From: Peter Eisentraut Date: Thu, 24 Aug 2017 18:04:28 +0000 (-0400) Subject: Increase SCRAM salt length X-Git-Tag: REL_11_BETA1~1741 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fe7774144d5c3f3a2941a2ca51e61352e4005991;p=postgresql Increase SCRAM salt length The original value 12 was set based on RFC 5802 for SCRAM-SHA-1, but RFC 7677 for SCRAM-SHA-256 uses 16, so use that. (This does not affect the validity of already stored verifiers.) Discussion: https://www.postgresql.org/message-id/flat/12cc9297-7e05-932f-d863-765e5626ead4%402ndquadrant.com --- diff --git a/src/include/common/scram-common.h b/src/include/common/scram-common.h index ebb733df4b..0c5ee04f26 100644 --- a/src/include/common/scram-common.h +++ b/src/include/common/scram-common.h @@ -28,10 +28,17 @@ */ #define SCRAM_RAW_NONCE_LEN 18 -/* length of salt when generating new verifiers */ -#define SCRAM_DEFAULT_SALT_LEN 12 +/* + * Length of salt when generating new verifiers, in bytes. (It will be stored + * and sent over the wire encoded in Base64.) 16 bytes is what the example in + * RFC 7677 uses. + */ +#define SCRAM_DEFAULT_SALT_LEN 16 -/* default number of iterations when generating verifier */ +/* + * Default number of iterations when generating verifier. Should be at least + * 4096 per RFC 7677. + */ #define SCRAM_DEFAULT_ITERATIONS 4096 /*