|--- gitweb/email subject limit -----------------|-------------|

doc:  PG 11 relnotes: remove channel binding from major features

Also move to the source code section, and expand the paragraph

diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml
index 25b2ab19f288dc3c63686f67ef1c0960e417e3c5..53b600b45366f85e335e0ef898637663ea2e632b 100644 (file)
--- a/doc/src/sgml/release-11.sgml
+++ b/doc/src/sgml/release-11.sgml
@@ -99,13 +99,6 @@
      
     
 
-    
-     
-      Channel binding for SCRAM authentication, to prevent potential
-      man-in-the-middle attacks on database connections
-     
-    
-
     
      
       Many other useful performance improvements, including making
@@ -1230,29 +1223,6 @@ same commits as above
 
       
 
-
-       
-        Add libpq option to support channel binding when using 
-        linkend="auth-password">SCRAM
-        authentication (Michael Paquier)
-       
-
-       
-        While SCRAM always prevents the
-        replay of transmitted hashed passwords in a later
-        session, SCRAM with channel binding
-        also prevents man-in-the-middle attacks.  The options are 
-        linkend="libpq-scram-channel-binding">scram_channel_binding=tls-unique
-        and scram_channel_binding=tls-server-end-point.
-       
-      
-
-      
-
 
@@ -2646,6 +2616,35 @@ same commits as above
 
       
 
+
+       
+        Add ability to use channel binding when using 
+        linkend="auth-password">SCRAM
+        authentication (Michael Paquier)
+       
+
+       
+        While SCRAM always prevents the
+        replay of transmitted hashed passwords in a later session,
+        SCRAM with channel binding can also prevent
+        man-in-the-middle attacks.  However, since there is no way
+        to force channel binding in libpq,
+        the feature currently does not prevent man-in-the-middle
+        attacks when using libpq and interfaces built using it.  It is
+        expected that future versions of libpq and interfaces not built
+        using libpq, e.g. JDBC, will allow this capability.  The libpq
+        options to control the optional channel binding type are 
+        linkend="libpq-scram-channel-binding">scram_channel_binding=tls-unique
+        and scram_channel_binding=tls-server-end-point.
+       
+      
+
+      
+