Use SCRAM-SHA-256 for passwords on PostgreSQL server, drop MD5

Description

MD5 is the only password storage hashing algorithm that is supported by PG 9.x. And it's legacy, i. e. broken beyond repair and hope. PG 10 introduced SCRAM-SHA-256. Not only is sha256 a stronger and - for the foreseeable future - secure hashing algorithm, it also is salted and bundled with salted challenge response authentication, which doesn't expose passwords to sniffing parties on the network. Even if database breaches are something that seems like a worst case scenario, exposing passwords due to weak hashes during a breach will put a lot of users under fire, since we all know a lot of people recycle their passwords. SCRAM-SHA-256 won't be breakable for quite some time (as of current knowledge), and the salting counters rainbow table attacks too.
There also is the problem that MD5 hashed passwords are incompatible with SCRAM-SHA-256 authentication, so upgrading and using the better algorithm is only possible by resetting all passwords, which is a nightmare in its own right.

This requires

The old deprecated client https://github.com/vert-x3/vertx-mysql-postgresql-client / https://github.com/vert-x3/vertx-sql-common only supports MD5, it doesn't support SCRAM.

If all subtasks are finished add a note how to configure PostgreSQL for SCRAM-SHA-256 to all installation documentation documents.

Environment

None

Potential Workaround

None

Checklist

hide

TestRail: Results

Activity

Show:

Craig McNally October 14, 2021 at 3:15 PM

 to follow up with CP team and on the spring way question above.

Craig McNally October 14, 2021 at 3:14 PM

We may need another related ticket for folio-spring-base...  

Johannes Drexl December 20, 2019 at 3:17 PM

Details

Assignee

Reporter

Priority

Development Team

Core: Platform

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs

Created December 20, 2019 at 3:08 PM
Updated May 5, 2022 at 11:25 AM
TestRail: Cases
TestRail: Runs