search

indimail / indimail-mta

qmail fork with IPV6, TLS, DANE, DKIM, SRS2, SPF, daemontools, qmailanalog, mess822, & ucspi-tcp
https://github.com/indimail/indimail-mta/wiki/0-IndiMail-Wiki
GNU General Public License v3.0
12 stars 3 forks source link

SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports #30

Closed Neustradamus closed 2 years ago

Neustradamus commented 2 years ago

Dear @mbhangui,

In first, I wish you a Happy New Year!

Can you add supports of :

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

IMAP:

LDAP:

HTTP:

2FA:

IANA:

Linked to:

mbhangui commented 2 years ago

Wishing you a very happy new year too and thank you for bringing this to my attention. I will have to do some reading on this and thank you for providing the various links. At the moment I'm working on a specific PR and when that is completed I will give this a reading and see how it can be implemented

Neustradamus commented 2 years ago

@mbhangui: Thanks for your quickly answer and for your wishes.

I know that my tickets have a lot of links, it is to give all informations.

No problem for your time, I hope you will understand the goal: It is for security, MD5 is obsolete and unsecure.

It is already done in:

A more complete list here: https://github.com/scram-xmpp/info/issues/1

I add other informations linked to the request:

20 November 2008: CRAM-MD5 to Historic:
- https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00

29 June 2017: CRAM-MD5 to Historic:
- https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00

July 2011: RFC6331: Moving DIGEST-MD5 to Historic:
- https://tools.ietf.org/html/rfc6331

August 2021: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2:
"Replaced DIGEST-MD5 SASL mechanism with SCRAM-SHA-256. DIGEST-MD5 was deprecated."
- https://tools.ietf.org/html/rfc9051
Neustradamus commented 2 years ago

@mbhangui: Good news, it is a good day, it is official for -PLUS variants with TLS 1.3!

It is here: RFC 9266: Channel Bindings for TLS 1.3:

mbhangui commented 2 years ago

Closing this. SCRAM-SHA-1 and SCRAM-SHA-256 methods are now avaiable with completion of #32. The -PLUS methods are not being attempted as I find them complicated.