Re: SCRAM methods

[Jeremy Harris]

On 03/01/2020 15:28, Jeremy Harris wrote:
> On 03/01/2020 14:40, Simon Josefsson wrote:
>> Clients should store the ClientKey:
>>
>> ClientKey       := HMAC(SaltedPassword, "Client Key")

As far as I can tell, the client needs to additionally
store the ServerKey - otherwise the ClientKey is not enough
(it needs the salted-password in order to calculate the
ServerKey, to calculate the ServerSignature for comparison
with what comes over the wire, to validate the server).

>> This allows the client to perform the client-side authentication.  An
>> attacker who steals the ClientKey cannot impersonate a server.

... though whether that still holds, if an attacker steals both,
I can't tell.

>>
>> Servers should store StoredKey and the ServerKey:
>>
>>      StoredKey       := H(ClientKey)
>>      ServerKey       := HMAC(SaltedPassword, "Server Key")
> 
> ... along with salt, itercnt?

I have this coded (both libgsasl and exim) and apparently operational.
Please say if you want a copy of my hacking.
-- 
Cheers,
  Jeremy