Subject: [kitten] SCRAM GSS-API mechanism implementations?

From: Simon Josefsson <[email-masked]>
Date: Wed, 22 Aug 2012 22:57:12 +0200

Has anyone implemented SCRAM as a GSS-API mechanism?

On the initiator side I'm using gss_acquire_cred_with_password (with
authentication identity being fed from the desired_name, or defaulting
to system username), but I'm struggling to find a good server-side
solution.

There is gss_add_cred_with_password which you in theory could iterate
over and add all local users, but you would typically not want to store
passwords in clear text.  Further, you would also want to specify the
number of PBKDF2 iterations and the salt.

So the only options appear to do something that is hidden from the
application (like a /etc/my-scram-secrets file), or furnish a new
GSS-API interface.

The GSS-API interface could be a callback-style interface, to allow the
application to fetch # of PBKDF2 iterations, salt, and hash for a
particular user.  If someone has implemented either approach or has
pointers to it, it would be useful to share experience.

Thanks,
/Simon