce Momjian 2017-06-06 15:31:21 Re: Extra Vietnamese unaccent rules

Browse pgsql-jdbc by date

  From Date Subject
Next Message Tom Lane 2017-06-06 16:21:02 Re: [HACKERS] Channel binding support for SCRAM-SHA-256
Previous Message Stephen Frost 2017-06-06 12:29:25 Re: [HACKERS] Channel binding support for SCRAM-SHA-256