From a89357e2f7839f5bc0815f4cf9e565cd3ad7a185 Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Tue, 26 Jun 2018 14:31:57 -0400 Subject: [PATCH] |--- gitweb/email subject limit -----------------|-------------| doc: PG 11 relnotes: remove channel binding from major features Also move to the source code section, and expand the paragraph --- doc/src/sgml/release-11.sgml | 59 ++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 30 deletions(-) diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml index 25b2ab19f2..53b600b453 100644 --- a/doc/src/sgml/release-11.sgml +++ b/doc/src/sgml/release-11.sgml @@ -99,13 +99,6 @@ - - - Channel binding for SCRAM authentication, to prevent potential - man-in-the-middle attacks on database connections - - - Many other useful performance improvements, including making @@ -1230,29 +1223,6 @@ same commits as above - - - Add libpq option to support channel binding when using SCRAM - authentication (Michael Paquier) - - - - While SCRAM always prevents the - replay of transmitted hashed passwords in a later - session, SCRAM with channel binding - also prevents man-in-the-middle attacks. The options are - and . - - - - - @@ -2646,6 +2616,35 @@ same commits as above + + + Add ability to use channel binding when using SCRAM + authentication (Michael Paquier) + + + + While SCRAM always prevents the + replay of transmitted hashed passwords in a later session, + SCRAM with channel binding can also prevent + man-in-the-middle attacks. However, since there is no way + to force channel binding in libpq, + the feature currently does not prevent man-in-the-middle + attacks when using libpq and interfaces built using it. It is + expected that future versions of libpq and interfaces not built + using libpq, e.g. JDBC, will allow this capability. The libpq + options to control the optional channel binding type are + and . + + + + +