As designed by RFC 7677 and RFC 5802, SCRAM verifiers (please take this term as a password if you want, which means a proof of authentication) are defined with default parameters which make the computation of a proof costly, making it more expensive to do dictionary or brute-force attacks while offline. Longer nonces help in making the computation longer, but there are as well two parameters that help in deciding such computation time and strength to offline attacks:

A couple of days back a thread has showed up on pgsql-hackers to discuss about the possibility of a function scanning all the partitions of a chain to get its size. The thread is here.

It has been a long time since the last post. Today here is a post about the following feature that will land in Postgres 11:

A couple of days back a new feature has landed in the PostgreSQL world for the development of version 11, in the shape of the following commit:

The last round of minor releases of PostgreSQL has been released on the 10th of August with a couple of security problem addressed and many more bugs.

With the SCRAM implementation done in Postgres 10, it is time to move on with other things in this area. The next, and perhaps last, area of focus in the implementation of channel binding, on which a patch has been submitted for integration into Postgres 11.

The addition of SCRAM-SHA-256 is proving to have many benefits in PostgreSQL over MD5, but it has required an extension of the authentication protocol so as message exchanges for SASL authentication are able to work correctly. A lot of details on this matter are defined in the documentation:

Postgres 10 will be released in a couple of months, with its beta 1 to be out very soon, and for this release many small, incompatible changes have been introduced during its development to help with long-term maintenance. The full list of items is present in the release notes, and here are the changes that can have an impact on any applications relying of what PostgreSQL has provided up to now.

An important step in the SCRAM authentication is called SASLprep, a mandatory feature to be sure about the equivalence of two strings encoded with UTF-8. A first commit has added support for SCRAM-SHA-256 protocol with the full SASL exchange plugged on top of it, and this has been implemented by the following commit:

The following feature has landed in Postgres 10 to help system administrators: