Support CRAM-MD5 or SCRAM-SHA-* for SMTP email submission #29333

Activity

1. jas4711

   added

   0. Needs triagePending check for reproducibility or if it fits our roadmapPending check for reproducibility or if it fits our roadmap

   enhancement

   on Oct 20, 2021
2. joshtrichards commented on Jul 8, 2023

   

   joshtrichards

   on Jul 8, 2023

   Member

   More actions

   Done.

   CRAM-MD5 support added in #30349 and documented in nextcloud/documentation#10023. Released in NC26.

   https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/email_configuration.html?highlight=crammd5#configuring-an-smtp-server

   Please close this Issue out.

   P.S. If you want support for any additional methods, you'll have to take that upstream since we rely Symfony Mailer. :-)

   👍React with 👍1Reacted by Simon Josefsson
3. Neustradamus commented on Aug 6, 2023

   

   Neustradamus

   on Aug 6, 2023

   Last edited by Neustradamus

   More actions

   @nextcloud team, @joshtrichards: Sorry, but it is time to remove CRAM-MD5, it is old and unsecure (it is same for DIGEST-MD5, LOGIN):

   • https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00
   • https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00
   • https://tools.ietf.org/html/rfc6331

   Can you add SCRAM-SHA-*(-PLUS)?

   SCRAM-SHA-1(-PLUS):

   • https://tools.ietf.org/html/rfc5802
   • https://tools.ietf.org/html/rfc6120

   SCRAM-SHA-256(-PLUS):

   • https://tools.ietf.org/html/rfc7677 since 2015-11-02
   • https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA

   SCRAM-SHA-512(-PLUS):

   • https://tools.ietf.org/html/draft-melnikov-scram-sha-512

   SCRAM-SHA3-512(-PLUS):

   • https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

   -PLUS variants:

   • RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056
   • RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929
   • Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml
   • RFC9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

   IMAP:

   • RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051

   LDAP:

   • RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803

   HTTP:

   • RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804

   2FA:

   • Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa

   IANA:

   • Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

   Linked to:

   • State of Play scram-sasl/info#1

   Thanks in advance.
4. jas4711 commented on Aug 6, 2023

   

   jas4711

   on Aug 6, 2023

   Author

   More actions

   I don't think CRAM-MD5 should be removed -- the IETF never got around to deprecating it, IIRC. CRAM-MD5 is not insecure when used under TLS. While I agree with adding SCRAM, I think that should be filed as a separate bug (possibly in Symfomy as suggested). Since my original request has been fixed (adding CRAM-MD5 or SCRAM) I am closing this request. Thank you for adding CRAM-MD5!
5. jas4711

   closed this as completedon Aug 6, 2023