Thanks for your attention to this. I'm definitely not a cryptography expert, but it seems to me that the actual mechanisms (MD5, SHA-256) are more important than the protocols used to negotiate them (SASL, SCRAM). When some security expert unfamiliar with PostgreSQL goes over itss documentation to determine whether it's secure, I think it's important to make sure that the word SHA-256 is actually there.
On Sat, Feb 3, 2018 at 8:30 AM, Peter Eisentraut < peter.eisentr...@2ndquadrant.com> wrote: > On 2/2/18 18:42, PG Doc comments form wrote: > > The following documentation comment has been logged on the website: > > > > Page: https://www.postgresql.org/docs/10/static/encryption-options.html > > Description: > > > > Section "18.8. Encryption Options" only mentions MD5 as the password > storage > > encryption mechanism, although PostgreSQL 10 introduced the superior > SHA256 > > - somebody looking at the docs would get a bad idea of PostgreSQL's > > capabilities... > > I propose the attached patch. I have combined the password storage and > password transmission items, because I don't want to go into the details > of how SCRAM works on the wire. > > -- > Peter Eisentraut http://www.2ndQuadrant.com/ > PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services >
