Dear all, After several years, can you add SCRAM-SHA-* and SCRAM-SHA-*-PLUS supports because secure servers do not work with SOGo?
It is possible to have it in SOGo 5.x and SOGo 6.x? Do not forget to update the documentation after it: - https://github.com/Alinto/sogo/blob/master/Documentation/SOGoInstallationGuide.asciidoc Base: - SCRAM-SHA-1 - SCRAM-SHA-256 - SCRAM-SHA-512 Same with TLS Channel Binding (security against MITM): - SCRAM-SHA-1-PLUS - SCRAM-SHA-256-PLUS - SCRAM-SHA-512-PLUS Recall: CRAM-MD5, DIGEST-MD5, LOGIN, ... are unsecure. History: 20 November 2008: CRAM-MD5 to Historic: - https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00 29 June 2017: CRAM-MD5 to Historic: - https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00 July 2011: RFC6331: Moving DIGEST-MD5 to Historic: - https://tools.ietf.org/html/rfc6331 August 2021: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: "Replaced DIGEST-MD5 SASL mechanism with SCRAM-SHA-256. DIGEST-MD5 was deprecated." - https://tools.ietf.org/html/rfc9051 SCRAM-SHA-1(-PLUS): - https://tools.ietf.org/html/rfc5802 - https://tools.ietf.org/html/rfc6120 SCRAM-SHA-256(-PLUS): - https://tools.ietf.org/html/rfc7677 since 2015-11-02 SCRAM-SHA-512(-PLUS): - https://tools.ietf.org/html/draft-melnikov-scram-sha-512 SCRAM-SHA3-512(-PLUS): - https://tools.ietf.org/html/draft-melnikov-scram-sha3-512 Channel Binding: - RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056 - RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929 - RFC9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266 - https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml IMAP: - RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051 LDAP: - RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803 HTTP: - RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804 2FA: - Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://datatracker.ietf.org/doc/html/draft-ietf-kitten-scram-2fa IANA: - Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml Linked to: - https://github.com/scram-xmpp/info/issues/1 - https://bugs.sogo.nu/view.php?id=4869 Thanks in advance. Regards, Neustradamus
