iris icon indicating copy to clipboard operation
iris copied to clipboard
verified publisher icon psi-im

SCRAM-SHA-1(-PLUS) + SCRAM-SHA-224(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-384(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports

Open Neustradamus opened this issue 7 years ago • 6 comments

After:

  • SCRAM-SHA-1

Can you add supports of :

  • SCRAM-SHA-1-PLUS
  • SCRAM-SHA-224
  • SCRAM-SHA-224-PLUS
  • SCRAM-SHA-256
  • SCRAM-SHA-256-PLUS
  • SCRAM-SHA-384
  • SCRAM-SHA-384-PLUS
  • SCRAM-SHA-512
  • SCRAM-SHA-512-PLUS
  • SCRAM-SHA3-512
  • SCRAM-SHA3-512-PLUS

A "big" list has been done in last link of this ticket.

SCRAM-SHA-1(-PLUS):

  • https://tools.ietf.org/html/rfc5802
  • https://tools.ietf.org/html/rfc6120

SCRAM-SHA-256(-PLUS):

  • https://tools.ietf.org/html/rfc7677 since 2015-11-02
  • https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

SCRAM-SHA-512(-PLUS):

  • https://tools.ietf.org/html/draft-melnikov-scram-sha-512

SCRAM-SHA3-512(-PLUS):

  • https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:

  • https://tools.ietf.org/html/draft-melnikov-scram-bis

-PLUS variants:

  • RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
  • RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
  • Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
  • RFC9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

IMAP:

  • RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

  • RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

  • RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

JMAP:

  • RFC8621: The JSON Meta Application Protocol (JMAP) for Mail: https://tools.ietf.org/html/rfc8621

2FA:

  • Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

IANA:

  • Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

Linked to:

  • https://github.com/scram-xmpp/info/issues/1

Neustradamus avatar Jan 01 '19 11:01 Neustradamus

Just tried to debug cyrus-sasl. SCRAM-SHA-256 definitely works. But cyrus-sasl's scram plugin has a mechanism prioritization bug. I'll PR them.

Ri0n avatar Jul 23 '19 17:07 Ri0n

https://github.com/cyrusimap/cyrus-sasl/pull/577

Ri0n avatar Jul 23 '19 18:07 Ri0n

@Ri0n: It is done now no? :)

Neustradamus avatar Apr 20 '20 10:04 Neustradamus

We can compile our own embedded version of cyrus-sasl to make scram working everywhere. Some distros won't accept it though. But at least it will work on Windows

Ri0n avatar Apr 20 '20 11:04 Ri0n

@Ri0n: It is possible to do?

Neustradamus avatar Nov 05 '23 00:11 Neustradamus

Dear @psi-im and @psi-plus teams, @Ri0n, @Vitozz, @tehnick, @drizt,

It is possible to comment this important Qt ticket about Channel Binding?

  • https://bugreports.qt.io/browse/QTBUG-77783

It is to needed to have support of SCRAM-SHA-*-PLUS variants.

Recently, we have seen the jabber.ru MITM:

  • https://notes.valdikss.org.ru/jabber.ru-mitm/
  • https://snikket.org/blog/on-the-jabber-ru-mitm/
  • https://www.devever.net/~hl/xmpp-incident
  • https://blog.jmp.chat/b/certwatch

Thanks in advance.

Neustradamus avatar Nov 10 '23 18:11 Neustradamus