Update encryption options doc for SCRAM-SHA-256
Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.
You can run a PostgreSQL built from this patch straight from Docker, with no checkout and no build:
docker run --rm -p 5432:5432 ghcr.io/hackorum-dev/postgres-patch:t76143psql -h localhost -U postgresBuilt from patchset v2 (message #2), July 27, 2026 at 09:11 PM.
Every patchset is also pushed to a branch of our PostgreSQL fork, so you can check out the same tree CI built. Without a PostgreSQL checkout:
git clone --branch t76143_2 https://github.com/hackorum-dev/postgres.gitIn a checkout you already have, add the fork once:
git remote add hackorum https://github.com/hackorum-dev/postgres.gitthen, for this patchset and every later one:
git fetch hackorum t76143_2 && git checkout t76143_2Patchset v2 (message #2) is on t76143_2
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/10/static/encryption-options.html
Description:
Section "18.8. Encryption Options" only mentions MD5 as the password storage
encryption mechanism, although PostgreSQL 10 introduced the superior SHA256
- somebody looking at the docs would get a bad idea of PostgreSQL's
capabilities...
On 2/2/18 18:42, PG Doc comments form wrote:
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/10/static/encryption-options.html
Description:Section "18.8. Encryption Options" only mentions MD5 as the password storage
encryption mechanism, although PostgreSQL 10 introduced the superior SHA256
- somebody looking at the docs would get a bad idea of PostgreSQL's
capabilities...
I propose the attached patch. I have combined the password storage and
password transmission items, because I don't want to go into the details
of how SCRAM works on the wire.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Thanks for your attention to this.
I'm definitely not a cryptography expert, but it seems to me that the
actual mechanisms (MD5, SHA-256) are more important than the protocols used
to negotiate them (SASL, SCRAM). When some security expert unfamiliar with
PostgreSQL goes over itss documentation to determine whether it's secure, I
think it's important to make sure that the word SHA-256 is actually there.
On Sat, Feb 3, 2018 at 8:30 AM, Peter Eisentraut <
peter.eisentraut@2ndquadrant.com> wrote:
Show quoted text
On 2/2/18 18:42, PG Doc comments form wrote:
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/10/static/encryption-options.html
Description:Section "18.8. Encryption Options" only mentions MD5 as the password
storage
encryption mechanism, although PostgreSQL 10 introduced the superior
SHA256
- somebody looking at the docs would get a bad idea of PostgreSQL's
capabilities...I propose the attached patch. I have combined the password storage and
password transmission items, because I don't want to go into the details
of how SCRAM works on the wire.--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services