| From: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
|---|---|
| To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
| Cc: | Stephen Frost <sfrost(at)snowman(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Álvaro Hernández Tortosa <aht(at)8kdata(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>, PostgreSQL JDBC List <pgsql-jdbc(at)postgresql(dot)org> |
| Subject: | Re: [JDBC] Channel binding support for SCRAM-SHA-256 |
| Date: | 2017-05-31 01:39:52 |
| Message-ID: | CAB7nPqShOtc15RyUrsX31StGOXwT9hDW1MPt49_OiR50p-sfSw@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers pgsql-jdbc |
On Tue, May 30, 2017 at 5:59 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> That sounds like undue optimism to me. Unless somebody's tested that
> Michael's proposed implementation, which uses undocumented OpenSSL
> APIs, actually interoperates properly with a SCRAM + channel binding
> implementation based on some other underlying SSL implementation, we
> can't really know that it's going to work. It's not like we're
> calling SSL_do_the_right_thing_for_channel_binding_thing_per_rfc5929().
> We're calling SSL_do_something_undocumented() and hoping that
> something_undocumented ==
> the_right_thing_for_channel_binding_thing_per_rfc5929. Could be true,
> but without actual interoperability testing it sounds pretty
> speculative to me.
Hm? Python is using that stuff for a certain amount of years now, for
the same goal of providing channel binding for SSL authentication. You
can look at this thread:
https://bugs.python.org/issue12551
So qualifying that as a speculative method sounds a quite hard word to me.
--
Michael
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Michael Paquier | 2017-05-31 01:45:39 | Re: TAP backpatching policy |
| Previous Message | Michael Paquier | 2017-05-31 01:36:46 | Re: pg_config --version-num |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Álvaro Hernández Tortosa | 2017-05-31 01:50:26 | Re: [JDBC] Channel binding support for SCRAM-SHA-256 |
| Previous Message | Robert Haas | 2017-05-31 00:59:13 | Re: [JDBC] Channel binding support for SCRAM-SHA-256 |