Module scram 

SCRAM (RFC 5802) with support for SHA-256 and SHA-512.

Structs

PgScramVerifier

A PostgreSQL pg_authid.rolpassword SCRAM-SHA-256 verifier.

ScramClientExchange

RFC 5802 SCRAM client-side handshake, initial phase.

ScramClientFirst

A parsed SCRAM client-first message.

ScramCredential

ScramIterations

Broker-valid PBKDF2 iteration count for a SCRAM credential.

Enums

ScramError

Errors returned by the PostgreSQL SCRAM verifier codec.

ScramServerExchange

RFC 5802 SCRAM server-side handshake, one type per negotiation phase.

StepResult

Constants

DEFAULT_SCRAM_ITERATIONS

Default PBKDF2 iteration count for new Kafka SCRAM credentials.

MAX_SCRAM_ITERATIONS

Maximum PBKDF2 iteration count accepted by the broker.

MIN_SCRAM_ITERATIONS

Minimum PBKDF2 iteration count accepted by the broker.

TOKEN_AUTH_EXTENSION

The SCRAM extension that marks a KIP-48 delegation-token authentication. Its value is true when the SCRAM username is a token id.

Functions

decode_saslname

Decode an RFC 5802 saslname, as Kafka’s ScramFormatter.username does.

derive_keys_from_salted

Reconstruct (stored_key, server_key) from the salted-password output the client sends in an AlterUserScramCredentialsRequest per KIP-554.

encode_saslname

Encode a username as an RFC 5802 saslname: = becomes =3D and , becomes =2C, as Kafka’s ScramFormatter.saslName does.

hash_scram_password

Hash password into a SCRAM credential with a fresh random 16-byte salt.

hash_scram_password_with_salt

Test-only entry that lets callers fix the salt for golden vectors.

pbkdf2_salted

Compute the PBKDF2 output for a SCRAM mechanism.

scram_hash_len

Output byte length of the underlying hash function for a SCRAM mechanism.