Open Neustradamus opened 5 years ago
Important information: Cyrus SASL 2.1.28 has been released.
2022-03-14: Prosody 0.12 has been released with SCRAM-SHA-256 (in more SCRAM-SHA-1):
Gajim 1.4.x and python-nbxmpp 3.x support now SCRAM-SHA-512 (in more SCRAM-SHA-1, SCRAM-SHA-256):
RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266
Welcome, this page informs you about the security, all SCRAM variants and Channel Binding (-PLUS variants) too.
Important history:
CRAM-MD5 to Historic:
RFC6331: Moving DIGEST-MD5 to Historic:
RFC8600: https://tools.ietf.org/html/rfc8600 (2019-06-21): https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA
When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802].
But in "Best practices for password hashing and storage" expired I-D:
About Channel Binding (for -PLUS variants):
Some important XEPs:
Little details, to know easily:
After the jabber.ru MITM, Channel Binding is the solution:
SCRAM-SHA-1(-PLUS):
SCRAM-SHA-256(-PLUS):
SCRAM-SHA-512(-PLUS):
SCRAM-SHA3-512(-PLUS):
SCRAM BIS: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:
IMAP:
LDAP:
HTTP:
JMAP:
2FA:
IANA:
SASL2:
Article: Convert old unsecured MD5 passwords to SCRAM-SHA-256 with PostgreSQL: https://info.crunchydata.com/blog/how-to-upgrade-postgresql-passwords-to-scram
Since PostgreSQL 10, MD5 -> SCRAM-SHA-256: SCRAM-SHA-256 has been added in PostgreSQL 10 SCRAM-SHA-256-PLUS variant (with TLS Binding) has been added in PostgreSQL 13 SCRAM-SHA-256 is selected by default in PostgreSQL 14
SCRAM-SHA-1(-PLUS) and SCRAM-SHA-256(-PLUS):
SCRAM-SHA-1 and SCRAM-SHA-256:
SCRAM-SHA-256(-PLUS):
SCRAM-SHA-256:
SCRAM-SHA-256 and SCRAM-SHA-512:
SCRAM-SHA-1, SCRAM-SHA-224, SCRAM-SHA-256, SCRAM-SHA-384, SCRAM-SHA-512 and SCRAM-SHA3-512:
SCRAM-SHA-1(-PLUS), SCRAM-SHA-224(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS), SCRAM-SHA-512(-PLUS) and SCRAM-SHA3-512(-PLUS):
SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-512 and SCRAM-SHA3-512:
SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-512(-PLUS) and SCRAM-SHA3-512(-PLUS):
SCRAM-SHA-1, SCRAM-SHA-256 and SCRAM-SHA-512:
SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS) and SCRAM-SHA-512(-PLUS):
SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-384 and SCRAM-SHA-512:
SCRAM-SHA-1, SCRAM-SHA-224, SCRAM-SHA-256, SCRAM-SHA-384 and SCRAM-SHA-512:
SCRAM-SHA-1(-PLUS), SCRAM-SHA-224(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS) and SCRAM-SHA-512(-PLUS):
SCRAM-SHA-1(-PLUS), SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS) and SCRAM-SHA-512(-PLUS):
SCRAM-SHA-1, SCRAM-SHA-256(-PLUS) and SCRAM-SHA-512(-PLUS):
SCRAM-SHA-1(-PLUS):
SCRAM-SHA-1 and SCRAM-SHA-1-PLUS:
SCRAM-SHA-1:
NOTHING:
UNKNOWN: