Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to SCRAM 3.0 and support channel binding #1430

Closed
jorsol opened this issue Apr 6, 2024 · 1 comment · Fixed by #1431
Closed

Update to SCRAM 3.0 and support channel binding #1430

jorsol opened this issue Apr 6, 2024 · 1 comment · Fixed by #1431

Comments

@jorsol
Copy link
Contributor

jorsol commented Apr 6, 2024

Describe the feature

The vertx-pg-client should update to the latest SCRAM library 3.0 com.ongres.scram:scram-client:3.0 and add support to channel binding with PostgreSQL.

Use cases

Channel binding is a security technique used in encrypted connections to prevent Man-in-the-Middle (MitM) attacks. It works by creating a unique fingerprint of the communication channel based on details specific to that connection. This fingerprint helps ensure that the encrypted communication is happening on the intended channel and not a compromised one impersonated by an attacker.

Contribution

I'm volunteering to implement this feature (maintainer of the SCRAM 3.0 release).

@jorsol
Copy link
Contributor Author

jorsol commented Apr 11, 2024

Since PostgreSQL 14+, the default value for password_encryption is scram-sha-256, this dependency should not be marked as optional to avoid recurring issues of failed authentication reports (due to the missing dependency).

So, should I remove the optional tag from the dependency declaration?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant