Subject: Re: ABNF for the three cases of SCRAM as GS2

From: Alexey Melnikov <[email-masked]>
Date: Sun, 15 Feb 2009 13:34:21 +0000

Hallvard B Furuseth wrote:

>Alexey Melnikov wrote:
>  
>
>>Hallvard B Furuseth wrote:
>>
>>>Also, how does an iteration count of more than 1 help on a site where
>>>passwords are stored in several forms anyway, maybe including salted MD5
>>>for Unix crypt()?  (Maybe that's for Appendix B or C, I don't know.)
>>>      
>>>
>>My understanding is that one can read values from hashed password files
>>and use them to implement server side SCRAM.
>>There is no requirement that SCRAM specific hash be stored in such files.
>>    
>>
>That sounds strange, unless you are talking about a weakness which can
>be attacked.
>
>The password-file secret would be
>  salt, Hash(salt || password)
>while even with iteration count 0, SCRAM SaltedPassword is
>  Hash((password XOR opad) || Hash((password XOR ipad) || salt || INT(1)))
>
You are right.
I've checked earlier versions of both SCRAM and HEXA and neither of them 
mentioned use in Unix hashed password databases.
So this was just my wishful thinking.

>In any case, if there is a mapping MD5 crypt -> SCRAM crypt, that just
>makes the iteration count less useful as far as I can see.
>  
>