Hi all,

I've recently implemented XEP-0474 (SASL SCRAM Downgrade Protection, version 0.5.0) in Openfire. The example in section 6.3 was useful during that work.

While writing tests I generated a handful of additional vectors, and I think the XEP would be more useful to implementers if it carried a few more of them. The cases I found worth pinning down:

the 6.3 example extended to SHA-256 and SHA-512, since the specification applies to any SCRAM hash function but only exemplifies one;
a case where no channel-binding types were advertised, which is where an implementation might wrongly emit a bare %x1F separator;
a case including non-SCRAM mechanisms (PLAIN, EXTERNAL), making it explicit that the full advertised mechanism list is hashed, not just the SCRAM ones;
the single-entry degenerate cases.

In A and C the values are deliberately listed in an order that differs from the sorted order, so an implementation that skips the i;octet sort will fail those two. B, D and E instead pin down the presence or absence of the %x1F section.

The vectors are below. I've given the hash input both as an escaped string and as hex, so that the list construction and the hashing can be checked separately.

Important caveat: these come from a single implementation (mine). The SHA-1 value of the first one is the only one that is already published in the XEP. I would not want the others added to the specification on the basis of my implementation alone: A test vector that is wrong is worse than no test vector.

So: would anyone with an independent XEP-0474 implementation be willing to check them? If more people arrive at the same values independently, I'm happy to write them up as a pull request against the XEP in whatever form the author and council prefer. If anyone arrives at different values, that is an even more interesting result - please let me know either way.

-- A. The existing §6.3 example ------------------------------------------
advertised mechanisms : SCRAM-SHA-1, SCRAM-SHA-1-PLUS
advertised cb types : tls-server-end-point, tls-exporter
hash input : SCRAM-SHA-1%x1ESCRAM-SHA-1-PLUS%x1Ftls-exporter%x1Etls-server-end-point
input (hex) : 534352414d2d5348412d311e534352414d2d5348412d312d504c55531f746c732d6578706f727465721e746c732d7365727665722d656e642d706f696e74
SHA-1 : G6k/rBLDqgOhRRaCuuatSDFkJ08=
SHA-256 : H6VEQ+6wl/eYKuTjJn4D9/e9GTn1AcYGw/oiSJ3Yhy0=
SHA-512 : Q1q0WwH927l2RRoYIMiDY0g7R21hTZK+bfBgkhqek9JSTfIzUlnUZQRB2A6lZL3ER7ZMWRRdQzEJKVH671Bh0g==

-- B. Same mechanisms, no channel-binding advertised ----------------------
advertised mechanisms : SCRAM-SHA-1, SCRAM-SHA-1-PLUS
advertised cb types : (none)
hash input : SCRAM-SHA-1%x1ESCRAM-SHA-1-PLUS
input (hex) : 534352414d2d5348412d311e534352414d2d5348412d312d504c5553
SHA-1 : g00gt4Qd0gJ3EvnclTnY0KEYfRg=
SHA-256 : Uuua9QJnTss43LMyJpE0esh43d9r8DB6N89DXs91aFo=
SHA-512 : eOeUdpE/0pNIUnVTIcURoWHTT22Ohgk8C5/03RZTyqK9vShp/jK5G+v7G36yqSEsZgXnH7wVq2gBuUxm11OEHA==

-- C. Full advertisement, including non-SCRAM mechanisms ------------------
advertised mechanisms : SCRAM-SHA-1, SCRAM-SHA-1-PLUS, SCRAM-SHA-256, SCRAM-SHA-256-PLUS, PLAIN, EXTERNAL
advertised cb types : tls-unique, tls-exporter, tls-server-end-point
hash input : EXTERNAL%x1EPLAIN%x1ESCRAM-SHA-1%x1ESCRAM-SHA-1-PLUS%x1ESCRAM-SHA-256%x1ESCRAM-SHA-256-PLUS%x1Ftls-exporter%x1Etls-server-end-point%x1Etls-unique
input (hex) : 45585445524e414c1e504c41494e1e534352414d2d5348412d311e534352414d2d5348412d312d504c55531e534352414d2d5348412d3235361e534352414d2d5348412d3235362d504c55531f746c732d6578706f727465721e746c732d7365727665722d656e642d706f696e741e746c732d756e69717565
SHA-1 : SQjUrwq125kFEHbaywmNGkNY8NI=
SHA-256 : jl3RxAJC6h0xX0nWBprC7vAD09HBsUNvCx5Ei/97Lt4=
SHA-512 : 8822jz/cRVDn3bk/XTx/RgrUHucqhcpcqWTOzXIU8lMwLZr2aKT/GXnqYdLWDLZS/qkmt7vmkPM7FJ0I8ADi2Q==

-- D. Minimal: one mechanism, one channel-binding type --------------------
advertised mechanisms : SCRAM-SHA-256-PLUS
advertised cb types : tls-exporter
hash input : SCRAM-SHA-256-PLUS%x1Ftls-exporter
input (hex) : 534352414d2d5348412d3235362d504c55531f746c732d6578706f72746572
SHA-1 : 50fovNdJS+nqcJ0IYUsXqRTUrtU=
SHA-256 : vxAYBdhmEYs9EAv8GQJQqk2YPUoLPUaj9em9zXzXzA0=
SHA-512 : Fk0ja0KqooAP1flikg4vmSejIFhTSExpY1qISx86+1xAgftZDqyAN0cokd2RWPt1ttQSYlxr2EA8BRj7jwLiow==

-- E. Single mechanism, no channel-binding advertised ---------------------
advertised mechanisms : SCRAM-SHA-1
advertised cb types : (none)
hash input : SCRAM-SHA-1
input (hex) : 534352414d2d5348412d31
SHA-1 : LrtFoCs8XsoI+diY4u3rG69UGN8=
SHA-256 : hzhrgAj6xgd4yQIejnb2tHGgllHiKhjRwvofy7ETi64=
SHA-512 : EMrc8V7X7onzZnTj6wtLdWqN9CM6v3VhUIZ2Th01rCX/uSlNzKVafB2MBIriyBEjzGLGEjlnn1e8nI4LHR4rDQ==

Kind regards,

Guus