Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support PostgreSQL SCRAM-SHA-256 #5735

Open
solardiz opened this issue Mar 29, 2025 · 1 comment
Open

Support PostgreSQL SCRAM-SHA-256 #5735

solardiz opened this issue Mar 29, 2025 · 1 comment

Comments

@solardiz
Copy link
Member

There's apparently a common kind of encoding for SCRAM verifiers, which we don't support yet:

https://github.com/search?q=SCRAM-SHA-256%24&type=code

// AsPasswordString returns the password as defined in https://www.postgresql.org/docs/15/catalog-pg-authid.html
func (password ScramSha256Password) AsPasswordString() string {
	return fmt.Sprintf(`SCRAM-SHA-256$%d:%s$%s:%s`,
		password.Iterations, password.Salt.ToBase64(), password.StoredKey.ToBase64(), password.ServerKey.ToBase64())

https://github.com/svenvc/P3/blob/master/P3/P3SCRAM.class.st

About PostgreSQL's password storage 

If you execute 'SELECT rolname,rolpassword FROM pg_authid' with enough privileges,
you can see how PostgreSQL stores passwords. In the case of SCRAM-SHA-256, 
rolpassword seems to have the following format (using terms used in this implementation): 

SCRAM-SHA-256$<iterations>:<salt(base64>$<storedKey(base64>:<serverKey(base64)>

To support the colons, we need a prepare method that would turn these strings into what can go into john.pot, or a 2john script.

@solardiz solardiz added this to the Potentially 2.0.0 milestone Mar 29, 2025
@solardiz
Copy link
Member Author

To support the colons, we need a prepare method that would turn these strings into what can go into john.pot, or a 2john script.

To be clear, I think prepare is the better way to go, and a 2john script is a shortcut or fallback approach. @kholia

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant