| From: | Jacob Champion <jchampion(at)timescale(dot)com> |
|---|---|
| To: | Michael Paquier <michael(at)paquier(dot)xyz> |
| Cc: | Postgres hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | Re: Support tls-exporter as channel binding for TLSv1.3 |
| Date: | 2022-09-20 18:51:44 |
| Message-ID: | CAAWbhmj8zoDz3JRbUAi4JACTi-OcQxiWddbZJ5wA3yowrXdugg@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Tue, Sep 20, 2022 at 11:01 AM Jacob Champion <jchampion(at)timescale(dot)com> wrote:
> Well, I'm working on a next version, but it's ballooning in complexity
> as I try to navigate the fix for OpenSSL 1.0.1 (which is currently
> failing the tests, unsurprisingly).
To be more specific: I think I'm hitting the case that Heikki pointed
out several years ago [1]:
> The problematic case is when e.g. the server
> only supports tls-unique and the client only supports
> tls-server-end-point. What we would (usually) like to happen, is to fall
> back to not using channel binding. But it's not clear how to make that
> work, and still protect from downgrade attacks.
The problem was deferred when tls-unique was removed. We might have to
actually solve it now.
bcc: Heikki, in case he would like to weigh in.
--Jacob
[1] https://www.postgresql.org/message-id/ec787074-2305-c6f4-86aa-6902f98485a4%40iki.fi
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2022-09-20 18:56:47 | Re: A question about wording in messages |
| Previous Message | James Coleman | 2022-09-20 18:34:48 | Re: Auto explain after query timeout |