Motivation
Alice wants to log into Bob's server. She needs to prove she is who she claims to be. For solving this authentication problem, Alice and Bob have agreed upon a password, which Alice knows, and which Bob knows how to verify. Now Alice could send her password over an unencrypted connection to Bob in a clear text form, for him to verify. That would however make the password accessible to Mallory, who is wiretapping the line. Alice and Bob could try to bypass this by encrypting the connection. However, Alice doesn't know whether the encryption was set up by Bob, and not by Mallory by doing aProtocol overview
Although all clients and servers have to support theH
be the selected hash function, given by the name of the algorithm advertised by the server and chosen by the client. 'SCRAM-SHA-1' for instance, uses SHA-1 as hash function.
Password-based derived key, or salted password
The client derives a key, or salted password, from the password, a salt, and a number of computational iterations as follows: :''SaltedPassword'' = Hi(''password'', ''salt'', ''iteration-count'') = PBKDF2
In cryptography, PBKDF1 and PBKDF2 (Password-Based Key Derivation Function 1 and 2) are key derivation functions with a sliding computational cost, used to reduce vulnerabilities of brute-force attacks.
PBKDF2 is part of RSA Laboratories' Publ ...
(HMAC
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret ...
, ''password'', ''salt'', ''iteration-count'', ''output length of ''H)
.
Messages
RFC 5802 names four consecutive messages between server and client: ; ''client-first'': The ''client-first'' message consists of a GS2 header (comprising a channel binding flag, and optional name for authorization information), the desired''username''
, and a randomly generated client nonce ''c-nonce''
.
; ''server-first'': The server appends to this client nonce its own nonce ''s-nonce''
, and adds it to the ''server-first'' message, which also contains a ''salt''
used by the server for salting the user's password hash, and an iteration count ''iteration-count''
.
; ''client-final'': After that the client sends the ''client-final'' message containing ''channel-binding'', the GS2 header and channel binding data encoded in base64, the concatenation of the client and the server nonce, and the client proof, ''proof''
.
; ''server-final'' : The communication closes with the ''server-final'' message, which contains the server signature, ''verifier''
.
Proofs
The client and the server prove to each other they have the same''Auth''
variable, consisting of:
:''Auth'' = ''client-first-without-header'' + , + ''server-first'' + , + ''client-final-without-proof''
(concatenated with commas)
More concretely, this takes the form:
:= r=''cnonce'', 'extensions'',=''cnonce''‖''snonce'',s=''salt'',i=''iterationcount'', 'extensions'',=base64(''channelflag'', =''authzid''!--mandatory comma repetition intended-->,''channelbinding''),r=''cnonce''‖''snonce'' ''extensions''/code>
The proofs are calculated as follows:
:''ClientKey'' = HMAC(''SaltedPassword'', 'Client Key')
:''ServerKey'' = HMAC(''SaltedPassword'', 'Server Key')
:''ClientProof'' = ''p'' = ''ClientKey'' XOR HMAC(H(''ClientKey''), ''Auth'')
:''ServerSignature'' = ''v'' = HMAC(''ServerKey'', ''Auth'')
where the XOR
Exclusive or or exclusive disjunction is a logical operation that is true if and only if its arguments differ (one is true, the other is false).
It is symbolized by the prefix operator J and by the infix operators XOR ( or ), EOR, EXOR, , ...
operation is applied to byte strings of the same length, H(''ClientKey'')
is a normal hash of ''ClientKey''
. 'Client Key'
and 'Server Key'
are verbatim strings.
The server can authorize the client by computing ClientKey
from ClientProof
and then comparing H(ClientKey)
with the stored value.
The client can authorize the server by computing and comparing ServerSignature
directly.
Stored password
The server stores only the username, ''salt''
, ''iteration-count''
, H(''ClientKey'')
, ''ServerKey''
. The server has transient access to ''ClientKey''
as it is recovered from the client proof, having been encrypted with H(''ClientKey'')
.
The client needs only the ''password''
.
Channel binding
The term ''channel binding'' describes the man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
prevention strategy to 'bind' an application layer
An application layer is an abstraction layer that specifies the shared communications protocols and Interface (computing), interface methods used by Host (network), hosts in a communications network. An ''application layer'' abstraction is speci ...
, which provides mutual authentication, to a lower (mostly encryption) layer, ensuring that the endpoints of a connection are the same in both layers. There are two general directions for channel binding: ''unique'' and ''endpoint'' channel binding. The first ensures that a specific connection is used, the second that the endpoints are the same.
There are several channel binding types, where every single type has a ''channel binding unique prefix''. Every channel binding type specifies the content of the ''channel binding data'', which provides unique information over the channel and the endpoints. For instance, for the ''tls-server-end-point'' channel binding, it is the server's TLS certificate.
An example use case of channel binding with SCRAM as application layer, could be with Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securi ...
(TLS) as lower layer. TLS protects from passive eavesdropping, as the communication is encrypted. However, if the client doesn't authenticate the server (e.g. by verifying the server's certificate), this doesn't prevent man-in-the-middle attacks. For this, the endpoints need to assure their identities to each other, which can be provided by SCRAM.
The ''gs2-cbind-flag'' SCRAM variable specifies whether the client supports channel binding or not, or thinks the server doesn't support channel binding, and ''c-bind-input'' contains the ''gs2-cbind-flag'' together with the ''channel binding unique prefix'' and the ''channel binding data'' themselves.
Channel binding is optional in SCRAM, and the ''gs2-cbind-flag'' variable prevents from downgrade attack
A downgrade attack, also called a bidding-down attack or version rollback attack, is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. an encrypted connec ...
s.
When a server supports channel binding, it adds the character sequence '-PLUS' to the advertised SCRAM algorithm name.
Strengths
* Strong password storage: When implemented in a right way, the server can store the passwords in a salted, iterated hash format, making offline attacks harder, and decreasing the impact of database breaches.
* Simplicity: Implementing SCRAM is easier than DIGEST-MD5.
* International interoperability: the RFC requires UTF-8
UTF-8 is a variable-width encoding, variable-length character encoding used for electronic communication. Defined by the Unicode Standard, the name is derived from ''Unicode'' (or ''Universal Coded Character Set'') ''Transformation Format 8-bit'' ...
to be used for usernames and passwords, unlike CRAM-MD5.
* Because only the salted and hashed version of a password is used in the whole login process, and the salt on the server doesn't change, a client storing passwords can store the hashed versions, and not expose the clear text password to attackers. Such hashed versions are bound to one server, which makes this useful on password reuse.
References
External links
* , SCRAM for SASL and GSS-API
* , SCRAM-SHA-256 and SCRAM-SHA-256-PLUS
* {{IETF RFC, 7804, link=no, SCRAM in HTTP
GNU Network Security Labyrinth
(presentation similar to Motivation
Motivation is the reason for which humans and other animals initiate, continue, or terminate a behavior at a given time. Motivational states are commonly understood as forces acting within the agent that create a disposition to engage in goal-dire ...
section)
Cryptographic protocols