Re: Successor of MD5 authentication, let's use SCRAM

On 09/12/2013 09:10 AM, Heikki Linnakangas wrote:
>
>
> Now, to a completely different approach:
>
> I just found out that OpenSSL has added support for SRP in version
> 1.0.1. We're already using OpenSSL, so all we need to do is to provide
> a couple of callbacks to OpenSSL, and store SRP verifiers in pg_authid
> instead of MD5 hashes, and we're golden.
>
> Well, not quite. There's one little problem: Currently, we first
> initialize SSL, then read the startup packet which contains the
> username and database to connect to. After that, we initialize
> database access to the specified database, and only then we proceed
> with authentication. That's not a problem for certificate
> authentication, because certificate authentication doesn't require any
> database access, but if we are to store the SRP verifiers in
> pg_authid, we'll need to database access much earlier. Before we know
> which database to connect to.
>
>

You forgot to mention that we'd actually like to get away from being
tied closely to OpenSSL because it has caused license grief in the past
(not to mention that it's fairly dirty to manage).

cheers

andrew