SCRAM-SHA-***(-PLUS) supports

[Neustradamus]

After:

• SCRAM-SHA-1

Can you add supports of:

• SCRAM-SHA-1-PLUS
• SCRAM-SHA-256
• SCRAM-SHA-256-PLUS
• SCRAM-SHA-512
• SCRAM-SHA-512-PLUS
• SCRAM-SHA3-512
• SCRAM-SHA3-512-PLUS

You can add too:

• SCRAM-SHA-224
• SCRAM-SHA-224-PLUS
• SCRAM-SHA-384
• SCRAM-SHA-384-PLUS

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

• SCRAM-SHA-1(-PLUS):
  -- https://tools.ietf.org/html/rfc5802
  -- https://tools.ietf.org/html/rfc6120

• SCRAM-SHA-256(-PLUS):
  -- https://tools.ietf.org/html/rfc7677 since 2015-11-02
  -- https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

• SCRAM-SHA-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha-512

• SCRAM-SHA3-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

• SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:
  -- https://tools.ietf.org/html/draft-melnikov-scram-bis

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

• RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
• RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
• Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
• RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

IMAP:

• RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

• RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

• RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

2FA:

• Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://datatracker.ietf.org/doc/html/draft-ietf-kitten-scram-2fa

IANA:

• Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

Linked to:

• State of Play scram-sasl/info#1

[fabiang]

Please feel free to implement those and add a pull request. Thank you!

[Neustradamus]

@fabiang: Have you looked on it?

Thanks in advance.

[fabiang]

If you need them, please create a PR and I'll be happy to add them. Thanks.

[fabiang]

Closing this due age. PR is still very welcome for this.

[Neustradamus]

@fabiang: The problem is always here, it is not a solution to close it...

[fabiang]

I was able to add support for some of the algos.

The following authentication methods were supported before and I've also updated the integration tests to test them:

• SCRAM-SHA-256
• SCRAM-SHA-512

Those should have been working before, but I can't test them automatically

• SCRAM-SHA-224
• SCRAM-SHA-384

This should be working now, but can't be tested either:

• SCRAM-SHA3-512

Also I'm unable to add support for all the *-PLUS algorithms since OpenSSL/PHP doesn't have an API for channel binding (same problem as in #11) .

[Neustradamus]

@fabiang: Thanks a lot for your commit!

• 4769aad

Can you add topics in your repo?

• scram-sha-1
• scram-sha-256
• scram-sha-512
• scram-sha3-512

ejabberd: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS):

• https://ejabberd.im/
• https://github.com/processone/ejabberd/

Tigase XMPP Server: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS):

• https://tigase.org/
• https://github.com/tigase/tigase-server

MongooseIM supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-224(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS), SCRAM-SHA-512(-PLUS) | Without CB 1.3:

• https://github.com/esl/MongooseIM

Metronome IM supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS), SCRAM-SHA-512(-PLUS) | Without CB 1.3:

• https://metronome.im/
• https://github.com/maranda/metronome

Jackal supports: SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS), SCRAM-SHA3-512(-PLUS) | Without CB 1.3:

• https://github.com/ortuman/jackal

Prosody supports: SCRAM-SHA-1(-PLUS) and SCRAM-SHA-256(-PLUS):

• https://prosody.im/

[fabiang]

What topics you're talking about? Is there any server software available that supports SCRAM-SHA3-512?

[Neustradamus]

At right here: https://github.com/fabiang/sasl (gear) ^^

There are several lists, search SHA3 here:

• State of Play scram-sasl/info#1

[fabiang]

I don't see any server software that supports scram-sha3-*. I've added the other supported algos as topics.

[Neustradamus]

@fabiang: Jackal but it is now a dead project: https://github.com/search?q=repo%3Aortuman%2Fjackal+sha3&type=code

[Neustradamus]

@fabiang: Recently some SCRAM hashes have been added in:

• https://github.com/pear/Auth_SASL
• https://github.com/pear/Auth_SASL2
• https://github.com/pear/Net_SMTP

A good job done by @schengawegga.

Maybe you can help for -PLUS variants?

And for repositories:

• https://github.com/pear/Net_Sieve
• https://github.com/pear/Net_IMAP
• https://github.com/pear/Mail_IMAPv2
• https://github.com/pear/Net_POP3
• https://github.com/pear/Mail
• https://github.com/pear/Mail2
• https://github.com/pear/Auth
• https://github.com/pear/Auth_HTTP