Add support for SHA-256/512 and/or SHA-3 for password based authentication

[bowlofeggs]

Greetings!

Is it possible to use SHA-256/512 or SHA-3 for password based authentication, in lieu of SHA-1 or MD5? When reading the docs here, it seems like SHA-256/512 are not supported:

https://docs.ejabberd.im/admin/configuration/#internal

If that is the case, I recommend adding a stronger hash to the list of supported authentication algorithms. SHA-1 is known to be weak, and it is thus not recommended to use it anymore.

[licaon-kter]

/close as duplicate #2742

Also, are you sure SCRAM-SHA1 really has the same weaknesses as SHA1?
eg. https://www.gnu.org/software/gsasl/manual/html_node/SCRAM_002dSHA_002d1.html

[bowlofeggs]

Hi @licaon-kter, I honestly don't know the difference between SHA-1 and SCRAM-SHA-1.

[Neustradamus]

@processone: Can you reopen #2742, it is always closed...

@bowlofeggs: RFC5208 -> https://tools.ietf.org/html/rfc5802

[Neustradamus]

Good news, there are new informations:

• SCRAM-SHA-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha-512
• SCRAM-SHA3-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha3-512
• Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

Note, after SCRAM-SHA-1(-PLUS):

• GNU SASL (gsasl) supports SCRAM-SHA-256(-PLUS) since 1.9.1: http://git.savannah.gnu.org/gitweb/?p=gsasl.git;a=blob;f=NEWS;hb=HEAD
  I have informed about missing informations in website/manual/docs.
• Dovecot supports SCRAM-SHA-256(-PLUS) since 2.3.10: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
• Cyrus SASL/IMAP supports SCRAM-SHA-256(-PLUS) and more since 2.1.27: https://www.cyrusimap.org/sasl/sasl/authentication_mechanisms.html
• ...

[Neustradamus]

@bowlofeggs: @prefiks has done a lot of work about SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS).

SCRAM-SHA3-512(-PLUS) will be added, I think, when the RFC will be here, draft link in the previous comment.

[Neustradamus]

@bowlofeggs: New improvements have been added recently!

• RFC 9266: Channel Bindings for TLS 1.3 support xmpp#69