Repository navigation
SCRAM-SHA-***(-PLUS) supports #4
Description
After:
- SCRAM-SHA-1
Can you add supports of:
- SCRAM-SHA-1-PLUS
- SCRAM-SHA-256
- SCRAM-SHA-256-PLUS
- SCRAM-SHA-512
- SCRAM-SHA-512-PLUS
- SCRAM-SHA3-512
- SCRAM-SHA3-512-PLUS
You can add too:
- SCRAM-SHA-224
- SCRAM-SHA-224-PLUS
- SCRAM-SHA-384
- SCRAM-SHA-384-PLUS
"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".
-
SCRAM-SHA-1(-PLUS):
-- https://tools.ietf.org/html/rfc5802
-- https://tools.ietf.org/html/rfc6120 -
SCRAM-SHA-256(-PLUS):
-- https://tools.ietf.org/html/rfc7677 since 2015-11-02
-- https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA -
SCRAM-SHA-512(-PLUS):
-- https://tools.ietf.org/html/draft-melnikov-scram-sha-512 -
SCRAM-SHA3-512(-PLUS):
-- https://tools.ietf.org/html/draft-melnikov-scram-sha3-512 -
SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:
-- https://tools.ietf.org/html/draft-melnikov-scram-bis
https://xmpp.org/extensions/inbox/hash-recommendations.html
-PLUS variants:
- RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
- RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
- Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
- RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266
IMAP:
- RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051
LDAP:
- RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803
HTTP:
- RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804
2FA:
- Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://datatracker.ietf.org/doc/html/draft-ietf-kitten-scram-2fa
IANA:
- Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml
Linked to:
Activity
[-]SCRAM-SHA-***-PLUS supports[/-][+]SCRAM-SHA-***(-PLUS) supports[/+]fabiang commentedon Dec 3, 2019
Please feel free to implement those and add a pull request. Thank you!
Neustradamus commentedon Sep 22, 2021
@fabiang: Have you looked on it?
Thanks in advance.
fabiang commentedon Apr 19, 2022
If you need them, please create a PR and I'll be happy to add them. Thanks.
fabiang commentedon May 15, 2023
Closing this due age. PR is still very welcome for this.
Neustradamus commentedon May 15, 2023
@fabiang: The problem is always here, it is not a solution to close it...
fabiang commentedon Nov 20, 2023
I was able to add support for some of the algos.
The following authentication methods were supported before and I've also updated the integration tests to test them:
Those should have been working before, but I can't test them automatically
This should be working now, but can't be tested either:
Also I'm unable to add support for all the *-PLUS algorithms since OpenSSL/PHP doesn't have an API for channel binding (same problem as in #11) .
Neustradamus commentedon Nov 20, 2023
@fabiang: Thanks a lot for your commit!
Can you add topics in your repo?
ejabberd: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS):
Tigase XMPP Server: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS):
MongooseIM supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-224(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS), SCRAM-SHA-512(-PLUS) | Without CB 1.3:
Metronome IM supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS), SCRAM-SHA-512(-PLUS) | Without CB 1.3:
Jackal supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS), SCRAM-SHA3-512(-PLUS) | Without CB 1.3:
Prosody supports: SCRAM-SHA-1(-PLUS) and SCRAM-SHA-256(-PLUS):
fabiang commentedon Nov 20, 2023
What topics you're talking about? Is there any server software available that supports
SCRAM-SHA3-512?Neustradamus commentedon Nov 20, 2023
At right here: https://github.com/fabiang/sasl (gear) ^^
There are several lists, search SHA3 here:
fabiang commentedon Nov 20, 2023
I don't see any server software that supports
scram-sha3-*. I've added the other supported algos as topics.Neustradamus commentedon Nov 20, 2023
@fabiang: Jackal but it is now a dead project: https://github.com/search?q=repo%3Aortuman%2Fjackal+sha3&type=code
Neustradamus commentedon Dec 12, 2023
@fabiang: Recently some SCRAM hashes have been added in:
A good job done by @schengawegga.
Maybe you can help for -PLUS variants?
And for repositories:
Neustradamus commentedon Oct 24, 2026
@fabiang: Have you seen my comment about the good @Sjord PHP work?
Linked to: