Re: SCRAM methods

[Simon Josefsson]

Jeremy Harris <address@hidden> writes:

> On 15/01/2020 09:27, Simon Josefsson wrote:
>>> On 14/01/2020 22:19, Simon Josefsson wrote:
>>>> Please try version 1.9.1 and tell me if it does what you
>>>> want!  There are new properties for ServerKey/StoredKey now.
>>>
>>> Yes, that works nicely for the server side.
>>> Client side in the next patch release?
>> 
>> Currently I prefer to not implement ClientKey support -- there isn't
>> any security advantage with it as far as I can see.  Stealing
>> SaltedPassword or ClientKey/StoredKey both make client and server
>> impersonation possible.
>> 
>> I believe clients should store cleartext-password or the
>> SaltedPassword.  Storing PBKDF2 values in clients is not that uncommon,
>> so there may be infrastructure in place for it in some environments --
>> whereas ClientKey/StoredKey are entirely SCRAM-specific.
>
> I'm fine with that; I fully understand the minimum-changes
> argument.  I've updated the Exim implementation to match
> (and pushed to the repo I pointed you to, if you're using that).
>
> It'll go into the next release.  Thanks for your work on this.

Yay, thank you!  I'll release this as a new stable 1.10.0 once I have
worked through the QA cycle to do a stable release.

/Simon

signature.asc
Description: PGP signature