Menu

#2856 SCRAM Key Provider Plugin

KeePass_2.x
open
nobody
5
2023-12-26
2023-12-26
No

Dear @keepass team,

Can you add supports of :

  • SCRAM-SHA-1
  • SCRAM-SHA-1-PLUS
  • SCRAM-SHA-256
  • SCRAM-SHA-256-PLUS
  • SCRAM-SHA-512
  • SCRAM-SHA-512-PLUS
  • SCRAM-SHA3-512
  • SCRAM-SHA3-512-PLUS

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

IMAP:

LDAP:

  • RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

HTTP:

2FA:

IANA:

Linked to:

Discussion

  • Paul

    Paul - 2023-12-26

    Why?
    The current encryption methods are not broken and are not likely to be.

    cheers, Paul

     
  • Dominik Reichl

    Dominik Reichl - 2023-12-26

    SCRAM is a challenge-response authentication mechanism. This is primarily intended for client/server systems, but it might be possible to encrypt/decrypt database files with a construction similar to OtpKeyProv. I'm currently not planning to develop a plugin for this, but maybe someone else does, thus I'm moving this to the open feature requests.

    Thanks and best regards,
    Dominik

     
  • Dominik Reichl

    Dominik Reichl - 2023-12-26
    • summary: SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports --> SCRAM Key Provider Plugin
    • Group: KeePass_1.x --> KeePass_2.x
     
  • Dominik Reichl

    Dominik Reichl - 2023-12-26

    Ticket moved from /p/keepass/bugs/2291/

     

Log in to post a comment.

MongoDB Logo MongoDB