SCRAM-SHA-1-PLUS, SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS) supports

[Neustradamus]

After:

• SCRAM-SHA-1

Can you add supports of:

• SCRAM-SHA-1-PLUS
• SCRAM-SHA-256
• SCRAM-SHA-256-PLUS
• SCRAM-SHA-512
• SCRAM-SHA-512-PLUS
• SCRAM-SHA3-512
• SCRAM-SHA3-512-PLUS

You can add too:

• SCRAM-SHA-224
• SCRAM-SHA-224-PLUS
• SCRAM-SHA-384
• SCRAM-SHA-384-PLUS

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

• SCRAM-SHA-1(-PLUS):
  -- https://tools.ietf.org/html/rfc5802
  -- https://tools.ietf.org/html/rfc6120

• SCRAM-SHA-256(-PLUS):
  -- https://tools.ietf.org/html/rfc7677 since 2015-11-02
  -- https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

• SCRAM-SHA-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha-512

• SCRAM-SHA3-512(-PLUS):
  -- https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

• SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:
  -- https://tools.ietf.org/html/draft-melnikov-scram-bis

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

• RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
• RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
• Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
• RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

IMAP:

• RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

• RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

• RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

2FA:

• Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://datatracker.ietf.org/doc/html/draft-ietf-kitten-scram-2fa

IANA:

• Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

Linked to:

• State of Play scram-sasl/info#1

[sonnyp]

I don't understand. What's your point?

[sonnyp]

I will consider re-opening if you make the effort to explain what it is you're reporting.

[Neustradamus]

There is only SCRAM-SHA-1 in xmppjs: https://github.com/xmppjs/xmpp.js/blob/master/packages/sasl-scram-sha-1/index.js

There are not SCRAM-SHA-1-PLUS + SCRAM-SHA-256(-PLUS):

• SCRAM-SHA-1-PLUS is from RFC6120 (XMPP)
• SCRAM-SHA-256(-PLUS) will be in a new RFC for XMPP soon

[Neustradamus]

@sonnyp: Good news, after XMPP Servers: Metronome IM, Tigase XMPP Server, Jackal IM, Mongoose IM, DJabberd git-master, Prosody 0.12.x, ejabberd 20.12 supports now new SCRAM.

• Clients: Conversations, CoyIM, eyeCU, Gajim 1.2.0+, KDE Kaidan, Miranda NG, Mozilla Thunderbird 71+, Psi/Psi+ (with QCA), Tigase Beagle IM, Tigase Siskin IM, Tigase Stork IM, UWPX, Vacuum IM
• Libraries: cr-xmpp, libstrophe, Mellium XMPP, python-nbxmpp, QXmpp, Tigase JaXMPP, TigaseSwift, Stanza, Wocky, xmpp-rs
• ...

Can you add the support in xmpp.js?
Really important for security.

More infos:

• State of Play scram-sasl/info#1
• https://wiki.xmpp.org/web/SASL_and_SCRAM-SHA-1(-PLUS)_/_SCRAM-SHA-256(-PLUS)#SCRAM-SHA-256.28-PLUS.29

[Neustradamus]

@sonnyp: Have you looked to add others SCRAM-SHA?

There are several packages on github to replace the "sasl-scram-sha-1"

Example for 256:

• https://github.com/PhysoTronic/SASL-SCRAM-SHA256

[sonnyp]

@Neustradamus I know you have good intentions, but stop spamming over and over, it's tiring and doesn't help.