SCRAMSHA1

SCRAM-SHA-1 refers to the SCRAM (Salted Challenge Response Authentication Mechanism) variant that uses SHA-1 as its underlying hash function. It is defined as SCRAM-SHA-1 in the SASL framework and is part of the family of mechanisms designed to provide password-based authentication without sending plain passwords over the network.

How it works in brief: the authentication occurs through a challenge-response exchange between client and server. The client starts with a first message containing a nonce. The server replies with a second message that includes its own nonce, a salt, and an iteration count. The client then sends a final message that contains a client proof, computed from the salted password and the exchanged nonces. The server verifies the client proof and, if valid, responds with a server signature to prove it possesses the correct credentials. Channel binding can be used to protect against certain man-in-the-middle attacks.

Password handling and storage: the client derives a salted password from the user’s password using a key derivation function analogous to PBKDF2 with HMAC-SHA-1, guided by the provided salt and iteration count. From this salted password, a client key and a server key are computed. The server stores a representation of the password material, typically including the salt, iteration count, and derived values (StoredKey and ServerKey), rather than storing plaintext passwords.

Security considerations: SCRAM-SHA-1 provides mutual authentication and protects against eavesdropping of passwords. However, SHA-1 is considered weaker for collision resistance than newer hash functions, so many deployments prefer SCRAM-SHA-256 or higher. When available, channel binding enhances protection against certain man-in-the-middle threats.

Standards and usage: SCRAM-SHA-1 is standardized in RFC 5802 as a SASL mechanism. It has been implemented in various systems and services that support SASL-based authentication, including some databases and directory services.