mirror of
https://github.com/postgres/postgres.git
synced 2025-04-21 12:05:57 +03:00
035f99cbeb
When using OpenSSL and/or the underlying operating system in FIPS mode no non-FIPS certified crypto implementations should be used. While that is already possible by just not invoking the built-in crypto in pgcrypto, this adds a GUC which prohibit the code from being called. This doesn't change the FIPS status of PostgreSQL but can make it easier for sites which target FIPS compliance to ensure that violations cannot occur. Author: Daniel Gustafsson <daniel@yesql.se> Author: Joe Conway <mail@joeconway.com> Reviewed-by: Joe Conway <mail@joeconway.com> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com> Discussion: https://postgr.es/m/16b4a157-9ea1-44d0-b7b3-4c85df5de97b@joeconway.com
28 lines
685 B
SQL
28 lines
685 B
SQL
--
|
|
-- crypt() and gen_salt(): crypt-des
|
|
--
|
|
|
|
SELECT crypt('', 'NB');
|
|
|
|
SELECT crypt('foox', 'NB');
|
|
|
|
-- We are supposed to pass in a 2-character salt.
|
|
-- error since salt is too short:
|
|
SELECT crypt('password', 'a');
|
|
|
|
CREATE TABLE ctest (data text, res text, salt text);
|
|
INSERT INTO ctest VALUES ('password', '', '');
|
|
|
|
UPDATE ctest SET salt = gen_salt('des');
|
|
UPDATE ctest SET res = crypt(data, salt);
|
|
SELECT res = crypt(data, res) AS "worked"
|
|
FROM ctest;
|
|
|
|
-- check disabling of built in crypto functions
|
|
SET pgcrypto.builtin_crypto_enabled = off;
|
|
UPDATE ctest SET salt = gen_salt('des');
|
|
UPDATE ctest SET res = crypt(data, salt);
|
|
RESET pgcrypto.builtin_crypto_enabled;
|
|
|
|
DROP TABLE ctest;
|