You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "dxbjavid (via GitHub)" <gi...@apache.org> on 2026/10/11 06:28:54 UTC
[PR] require scram server nonce to extend the client nonce [httpcomponents-client]
dxbjavid opened a new pull request, #896:
URL: https://github.com/apache/httpcomponents-client/pull/896
When the SCRAM-SHA-256 client processes the server-first message it only checks that the server nonce begins with the client nonce, so a server (or a man in the middle) can echo the client nonce unchanged and the client carries on as though the handshake were sound. RFC 5802 section 5.1 requires the server to append its own nonce to the client's, and accepting an unchanged value drops the server's contribution to the combined nonce and the freshness that comes with it. This tightens the check in ScramScheme to also require the server nonce to be strictly longer than the client nonce, with a regression test; conformant servers always extend the nonce, so interoperability is unaffected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] require scram server nonce to extend the client nonce [httpcomponents-client]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg merged PR #896:
URL: https://github.com/apache/httpcomponents-client/pull/896
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] require scram server nonce to extend the client nonce [httpcomponents-client]
Posted by "dxbjavid (via GitHub)" <gi...@apache.org>.
dxbjavid commented on PR #896:
URL: https://github.com/apache/httpcomponents-client/pull/896#issuecomment-6143616689
@arturobernalg Thanks, appreciate the review and merge!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org