Postgres Pro
Downloads
Home   >   mailing lists

Re: Replace current implementations in crypt() and gen_salt() to OpenSSL - Mailing list pgsql-hackers

From Joe Conway
Subject Re: Replace current implementations in crypt() and gen_salt() to OpenSSL
Date
Msg-id 4f0b39e5-4ccb-4771-9f68-839d7d7e6014@joeconway.com
Whole thread Raw
In response to Re: Replace current implementations in crypt() and gen_salt() to OpenSSL  (Daniel Gustafsson <daniel@yesql.se>)
List pgsql-hackers
Tree view 
On 11/20/24 12:14, Daniel Gustafsson wrote:
>> On 19 Nov 2024, at 18:30, Joe Conway <mail@joeconway.com> wrote:
> 
>> Any other opinions out there?
> 
> Couldn't installations who would be satisfied with a GUC gate revoke privileges
> from the relevant functions already today and achieve almost the same result?

I think that would qualify as a "mitigation" but not "FIPS compliant".

When the OS is made FIPS compliant, for example, you run something on 
the command line and then you need to reboot (RHEL at least). I believe 
that is considered configuration for FIPS.

A postmaster GUC (requiring restart) would be a way to configure 
Postgres to eliminate these two non-FIPS functions that could not be 
undone without another restart (similar to the OS example above).

-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

pgsql-hackers by date:

Previous
From: Joe Conway
Date:
Subject: Re: Replace current implementations in crypt() and gen_salt() to OpenSSL
Next
From: Jacob Champion
Date:
Subject: Re: Windows pg_basebackup unable to create >2GB pg_wal.tar tarballs ("could not close file: Invalid argument" when creating pg_wal.tar of size ~ 2^31 bytes)