SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) supports #6917

Activity

1. alecpl

   added

   C: IMAP

   C: SMTP

   enhancement

   on Sep 8, 2019
2. alecpl

   added this to the later milestone on Sep 8, 2019
3. alecpl commented on Sep 8, 2019

   

   alecpl

   on Sep 8, 2019

   Member

   More actions

   Auth_SASL has some SCRAM support so it should be doable, but I will not give it a high prio. Any help appreciated.
4. Neustradamus commented on Sep 8, 2019

   

   Neustradamus

   on Sep 8, 2019

   Author

   More actions

   • There is: Auth_SASL2 : https://pear.php.net/package/Auth_SASL2
   • Maybe good to compare with Auth_SASL: https://pear.php.net/package/Auth_SASL

   It can be ok for 1.4?
5. alecpl commented on Sep 9, 2019

   

   alecpl

   on Sep 9, 2019

   Member

   More actions

   There's only one difference between these two libs. They handle errors differently. SO, there's no reason to switch.
6. Neustradamus commented on Sep 9, 2019

   

   Neustradamus

   on Sep 9, 2019

   Author

   More actions

   What is missing for SCRAM in 1.4 RC1 for 1.4 release?

   Note: SCRAM is for LDAP too.
7. alecpl commented on Sep 9, 2019

   

   alecpl

   on Sep 9, 2019

   Member

   More actions

   1. Make sure pear/Auth_SASL has everything you need. It might not support *-PLUS variants, but I didn't look at this.
   2. Add SCRAM auth support to rcube_imap_generic.
   3. Add SCRAM auth support to pear/Net_Sieve.
   4. Add SCRAM auth support to pear/Net_SMTP.
   5. Add SCRAM auth support to kolab/Net_LDAP3.
8. Neustradamus commented on Sep 9, 2019

   

   Neustradamus

   on Sep 9, 2019

   Author

   More actions

   Yes, I think it is not supported yet for -PLUS variants, but it is already good point :)
9. Neustradamus commented on Nov 15, 2019

   

   Neustradamus

   on Nov 15, 2019

   Author

   More actions

   @alecpl: Any news?
   I have seen that Roundcube 1.4 is out!
10. alecpl commented on Nov 16, 2019

    

    alecpl

    on Nov 16, 2019

    Member

    More actions

    I'm not working and not plan to work on this in foreseable future. It's not a prio for me. Pull requests appreciated.
11. Neustradamus commented on Nov 17, 2019

    

    Neustradamus

    on Nov 17, 2019

    Author

    More actions

    @alecpl, @kanarip: Can you look for kolab/Net_LDAP3 and SCRAM?
    I have looked here: https://git.kolab.org/diffusion/PNL/history/master/

    @alecpl: Your are here too :)

    • https://github.com/pear/Net_Sieve/commits/master
      Why you do not accept ticket here?

    I have done a ticket for pear/Net_SMTP: pear/Net_SMTP#57

    For pear/Auth_SASL, all except -PLUS variants are good.
12. Neustradamus

    changed the title [-]SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) supports[/-] [+]SCRAM-SHA-1-PLUS + SCRAM-SHA-256-PLUS + SCRAM-SHA-512-PLUS supports[/+] on Nov 1, 2020
13. Neustradamus

    changed the title [-]SCRAM-SHA-1-PLUS + SCRAM-SHA-256-PLUS + SCRAM-SHA-512-PLUS supports[/-] [+]SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) supports[/+] on Nov 1, 2020
14. Neustradamus commented on Nov 8, 2020

    

    Neustradamus

    on Nov 8, 2020

    Author

    More actions

    @alecpl: Can you add "Issues" section (or it must be owner of PEAR) in https://github.com/pear/Net_Sieve?

    Have you progressed on SCRAM?
    To have a best security?

    Note, after SCRAM-SHA-1(-PLUS):

    • GNU SASL (gsasl) supports SCRAM-SHA-256(-PLUS) since 1.9.1: http://git.savannah.gnu.org/gitweb/?p=gsasl.git;a=blob;f=NEWS;hb=HEAD
    • Dovecot supports SCRAM-SHA-256(-PLUS) since 2.3.10: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
    • Cyrus SASL/IMAP supports SCRAM-SHA-256(-PLUS) and more since 2.1.27: https://www.cyrusimap.org/sasl/sasl/authentication_mechanisms.html
    • ...
15. Neustradamus commented on Nov 17, 2020

    

    Neustradamus

    on Nov 17, 2020

    Author

    More actions

    @alecpl: SquirrelMail has SCRAM, it is possible to add in Roundcube?

    • https://github.com/RealityRipple/squirrelmail
16. Neustradamus commented on Jul 18, 2021

    

    Neustradamus

    on Jul 18, 2021

    Author

    More actions

    @alecpl: Have you progressed on it?
17. Neustradamus commented on Jan 7, 2022

    

    Neustradamus

    on Jan 7, 2022

    Author

    More actions

    Dear @roundcube team, @alecpl, @thomascube, @vbenincasa,

    Happy New Year 2022!

    Have you looked for SCRAM-SHA-* supports?
    The first step is without -PLUS variants.

