eclipse-vertx/vertx-sql-client

Update to SCRAM 3.0 and support channel binding

jorsol opened this issue · 1 comments

Describe the feature

The vertx-pg-client should update to the latest SCRAM library 3.0 com.ongres.scram:scram-client:3.0 and add support to channel binding with PostgreSQL.

Use cases

Channel binding is a security technique used in encrypted connections to prevent Man-in-the-Middle (MitM) attacks. It works by creating a unique fingerprint of the communication channel based on details specific to that connection. This fingerprint helps ensure that the encrypted communication is happening on the intended channel and not a compromised one impersonated by an attacker.

Contribution

I'm volunteering to implement this feature (maintainer of the SCRAM 3.0 release).

Since PostgreSQL 14+, the default value for password_encryption is scram-sha-256, this dependency should not be marked as optional to avoid recurring issues of failed authentication reports (due to the missing dependency).

So, should I remove the optional tag from the dependency declaration?