Re: SCRAM with channel binding downgrade attack

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Michael Paquier <michael(at)paquier(dot)xyz>
Cc: Magnus Hagander <magnus(at)hagander(dot)net>, Heikki Linnakangas <hlinnaka(at)iki(dot)fi>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Stephen Frost <sfrost(at)snowman(dot)net>
Subject: Re: SCRAM with channel binding downgrade attack
Date: 2018-05-18 02:48:48
Message-ID: 20180518024848.GA3088@momjian.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers pgsql-www

On Fri, May 18, 2018 at 10:46:46AM +0900, Michael Paquier wrote:
> On Thu, May 17, 2018 at 10:05:25AM -0400, Bruce Momjian wrote:
> > Agreed. The problem was so glaring that I assumed I was not
> > understanding it. I have modified this email subject so users will
> > hopefully read back in this thread to see the details.
>
> Okay, let's use this new thread then for the follow-up discussion. For
> people wondering, this basically refers to the following message from
> Bruce and Heikki:
> https://www.postgresql.org/message-id/d01b31f5-0b3e-b69a-1504-a79649d81f46@iki.fi

FYI, it was only glaring to me because I have spent so many months
recently studying security.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Peter Eisentraut 2018-05-18 02:55:02 Re: Odd procedure resolution
Previous Message Bruce Momjian 2018-05-18 02:44:44 Re: Is a modern build system acceptable for older platforms

Browse pgsql-www by date

  From Date Subject
Next Message Michael Paquier 2018-05-18 03:03:49 Re: SCRAM with channel binding downgrade attack
Previous Message Michael Paquier 2018-05-18 01:46:46 Re: SCRAM with channel binding downgrade attack