Expected behavior

Password should be transmitted in plain text (cleartext), without md5 hashing. Because MD5 is not FIPS compliant.

Actual behavior

Password always uses md5 hashing.

Steps to reproduce

pg_hba.conf file has "md5" option. It cannot be changed to "password" in my case. Role in pg_authid has password with "md5" prefix.

According to PostgreSQL documentation (https://www.postgresql.org/docs/11/auth-password.html):

If a password was encrypted using the md5 setting, then it can be used only for the md5 and password authentication method specifications (again, with the password transmitted in plain text in the latter case).

How password can be transmitted in plain text (cleartext), without md5 hashing?

Used libraries

• pg-promise: 10.11.0
• pg-protocol: 1.5.0
• pg (https://www.npmjs.com/package/pg): 8.7.1

PostgreSQL version: 9.3

Node.js: 12.20.1

OS: Linux/Mac