Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

On 11/20/24 12:14, Daniel Gustafsson wrote:
>> On 19 Nov 2024, at 18:30, Joe Conway <mail@joeconway.com> wrote:
> 
>> Any other opinions out there?
> 
> Couldn't installations who would be satisfied with a GUC gate revoke privileges
> from the relevant functions already today and achieve almost the same result?

I think that would qualify as a "mitigation" but not "FIPS compliant".

When the OS is made FIPS compliant, for example, you run something on 
the command line and then you need to reboot (RHEL at least). I believe 
that is considered configuration for FIPS.

A postmaster GUC (requiring restart) would be a way to configure 
Postgres to eliminate these two non-FIPS functions that could not be 
undone without another restart (similar to the OS example above).

-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com