Re: SCRAM with channel binding downgrade attack - Mailing list pgsql-hackers

From Peter Eisentraut
Subject Re: SCRAM with channel binding downgrade attack
Date
Msg-id 41559c12-4656-14ec-2b64-0d1b9c1b43cb@2ndquadrant.com
Whole thread Raw
In response to Re: SCRAM with channel binding downgrade attack  (Michael Paquier <michael@paquier.xyz>)
List pgsql-hackers
On 29.06.18 04:16, Michael Paquier wrote:
> I am able to find easily drafts of TLS 1.3, but I am not seeing an RFC
> associated to it, which would be the base document to rely on I
> guess...  So that's really hard to make any decision in this area
> without the real deal.  As far as I can see tls-unique could be
> deprecated and replaced, but from OpenSSL point of view it technically
> works.

At this point, I think we can leave it as is until they came out with a
new channel binding type.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


pgsql-hackers by date:

Previous
From: Euler Taveira
Date:
Subject: Re: Comment refers to non existent function IncreaseRestartDecodingForSlot
Next
From: Peter Eisentraut
Date:
Subject: TLS 1.3 and OpenSSL