Skip to content

Commit

Permalink
Add some technical info at the end of P3SCRAM's class comment
Browse files Browse the repository at this point in the history
  • Loading branch information
Sven Van Caekenberghe committed Nov 4, 2020
1 parent 8c62083 commit fd124a0
Showing 1 changed file with 11 additions and 0 deletions.
11 changes: 11 additions & 0 deletions P3/P3SCRAM.class.st
Expand Up @@ -45,6 +45,17 @@ Security note
The information held in my instances is sensitive.
For this reason, my class side store will be reset before each image save.
About PostgreSQL's password storage
If you execute 'SELECT rolname,rolpassword FROM pg_authid' with enough priviledges,
you can see how PostgreSQL stores passwords. In the case of SCRAM-SHA-256,
rolpassword seems to have the following format (using terms used in this implementation):
SCRAM-SHA-256$<iterations>:<salt(base64>$<storedKey(base64>:<serverKey(base64)>
Using iterations and salt, and of course the password itself, constitutes
enough information to calculate everything that does not depend on the nounces.
"
Class {
#name : #P3SCRAM,
Expand Down

0 comments on commit fd124a0

Please sign in to comment.