    Thanks in advance.

    cc: @jparise
18. Neustradamus commented on Jan 12, 2022

    

    Neustradamus

    on Jan 12, 2022

    Author

    More actions

    I have forgotten to inform you, SCRAM-SHA-256/SCRAM-SHA-256-PLUS are in the new IMAP, I have added the last RFC in the description: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2:

    • https://tools.ietf.org/html/rfc9051

    I wish you a good reading ^^
19. pkolmann commented on Apr 27, 2023

    

    pkolmann

    on Apr 27, 2023

    More actions

    Please consider when implementing SCRAM-SHA-* that the whole SCRAM-algorithm should run on the Client, not the PHP on the server.

    UseCase: Company Firewall with deep packet inspection should not get the plaintext password in the HTTPS traffic...
20. Neustradamus commented on Oct 28, 2023

    

    Neustradamus

    on Oct 28, 2023

    Author

    More actions

    @roundcube team, @alecpl: Net_SMTP (with Auth_SASL/Auth_SASL2) has now SCRAM-SHA-* features, old mechanisms have been deprecated.
    Not yet -PLUS variants but a big progress done by @schengawegga and you can use.

    Can you look for rcube_imap_generic, Net_Sieve, Net_LDAP3?
21. Neustradamus commented on Nov 30, 2023

    

    Neustradamus

    on Nov 30, 2023

    Last edited by Neustradamus

    Author

    More actions

    Dear @karlitschek, @owncloud team, @roundcube team,

    Security is the number 1?

    • https://nextcloud.com/blog/open-source-email-pioneer-roundcube-comes-aboard-nextcloud/
    • https://nextcloud.com/blog/roundcubes-future-at-nextcloud-an-interview-with-the-founders/

    Can you confirm it and add SCRAM-SHA-* and SCRAM-SHA-*-PLUS supports in Roundcube, Nextcloud and deps?

    Thanks in advance.

    Roundcube, linked to (comment from @alecpl):

    • SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) supports #6917 (comment)

    Nextcloud, linked to:

    • https://github.com/search?q=org%3Anextcloud+scram&type=issues
    • Support strong authentication nextcloud/mail#3146
    • SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports nextcloud/server#39732
    • SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports symfony/symfony#51292
    • Add horde_stringprep to support SCRAM-SHA-1 nextcloud/mail#4377
    • https://github.com/nextcloud/mail/blob/098d808c7c1a9af47a83a9fb27446a092092de1c/CHANGELOG.md?plain=1#L763
    • https://bugs.horde.org/ticket/15146

    Linked to:

    • State of Play scram-sasl/info#1
22. Neustradamus commented on Dec 23, 2023

    

    Neustradamus

    on Dec 23, 2023

    Author

    More actions

    @alecpl: Can you look for rcube_imap_generic, Net_Sieve, Net_LDAP3?

    It is already in pear/Auth_SASL, pear/Net_SMTP:

    • https://github.com/pear/Auth_SASL/releases
    • https://github.com/pear/Auth_SASL2/releases
    • https://github.com/pear/Net_SMTP/releases

    Thanks in advance.

    cc: @schengawegga.
23. Neustradamus commented on Jan 26, 2024

    

    Neustradamus

    on Jan 26, 2024

    Author

    More actions

    Dear @karlitschek, @nextcloud team.

    I wish you a Happy New Year 2024!

    Can you add SCRAM supports in Roundcube and in Nextcloud?
24. Neustradamus commented on Nov 21, 2024

    

    Neustradamus

    on Nov 21, 2024

    Author

    More actions

    @pabzm: Can you solve this issue for security?

    Thanks in advance.
25. pabzm commented on Nov 21, 2024

    

    pabzm

    on Nov 21, 2024

    Member

    More actions

    As @alecpl said five years ago: Pull requests welcome. Roundcube is very much a community project. If you care for this feature:

    • find more people that want it. You're the only one since years who asks for it. Repeatedly tagging single people to push for it won't make it happen.
    • find someone who implements it. The dev team has limited time, too, we can't do all the work.
26. Neustradamus commented on Nov 21, 2024

    

    Neustradamus

    on Nov 21, 2024

    Author

    More actions

    @schengawegga has done a lot of work in PEAR repositories but I do not know about Roundcube.
    Hope an answer.
27. Neustradamus commented on Jul 23, 2025

    

    Neustradamus

    on Jul 23, 2025

    Author

    More actions

    @Danelif, @josaphatim: You have done a good part in Cypht, it is possible to look Roundcube?
28. Neustradamus commented on Oct 2, 2026

    

    Neustradamus

    on Oct 2, 2026

    Author

    More actions

    Dear @roundcube team, @owncloud team, @alecpl, @pabzm, @karlitschek, and all others,

    It is in progress for Channel Binding in PHP, can you test it?

    • Add support for SCRAM-SHA-*-PLUS channel binding in PHP streams (e.g., tls-unique, tls-exporter) php/php-src#16766
    • Add openssl_get_channel_binding php/php-src#24035

    Feedback is very important for the PHP PR author...

    cc: @Danelif, @josaphatim, @schengawegga.