Subject: [kitten] SCRAM-*-PLUS examples and running servers?

From: Jehan Pagès <[email-masked]>
Date: Wed, 7 Sep 2011 06:03:38 +0900

Hello,

I have 2 clients SASL SCRAM implementations (in Objective Caml, and
recently I added the support to the PHP Pear Auth_SASL package). I'd
like to add the channel binding support. I think that should be more
or less straightforward from reading the RFCs but what I miss are
specific examples to compare with and/or a server to test with
(ideally both!).

The example in section 5 of RFC5802 has no channel binding, nor has
the one in section 9.1.2 of RFC6120. Is there any other place with a
detailed example (whatever, a RFC, a blog post, or simply an answer to
this email! :-).

And would you know any Free software server implementation (preferably
XMPP because I already have code to test with this, but some other
protocols may do the part) which supports channel binding on SCRAM?
The only I seem to find is M-Link from Isode, but it is not Free
Software so I cannot install it.
Alternatively if you have an already installed server with channel
binding and you would be willing to provide me a test account (hence
letting me do authentication tests on it), that would do it as well,
of course! (that's for a good cause, 2 Free Software implementations!)

Sorry for asking this on this standards list, but I did not know where
I could get these information otherwise, after searching quite a bit.
Thanks.

Jehan

---

From: Dave Cridland <[email-masked]>
Date: Tue, 06 Sep 2011 23:14:58 +0100

> Software so I cannot install it.

I can certainly get you a test account, though, I've done so for  
other SCRAM implementors.

Also, Simon Josefsson has an IMAP server stood up before, and  
Polymer's been tested against that, and M-Link/M-Box, so they're all  
known to interoperate.

Finally, I believe that all the code Isode uses is directly from its  
use in Cyrus SASL, so in principle a recent Cyrus IMAP should support  
channel binding, I'd imagine.

I think M-Link might still be the only SCRAM-*-PLUS XMPP server, but  
you might want to check Prosody, too.

> I could get these information otherwise, after searching quite a  

No, this is a good place to ask, but you might also want to ask on  
the XSF's jdev and/or XSF's standards list.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Tobias Markmann <[email-masked]>
Date: Wed, 7 Sep 2011 00:27:15 +0200

And to the list. Hit "Reply" instead of "Reply to all".

---------- Forwarded message ----------
From: Tobias Markmann <[email-masked]>
Date: Wed, Sep 7, 2011 at 00:24
Subject: Re: [kitten] SCRAM-*-PLUS examples and running servers?
To: Dave Cridland <[email-masked]>

On Wed, Sep 7, 2011 at 00:14, Dave Cridland <[email-masked]> wrote:
> I think M-Link might still be the only SCRAM-*-PLUS XMPP server, but you
> might want to check Prosody, too.

Code exists for SCRAM-*-PLUS for Prosody however it's not publicly
released yet since it requires a patched LuaSec (opeenssl binding).
However it has been tested against *some* version of Swift.

Tobi