SCRAM-SHA-1-PLUS + SCRAM-SHA-256-PLUS + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports

[Neustradamus]

Dear @the-djmaze,

In first, I wish you a Happy New Year!

Thanks a lot for your SCRAM-SHA-1 and SCRAM-SHA-256 adding! :)

After:

• SCRAM-SHA-1
• SCRAM-SHA-256

Can you add supports of :

• SCRAM-SHA-1-PLUS
• SCRAM-SHA-256-PLUS
• SCRAM-SHA-512
• SCRAM-SHA-512-PLUS
• SCRAM-SHA3-512
• SCRAM-SHA3-512-PLUS

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

• SCRAM-SHA-1(-PLUS):
  -- https://tools.ietf.org/html/rfc5802
  -- https://tools.ietf.org/html/rfc6120

• SCRAM-SHA-256(-PLUS):
  -- https://tools.ietf.org/html/rfc7677 since 2015-11-02
  -- https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

• SCRAM-SHA-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha-512

• SCRAM-SHA3-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

• RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
• RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
• Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
• RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

IMAP:

• RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

• RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

• RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

2FA:

• Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

IANA:

• Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

Linked to:

• State of Play scram-sasl/info#1

[the-djmaze]

Thanks, and a good 2022 to you as wel.

SCRAM-SHA-512 should work as scram.php detects it.

The PLUS versions however are difficult due to the required gs2 header which is inside TLS stream (we have no access to it).

On the other side: sha and md5 should not be used as it actually relies on plain/hash passwords stored on the server.
In 2022 it is very insecure to store passwords in plain text or md5/sha.

Passwords should be stored in bcrypt, balloon or argon2 (but scram will not work in these cases).

So basically always use TLS 1.3 connections unless the connection is 127.0.0.1

[Neustradamus]

@the-djmaze: Thanks for your SCRAM-SHA-512 :)

Please read here about SCRAM: https://techcommunity.microsoft.com/t5/azure-database-for-postgresql/how-to-securely-authenticate-with-scram-in-postgres-13/ba-p/1548319

[the-djmaze]

@Neustradamus i understand your SCRAM mission everywhere.
But -PLUS is just not possible in PHP.

[Neustradamus]

@the-djmaze: Ok for -PLUS variants, but for SCRAM-SHA3-512?

[Neustradamus]

@the-djmaze: I have added the RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051 in the description :)

[the-djmaze]

RFC9051 is already partially supported ;)

snappymail/snappymail/v/0.0.0/app/libraries/MailSo/Imap/ImapClient.php

Line 236 in 9fea092

// TODO: RFC 9051

[Neustradamus]

@the-djmaze: Recently SCRAM hashes have been added in:

• https://github.com/pear/Auth_SASL
• https://github.com/pear/Auth_SASL2
• https://github.com/pear/Net_SMTP

A good job done by @schengawegga.

Maybe you can help for -PLUS variants?

And for repositories:

• https://github.com/pear/Net_Sieve
• https://github.com/pear/Net_IMAP
• https://github.com/pear/Mail_IMAPv2
• https://github.com/pear/Net_POP3
• https://github.com/pear/Mail
• https://github.com/pear/Mail2
• https://github.com/pear/Auth
• https://github.com/pear/Auth_HTTP