Get Your Insecure PostgreSQL Passwords to SCRAM!
summary
PostgreSQL stores passwords with SCRAM-SHA-256 using PBKDF2-style hashing (default iterations=4096 and a 16‑byte salt) so servers keep only stored and server keys instead of plaintext or MD5 hashes. Channel binding lands in newer releases and PostgreSQL 14 makes SCRAM the default; drivers can prehash and psql’s \password builds SCRAM secrets. Upgrades require setting password_encryption to scram-sha-256, rehashing user passwords (or forcing pg_hba.conf to SCRAM) and verifying TLS/channel binding.
AI-written summary · about
chapters (15)
- 0:00Start
- 4:20Plaintext password authentication flow
- 10:08Does eavesdropping work?
- 12:38Salted Challenge Response Authentication Mechanism
- 14:11Creating a SCRAM secret
- 18:40Building a SCRAM secret -STORED KEY
- 20:19Building a SCRAM secret - SERVER KEY
- 21:52Do we care about eavesdropping?
- 25:16SCRAM authentication flow - setup
- 26:28Recall: CLIENT KEY
- 27:19CLIENT SIGNATURE
- 28:02SCRAM authentication flow - Generating client proof
- 30:40SERVER SIGNATURE
- 34:24Channel binding
- 36:01How to upgrade to use SCRAM
related talks
55mGet Your Insecure PostgreSQL Passwords to SCRAM!
54mConfiguration and Authentication
50mSecuring PostgreSQL From External Attack
35mSecuring PostgreSQL From External Attack
32mEnhancing Security in PostgreSQL
32mPostgreSQL Security: Defending Against External Attacks
22mFrom trust to Tokens: A Short History of PostgreSQL Authentication
50mSecuring PostgreSQL