SCRAM-05 notes (was: Clarifying the qualities we desire the DIGEST-MD5 replacement to have)

[Hallvard B Furuseth <h.b.furuseth@xxxxxxxxxxx>]

I wrote:
>> 1.1. Terminology
>>       The authentication information for a
>>       SCRAM identity consists of salt and the "StoredKey" and
>>       "ServerKey" (as defined in the algorithm overview) for each
>>       supported cryptographic hash function.
>
> Also iteration count.  So, a set of tuples
>    (hash function, iteration count, salt, StoredKey, ServerKey).
>
> If the iteration count is a config parameter instead of stored per hash,
> the admin must throw away all hashes and get all users to set new
> passwords.

Eh.  I meant, if the admin wants to increase the configured iteration
count he must do that.


Another detail: You can use RFC 3112's authPassword for the LDAP
attribute.  Though I imagine implementations will instead use
   userPassword: {SCRAM}whatever
as described in RFC 2307, even though that breaks the LDAP standard.

-- 
Hallvard