search

roundcube / roundcubemail

The Roundcube Webmail suite
https://roundcube.net
GNU General Public License v3.0
5.92k stars 1.64k forks source link

SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) supports #6917

Open Neustradamus opened 5 years ago

Neustradamus commented 5 years ago

Dear @roundcube team,

Can you add supports of :

You can add too:

A "big" list has been done in last link of this ticket.

SCRAM-SHA-1(-PLUS):

SCRAM-SHA-256(-PLUS):

SCRAM-SHA-512(-PLUS):

SCRAM-SHA3-512(-PLUS):

SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:

-PLUS variants:

IMAP:

LDAP:

HTTP:

JMAP:

2FA:

IANA:

Linked to:

alecpl commented 5 years ago

Auth_SASL has some SCRAM support so it should be doable, but I will not give it a high prio. Any help appreciated.

Neustradamus commented 5 years ago

It can be ok for 1.4?

alecpl commented 5 years ago

There's only one difference between these two libs. They handle errors differently. SO, there's no reason to switch.

Neustradamus commented 5 years ago

What is missing for SCRAM in 1.4 RC1 for 1.4 release?

Note: SCRAM is for LDAP too.

alecpl commented 5 years ago
  1. Make sure pear/Auth_SASL has everything you need. It might not support *-PLUS variants, but I didn't look at this.
  2. Add SCRAM auth support to rcube_imap_generic.
  3. Add SCRAM auth support to pear/Net_Sieve.
  4. Add SCRAM auth support to pear/Net_SMTP.
  5. Add SCRAM auth support to kolab/Net_LDAP3.
Neustradamus commented 5 years ago

Yes, I think it is not supported yet for -PLUS variants, but it is already good point :)

Neustradamus commented 5 years ago

@alecpl: Any news? I have seen that Roundcube 1.4 is out!

alecpl commented 5 years ago

I'm not working and not plan to work on this in foreseable future. It's not a prio for me. Pull requests appreciated.

Neustradamus commented 5 years ago

@alecpl, @kanarip: Can you look for kolab/Net_LDAP3 and SCRAM? I have looked here: https://git.kolab.org/diffusion/PNL/history/master/

@alecpl: Your are here too :)

I have done a ticket for pear/Net_SMTP: https://github.com/pear/Net_SMTP/issues/57

For pear/Auth_SASL, all except -PLUS variants are good.

Neustradamus commented 4 years ago

@alecpl: Can you add "Issues" section (or it must be owner of PEAR) in https://github.com/pear/Net_Sieve?

Have you progressed on SCRAM? To have a best security?

Note, after SCRAM-SHA-1(-PLUS):

Neustradamus commented 4 years ago

@alecpl: SquirrelMail has SCRAM, it is possible to add in Roundcube?

Neustradamus commented 3 years ago

@alecpl: Have you progressed on it?

Neustradamus commented 2 years ago

Dear @roundcube team, @alecpl, @thomascube, @vbenincasa,

Happy New Year 2022!

Have you looked for SCRAM-SHA-* supports? The first step is without -PLUS variants.

Thanks in advance.

cc: @jparise

Neustradamus commented 2 years ago

I have forgotten to inform you, SCRAM-SHA-256/SCRAM-SHA-256-PLUS are in the new IMAP, I have added the last RFC in the description: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2:

I wish you a good reading ^^

pkolmann commented 1 year ago

Please consider when implementing SCRAM-SHA-* that the whole SCRAM-algorithm should run on the Client, not the PHP on the server.

UseCase: Company Firewall with deep packet inspection should not get the plaintext password in the HTTPS traffic...

Neustradamus commented 1 year ago

@roundcube team, @alecpl: Net_SMTP (with Auth_SASL/Auth_SASL2) has now SCRAM-SHA-* features, old mechanisms have been deprecated. Not yet -PLUS variants but a big progress done by @schengawegga and you can use.

Can you look for rcube_imap_generic, Net_Sieve, Net_LDAP3?

Neustradamus commented 12 months ago

Dear @karlitschek, @owncloud team, @roundcube team,

Security is the number 1?

Can you confirm it and add SCRAM-SHA- and SCRAM-SHA--PLUS supports in Roundcube, Nextcloud and deps?

Thanks in advance.

Roundcube, linked to (comment from @alecpl):

Nextcloud, linked to:

Linked to:

Neustradamus commented 11 months ago

@alecpl: Can you look for rcube_imap_generic, Net_Sieve, Net_LDAP3?

It is already in pear/Auth_SASL, pear/Net_SMTP:

Thanks in advance.

cc: @schengawegga.

Neustradamus commented 10 months ago

Dear @karlitschek, @nextcloud team.

I wish you a Happy New Year 2024!

Can you add SCRAM supports in Roundcube and in Nextcloud?

Neustradamus commented 3 days ago

@pabzm: Can you solve this issue for security?

Thanks in advance.

pabzm commented 2 days ago

As @alecpl said five years ago: Pull requests welcome. Roundcube is very much a community project. If you care for this feature:

Neustradamus commented 2 days ago

@schengawegga has done a lot of work in PEAR repositories but I do not know about Roundcube. Hope an answer.