search

ongres / scram

SCRAM (RFC 5802) Java implementation
BSD 2-Clause "Simplified" License
26 stars 11 forks source link

Implement Channel Binding #2

Closed davecramer closed 6 months ago

davecramer commented 6 years ago

PostgreSQL 11 will have channel binding. We'll need to extend the TLS interface to provide access to the Finished message and the peer certificate.

Neustradamus commented 3 years ago

@davecramer, @ongres, @ahachete: It is supported no?

Linked to:

Neustradamus commented 2 years ago

@davecramer: Ping?

davecramer commented 2 years ago

@Neustradamus this is more for @ahachete to implement

Neustradamus commented 2 years ago

It is official, it is here: RFC 9266: Channel Bindings for TLS 1.3:

Neustradamus commented 10 months ago

Dear @ongres team, @ahachete,

I think that you have seen the jabber.ru MITM and Channel Binding is the solution:

Linked to:

jorsol commented 7 months ago

Status update:

Getting the channel-binding data from an external security layer such as that provided by TLS is out of the scope for implementation in this library, TLS channel-binding data can be fetched using a library dedicated like the Bouncy Castle Crypto APIs.

Having said that, the channel binding type used by PostgreSQL is tls-server-end-point, it could be fetched using Java's APIs without external libraries, and since this library was developed primarily to support SCRAM in PostgreSQL from Java, it could perfectly include a utility class to extract the cbind-data from the peer certificate.

This will be included in the next major release of the SCRAM library 3.0 which is being actively worked on, but there is no ETA for a final release yet.

Neustradamus commented 6 months ago

@jorsol: It has been solved?

davecramer commented 6 months ago

So what do we have to do with the JDBC driver to make this work. Just update the version ?

jorsol commented 6 months ago

@jorsol: It has been solved?

For the PostgreSQL JDBC Driver use, yes.

So what do we have to do with the JDBC driver to make this work. Just update the version ?

https://github.com/pgjdbc/pgjdbc/pull/3188

Right now is in draft, maven central is having sync issues and the jars are not available yet. Also need to check what the pipeline has to say and fix it.

Neustradamus commented 6 months ago

@jorsol: Good job about 3.0!

Important to specify in the ticket where it has been added.