Skip to content

🔒️ Add SASL::ScramCache for salted SCRAM keys - #645

Draft
nevans wants to merge 2 commits into
masterfrom
scram-cache
Draft

🔒️ Add SASL::ScramCache for salted SCRAM keys#645
nevans wants to merge 2 commits into
masterfrom
scram-cache

Conversation

@nevans

@nevansnevans commented Apr 19, 2026

Copy link
Copy Markdown
Collaborator

Adds SASL::ScramCache, a SASL::ScramAuthenticator#cache attr, and a cache keyword parameter to SASL::ScramAuthenticator#initialize.

This avoids expensive re-hashing that was done during a single authentication exchange. It can also be re-used across multiple authentication exchanges.

When the cache kwarg contains the client and server keys (or the salted password), password is optional. But authentication will fail if salt or iterations change and password hasn't been provided.

TODO before merging:

  • Add at least one test case to test/net/imap/test_imap_authenticate.rb
  • When an error occurs, the authentication exchange should be canceled correctly (by sending the "=" char as the continuation response). Test that this is done when cache is used without password, but the server reports an updated salt and iteration_count.
  • Consider how this would work with a slightly different API, using a cache store:
    • Should a cache store API supplement or replace the current cached credentials API?
    • Should this be a "credentials store" API instead, and extended to other SASL authenticator's credentials? It might be used to load credentials from a KMS, with auditing (etc).

@nevans
nevansforce-pushed the scram-cache branch 2 times, most recently from f947db6 to 27c9dcdCompareApril 19, 2026 11:23
@nevansnevans added enhancement New feature or request SASL 🔒 Authentication and authentication mechanisms labels Apr 24, 2026
Adds `SASL::ScramCache`, a `SASL::ScramAuthenticator#cache` attr, and a
`cache` keyword parameter to `SASL::ScramAuthenticator#initialize`.
This avoids expensive re-hashing that was done during a single
authentication exchange, but can also be re-used across multiple
authentication exchanges.
@nevans
nevans marked this pull request as draft May 14, 2026 13:44
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancementNew feature or requestSASL 🔒Authentication and authentication mechanisms

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@nevans