RFC 5802: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms
In plain English — editorial summary, not part of the RFC
The secure authentication mechanism most widely deployed and used by Internet application protocols is the transmission of clear-text passwords over a channel protected by Transport Layer Security (TLS). There are some significant security concerns with that mechanism, which could be addressed by the use of a challenge response authentication mechanism protected by TLS. Unfortunately, the challenge response mechanisms presently on the standards track all fail to meet requirements necessary for widespread deployment, and have had success only in limited use. This specification describes a family of Simple Authentication and Security Layer (SASL; RFC 4422) authentication mechanisms called the Salted Challenge Response Authentication Mechanism (SCRAM), which addresses the security concerns and meets the deployability requirements. When used in combination with TLS or an equivalent security layer, a mechanism from this family could improve the status quo for application protocol authentication and provide a suitable choice for a mandatory-to-implement mechanism for future application protocol standards. [STANDARDS-TRACK]
Document record
- Document ID
- RFC5802
- Published
- July 2010
- Authors
- C. Newman; A. Menon-Sen; A. Melnikov; N. Williams
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- sec
- Pages
- 28
- Also known as
- —
Topics
Referenced by
2 later RFCs formally update or obsolete part of this document.
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 4013SASLprep: Stringprep Profile for User Names and PasswordsObsoleted
March 2005
- RFC 5803Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted Challenge Response Authentication Mechanism (SCRAM) SecretsCurrent
July 2010
- RFC 4643Network News Transfer Protocol (NNTP) Extension for AuthenticationCurrent
October 2006
- RFC 5801Using Generic Security Service Application Program Interface (GSS-API) Mechanisms in Simple Authentication and Security Layer (SASL): The GS2 Mechanism FamilyUpdated
July 2010
- RFC 5793PB-TNC: A Posture Broker (PB) Protocol Compatible with Trusted Network Connect (TNC)Current
March 2010
- RFC 5792PA-TNC: A Posture Attribute (PA) Protocol Compatible with Trusted Network Connect (TNC)Current
March 2010
- RFC 5816ESSCertIDv2 Update for RFC 3161Current
April 2010
- RFC 5776Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Asynchronous Layered Coding (ALC) and NACK-Oriented Reliable Multicast (NORM) ProtocolsCurrent
April 2010
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?