Expected behavior
Password should be transmitted in plain text (cleartext), without md5 hashing. Because MD5 is not FIPS compliant.
Actual behavior
Password always uses md5 hashing.
Steps to reproduce
pg_hba.conf file has "md5" option. It cannot be changed to "password" in my case. Role in pg_authid has password with "md5" prefix.
According to PostgreSQL documentation (https://www.postgresql.org/docs/11/auth-password.html):
If a password was encrypted using the md5 setting, then it can be used only for the md5 and password authentication method specifications (again, with the password transmitted in plain text in the latter case).
How password can be transmitted in plain text (cleartext), without md5 hashing?
Used libraries
- pg-promise: 10.11.0
- pg-protocol: 1.5.0
- pg (https://www.npmjs.com/package/pg): 8.7.1
PostgreSQL version: 9.3
Node.js: 12.20.1
OS: Linux/Mac