uchicom / smtp

SMTPサーバ.

Apache License 2.0

0 stars 0 forks source link

CRAM-MD5 #1

Open uchicom opened 5 years ago

uchicom commented 5 years ago

goal

CRAM-MD5の認証を追加

参考 http://yamatyuu.net/computer/program/vc2013/sendmail_cram_md5/index.html https://www.tohoho-web.com/ex/draft/smtp-auth.htm https://stackoverflow.com/questions/186827/smtp-with-cram-md5-in-java

DESIGN

C: AUTH CRAM-MD5
S: 334 PDM0ODAuNjAxLjEwNTkyMzkyNTRAbWFpbC56enouZG9tPg== <123456789.012@testserver.com>
C: dGFuYWthIDU4M2UzMTBhZTRiNjBhZGU0Yjc4YzlhYWU5ZDdjY2Y2
S: 235 Authentication successful

チャレンジコード 12345.234@domain.com数値の部分はrandom数値を渡せばよいか？？これは、サーバーに保存する

Neustradamus commented 1 year ago

@uchicom: Please do not add unsecure and old CRAM-MD5 mechanism:

Can you remove unsecure and old LOGIN mechanism?

LOGIN has been replaced by PLAIN but PLAIN can not be used without a secure connection.

Now it is SCRAM-SHA-*(-PLUS)!

SCRAM-SHA-1(-PLUS):

SCRAM-SHA-256(-PLUS):

https://tools.ietf.org/html/rfc7677 since 2015-11-02
https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

SCRAM-SHA-512(-PLUS):

https://tools.ietf.org/html/draft-melnikov-scram-sha-512

SCRAM-SHA3-512(-PLUS):

https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

-PLUS variants:

RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
RFC9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

IMAP:

RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

LDAP:

RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

2FA:

Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

IANA:

Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml