mirror of
https://github.com/cypht-org/cypht.git
synced 2026-04-25 04:56:03 +03:00
[GH-ISSUE #354] SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) supports #305
Labels
No labels
2fa
I18N
PGP
Security
Security
account
advanced_search
advanced_search
announcement
api_login
authentication
awaiting feedback
blocker
bug
bug
bug
calendar
config
contacts
core
core
devops
docker
docs
duplicate
dynamic_login
enhancement
epic
feature
feeds
framework
github
github
gmail_contacts
good first issue
help wanted
history
history
imap
imap_folders
inline_message
installation
keyboard_shortcuts
keyboard_shortcuts
ldap_contacts
mobile
need-ssh-access
new module set
nux
pop3
profiles
pull-request
question
refactor
release
research
saved_searches
smtp
strategic
tags
tests
themes
website
wordpress
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/cypht#305
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Neustradamus on GitHub (Sep 7, 2019).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/354
Originally assigned to: @Danelif on GitHub.
Dear @cypht-org team,
For more security, can you add supports of :
You can add too:
A "big" list has been done in last link of this ticket.
SCRAM-SHA-1(-PLUS):
SCRAM-SHA-256(-PLUS):
SCRAM-SHA-512(-PLUS):
SCRAM-SHA3-512(-PLUS):
-PLUS variants:
IMAP:
LDAP:
HTTP:
2FA:
IANA:
Linked to:
@jasonmunro commented on GitHub (Nov 12, 2019):
I will look into this, thanks for the report.
@Neustradamus commented on GitHub (Aug 13, 2023):
Dear @cypht-org team,
Have you progressed since 2019?
Thanks in advance.
@marclaporte commented on GitHub (Aug 13, 2023):
Hi @Neustradamus
Thank you for the follow up. AFAIK, no progress has been made on this specific issue.
But we've just released a major version with tons of new features and fixes. And we've moved the project to an organization to facilitate work by various developers. Ref.: https://unencumberedbyfacts.com/2023/06/14/cypht-rebooted/
@josaphatim What do you think?
@Neustradamus commented on GitHub (Aug 13, 2023):
@marclaporte: Excellent news!
Hope it will be possible to have more security in your other projects too :)
@marclaporte commented on GitHub (Aug 13, 2023):
Hehe, yeah :-)
@marclaporte commented on GitHub (May 7, 2024):
@Danelif please advise.
@Danelif commented on GitHub (May 14, 2024):
I will look into this and give report
@Danelif commented on GitHub (May 16, 2024):
@marclaporte I have read all the documentation provided above and in my opinion for cypht, SCRAM-SHA-256-PLUS is suitable. Unfortunately, there is no much documentation apart from the Internet Engineering Task Force (IETF).
but I found this video interesting https://www.youtube.com/watch?v=20p4zP_pvQU&pp=ugMICgJmchABGAHKBSxwcm90ZWdlciB2b3MgbW90cyBkZSBwYXNzZSBzY3JhbSBwb3N0Z3Jlc3FsIA%3D%3D an scenario with PostgreSQL database.
@Neustradamus commented on GitHub (May 16, 2024):
@Danelif: Yes, PostgreSQL supports SCRAM-SHA-256 and SCRAM-SHA-256-PLUS and a lot of others projects/softs/libs/...
There is a list here: https://github.com/scram-sasl/info/issues/1.
@marclaporte: I have tried to contact you in private by e-mail, by Twitter (public message because DM is not opened for you), can you reply me? Thanks in advance.
@marclaporte commented on GitHub (May 16, 2024):
Done
@marclaporte commented on GitHub (May 16, 2024):
@Danelif Do you feel comfortable to prepare a pull request?
@Danelif commented on GitHub (May 17, 2024):
@marclaporte yes I do
@marclaporte commented on GitHub (May 17, 2024):
ok, please proceed
@Neustradamus commented on GitHub (Jun 4, 2024):
@marclaporte, @Danelif: Can you look SCRAM with Auth_SASL/Auth_SASL2?
It will be nice to have before a new release...
@Danelif commented on GitHub (Jun 4, 2024):
@Neustradamus okay let me take a look
@Danelif commented on GitHub (Jun 7, 2024):
Adding SCRAM-256-PLUS PR @Neustradamus
@Neustradamus commented on GitHub (Jun 7, 2024):
@Danelif: Nice, good job!
Can you add other SCRAM too?
@Danelif commented on GitHub (Jun 7, 2024):
@Neustradamus alright
@Neustradamus commented on GitHub (Jun 7, 2024):
@Danelif: Note that there are two connection possibilities by SCRAM, example for 256:
It will be perfect to have support of: SHA-1/SHA-256/SHA-512/SHA3-512.
Note: If you can add the -PLUS variant support into Auth_SASL/Auth_SASL2, it will be a big enhancement to have a full compatibility and will profit to several projects in the World.
@Danelif commented on GitHub (Jun 7, 2024):
i just finished to include all SCRAM SHA in the code base
PR
@Danelif commented on GitHub (Jun 13, 2024):
This PR has been merged so can i remove CRAM-MD5 (https://github.com/cypht-org/cypht/pull/1063) in cypht now ? @marclaporte @Neustradamus
@marclaporte commented on GitHub (Jun 13, 2024):
Wait. Is there a use case that the more advanced mechanisms would not be used?
If system always uses more secure mechanisms, it should never fall back to CRAM-MD5
@kroky @Neustradamus
@marclaporte commented on GitHub (Jun 13, 2024):
Say the mail server only supports plain and CRAM-MD5, it's surely better to use CRAM-MD5 instead of plain?
@Neustradamus commented on GitHub (Jun 13, 2024):
At the same time of CRAM-MD5 removal, it is possible to remove LOGIN too.
The latest possibility for "old servers" is PLAIN with TLS.
@kroky commented on GitHub (Jun 14, 2024):
I'd deprecate and use as a last resort for now. If big clients/servers haven't removed it yet, there might be a strong reason to. I understand the protocol is outdated and moved to a historic state but completely removing the authentication protocols might actually drop support for certain servers/users/use-cases.
@Neustradamus commented on GitHub (Jul 23, 2025):
Linked to: