Metadata-Version: 2.5
Name: scramp
Version: 1.4.18
Summary: An implementation of the SCRAM protocol.
Project-URL: Homepage, https://codeberg.org/tlocke/scramp
Author: The Contributors
License-Expression: MIT-0
License-File: LICENSE
Keywords: SASL,SCRAM,authentication
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: Implementation
Classifier: Programming Language :: Python :: Implementation :: CPython
Requires-Python: >=3.11
Requires-Dist: asn1crypto>=1.5.1
Description-Content-Type: text/markdown

# Scramp

A Python implementation of the [SCRAM authentication protocol](
https://en.wikipedia.org/wiki/Salted_Challenge_Response_Authentication_Mechanism).
Scramp supports the following mechanisms:

- SCRAM-SHA-1
- SCRAM-SHA-1-PLUS
- SCRAM-SHA-256
- SCRAM-SHA-256-PLUS
- SCRAM-SHA-512
- SCRAM-SHA-512-PLUS
- SCRAM-SHA3-512
- SCRAM-SHA3-512-PLUS

## Table Of Contents
<!-- mtoc-start -->

- [Installation](#installation)
- [Examples](#examples)
  - [Client and Server](#client-and-server)
  - [Client only](#client-only)
  - [Server only](#server-only)
  - [Server Error](#server-error)
  - [Avoiding User Enumeration](#avoiding-user-enumeration)
- [Standards](#standards)
- [Missing `tls-exporter` channel binding support](#missing-tls-exporter-channel-binding-support)
- [Key Derivation Function](#key-derivation-function)
- [API Docs](#api-docs)
  - [scramp.MECHANISMS](#scrampmechanisms)
  - [scramp.ScramClient](#scrampscramclient)
  - [scramp.ScramMechanism](#scrampscrammechanism)
  - [scramp.ScramServer](#scrampscramserver)
  - [scramp.make\_channel\_binding(name, ssl\_socket)](#scrampmake_channel_bindingname-ssl_socket)
- [Testing](#testing)
- [OpenSSF Scorecard](#openssf-scorecard)
- [Doing A Release Of Scramp](#doing-a-release-of-scramp)
- [Release Notes](#release-notes)
  - [Version 1.4.18, 2026-10-22](#version-1418-2026-10-22)
  - [Version 1.4.17, 2026-08-07](#version-1417-2026-08-07)
  - [Version 1.4.16, 2026-08-06](#version-1416-2026-08-06)
  - [Version 1.4.15, 2026-07-26](#version-1415-2026-07-26)
  - [Version 1.4.14, 2026-07-25](#version-1414-2026-07-25)
  - [Version 1.4.13, 2026-07-23](#version-1413-2026-07-23)
  - [Version 1.4.12, 2026-07-05](#version-1412-2026-07-05)
  - [Version 1.4.11, 2026-07-04](#version-1411-2026-07-04)
  - [Version 1.4.10, 2026-06-27](#version-1410-2026-06-27)
  - [Version 1.4.9, 2026-06-19](#version-149-2026-06-19)
  - [Version 1.4.8, 2026-01-06](#version-148-2026-01-06)
  - [Version 1.4.7, 2026-01-04](#version-147-2026-01-04)
  - [Version 1.4.6, 2025-07-05](#version-146-2025-07-05)
  - [Version 1.4.5, 2024-04-13](#version-145-2024-04-13)
  - [Version 1.4.4, 2022-11-01](#version-144-2022-11-01)
  - [Version 1.4.3, 2022-10-26](#version-143-2022-10-26)
  - [Version 1.4.2, 2022-10-22](#version-142-2022-10-22)
  - [Version 1.4.1, 2021-08-25](#version-141-2021-08-25)
  - [Version 1.4.0, 2021-03-28](#version-140-2021-03-28)
  - [Version 1.3.0, 2021-03-28](#version-130-2021-03-28)
  - [Version 1.2.2, 2021-02-13](#version-122-2021-02-13)
  - [Version 1.2.1, 2021-02-07](#version-121-2021-02-07)
  - [Version 1.2.0, 2020-05-30](#version-120-2020-05-30)
  - [Version 1.1.1, 2020-03-28](#version-111-2020-03-28)
  - [Version 1.1.0, 2019-02-24](#version-110-2019-02-24)
  - [Version 1.0.0, 2019-02-17](#version-100-2019-02-17)
  - [Version 0.0.0, 2019-02-10](#version-000-2019-02-10)

<!-- mtoc-end -->

## Installation

- Create a virtual environment: `python3 -m venv venv`
- Activate the virtual environment: `source venv/bin/activate`
- Install: `pip install scramp`

## Examples

### Client and Server

Here's an example using both the client and the server. It's a bit contrived as
normally you'd be using either the client or server on its own.

```python
>>> from scramp import ScramClient, ScramMechanism
>>>
>>> USERNAME = 'user'
>>> PASSWORD = 'pencil'
>>> MECHANISMS = ['SCRAM-SHA-256']
>>>
>>>
>>> # Choose a mechanism for our server
>>> m = ScramMechanism()  # Default is SCRAM-SHA-256
>>>
>>> # On the server side we create the authentication information for each user
>>> # and store it in an authentication database. We'll use a dict:
>>> db = {}
>>>
>>> salt, stored_key, server_key, iteration_count = m.make_auth_info(PASSWORD)
>>>
>>> db[USERNAME] = salt, stored_key, server_key, iteration_count
>>>
>>> # Define your own function for retrieving the authentication information
>>> # from the database given a username
>>>
>>> def auth_fn(username):
...     return db[username]
>>>
>>> # Make the SCRAM server
>>> s = m.make_server(auth_fn)
>>>
>>> # Now set up the client and carry out authentication with the server
>>> c = ScramClient(MECHANISMS, USERNAME, PASSWORD)
>>> cfirst = c.get_client_first()
>>>
>>> s.set_client_first(cfirst)
>>> sfirst = s.get_server_first()
>>>
>>> c.set_server_first(sfirst)
>>> cfinal = c.get_client_final()
>>>
>>> s.set_client_final(cfinal)
>>> sfinal = s.get_server_final()
>>>
>>> c.set_server_final(sfinal)
>>>
>>> # If it all runs through without raising an exception, the authentication
>>> # has succeeded
```

### Client only

Here's an example using just the client. The client nonce is specified in order
to give a reproducible example, but in production you'd omit the `c_nonce`
parameter and let `ScramClient` generate a client nonce:

```python
>>> from scramp import ScramClient
>>>
>>> USERNAME = 'user'
>>> PASSWORD = 'pencil'
>>> C_NONCE = 'rOprNGfwEbeRWgbNEkqO'
>>> MECHANISMS = ['SCRAM-SHA-256']
>>>
>>> # Normally the c_nonce would be omitted, in which case ScramClient will
>>> # generate the nonce itself.
>>>
>>> c = ScramClient(MECHANISMS, USERNAME, PASSWORD, c_nonce=C_NONCE)
>>>
>>> # Get the client first message and send it to the server
>>> cfirst = c.get_client_first()
>>> print(cfirst)
n,,n=user,r=rOprNGfwEbeRWgbNEkqO
>>>
>>> # Set the first message from the server
>>> c.set_server_first(
...     'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,'
...     's=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096')
>>>
>>> # Get the client final message and send it to the server
>>> cfinal = c.get_client_final()
>>> print(cfinal)
c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ=
>>>
>>> # Set the final message from the server
>>> c.set_server_final('v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4=')
>>>
>>> # If it all runs through without raising an exception, the authentication
>>> # has succeeded
```

### Server only

Here's an example using just the server. The server nonce and salt is specified
in order to give a reproducible example, but in production you'd omit the
`s_nonce` and `salt` parameters and let Scramp generate them:

```python
>>> from scramp import ScramMechanism
>>>
>>> USERNAME = 'user'
>>> PASSWORD = 'pencil'
>>> S_NONCE = '%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0'
>>> SALT = b'[m\x99h\x9d\x125\x8e\xec\xa0K\x14\x126\xfa\x81'
>>>
>>> db = {}
>>>
>>> m = ScramMechanism()
>>>
>>> salt, stored_key, server_key, iteration_count = m.make_auth_info(
...     PASSWORD, salt=SALT)
>>>
>>> db[USERNAME] = salt, stored_key, server_key, iteration_count
>>>
>>> # Define your own function for getting a password given a username
>>> def auth_fn(username):
...     return db[username]
>>>
>>> # Normally the s_nonce parameter would be omitted, in which case the
>>> # server will generate the nonce itself.
>>>
>>> s = m.make_server(auth_fn, s_nonce=S_NONCE)
>>>
>>> # Set the first message from the client
>>> s.set_client_first('n,,n=user,r=rOprNGfwEbeRWgbNEkqO')
>>>
>>> # Get the first server message, and send it to the client
>>> sfirst = s.get_server_first()
>>> print(sfirst)
r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096
>>>
>>> # Set the final message from the client
>>> s.set_client_final(
...     'c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,'
...     'p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ=')
>>>
>>> # Get the final server message and send it to the client
>>> sfinal = s.get_server_final()
>>> print(sfinal)
v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4=
>>>
>>> # If it all runs through without raising an exception, the authentication
>>> # has succeeded
```

### Server Error

Here's an example of when setting a message from the client causes an error. The
server nonce and salt is specified in order to give a reproducible example, but
in production you'd omit the `s_nonce` and `salt` parameters and let Scramp
generate them:

```python
>>> from scramp import ScramException, ScramMechanism
>>>
>>> USERNAME = 'user'
>>> PASSWORD = 'pencil'
>>> S_NONCE = '%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0'
>>> SALT = b'[m\x99h\x9d\x125\x8e\xec\xa0K\x14\x126\xfa\x81'
>>>
>>> db = {}
>>>
>>> m = ScramMechanism()
>>>
>>> salt, stored_key, server_key, iteration_count = m.make_auth_info(
...     PASSWORD, salt=SALT)
>>>
>>> db[USERNAME] = salt, stored_key, server_key, iteration_count
>>>
>>> # Define your own function for getting a password given a username
>>> def auth_fn(username):
...     return db[username]
>>>
>>> # Normally the s_nonce parameter would be omitted, in which case the
>>> # server will generate the nonce itself.
>>>
>>> s = m.make_server(auth_fn, s_nonce=S_NONCE)
>>>
>>> try:
...     # Set the first message from the client
...     s.set_client_first('p=tls-unique,,n=user,r=rOprNGfwEbeRWgbNEkqO')
... except ScramException as e:
...     print(e)
...     # Get the final server message and send it to the client
...     sfinal = s.get_server_final()
...     print(sfinal)
Received GS2 flag 'p' which indicates that the client requires channel binding,
but the server does not: channel-binding-not-supported
e=channel-binding-not-supported

```

### Avoiding User Enumeration

[User enumeration][user-enumeration] is where an attacker tries to find valid
user names by trying lots of different ones and distinguishing valid ones from
invalid ones by the different responses the server. In Scramp, if the
[`auth_fn`](#scrampscrammechanism) returns `None` then the client receives an
`unknown-user` response, which enables user enumeration. This is allowed
within the Scram specification.

To avoid user enumeration, instead of `auth_fn` returning `None` make it
return fake credentials. Then the error returned will be the same as if the
password were wrong. Here's an example:

```python
>>> from hmac import digest
>>> from secrets import DEFAULT_ENTROPY
>>> from scramp import ScramException, ScramMechanism
>>>
>>> S_NONCE = '%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0'
>>> S_SECRET = b"long-lived-server-secret"
>>>
>>> db = {}
>>>
>>> m = ScramMechanism()
>>>
>>> def auth_fn(username):
...     if username in db:
...         return db[username]
...     else:
...         algo = m.hf().name
...         u = username.encode()
...         salt = digest(S_SECRET, b"salt:" + u, 'sha256')[:DEFAULT_ENTROPY]
...         stored_key = digest(S_SECRET, b"sk:" + u, algo)
...         server_key = digest(S_SECRET, b"vk:" + u, algo)
...         i = int(m.iteration_count)
...         return salt, stored_key, server_key, i
>>>
>>>
>>> # Normally the s_nonce parameter would be omitted, in which case the
>>> # server will generate the nonce itself.
>>>
>>> s = m.make_server(auth_fn, s_nonce=S_NONCE)
>>>
>>> # Now set up the client and carry out authentication with the server
>>> MECHANISMS = ['SCRAM-SHA-256']
>>> USERNAME = 'user'
>>> PASSWORD = 'pencil'
>>>
>>> c = ScramClient(MECHANISMS, USERNAME, PASSWORD)
>>> cfirst = c.get_client_first()
>>>
>>> s.set_client_first(cfirst)
>>> sfirst = s.get_server_first()
>>>
>>> c.set_server_first(sfirst)
>>> cfinal = c.get_client_final()
>>>
>>> try:
...    s.set_client_final(cfinal)
... except ScramException as e:
...     print(e)
The client keys don't match.: invalid-proof
>>>
>>> # Get the final server message and send it to the client
>>> sfinal = s.get_server_final()
>>> print(sfinal)
e=invalid-proof
>>>
>>> try:
...    c.set_server_final(sfinal)
... except ScramException as e:
...     print(e)
The server returned an error: invalid-proof

```

When you create your fake inputs to `make_auth_info`, make sure that:

- Salt: HMAC(server_secret, username) truncated to the real salt length. It
  must be stable across requests, or an attacker spots fake users because their
  salt changes on every attempt while real salts don’t.
- Iteration count: use what real users have. If counts vary per user, that’s
  a leak you can’t fully close, so pick the default.
- Mechanism: respond to whatever was requested as if the user had it.
- Server secret: keep it stable across restarts.

[user-enumeration]:
  https://yellowgnu.com/the-hidden-security-risks-of-user-enumeration-and-how-to-prevent-them/

## Standards

- [RFC 5802](https://datatracker.ietf.org/doc/html/rfc5802) Describes SCRAM.
- [RFC 7677](https://datatracker.ietf.org/doc/html/rfc7677) Registers
  SCRAM-SHA-256 and SCRAM-SHA-256-PLUS.
- [draft-melnikov-scram-sha-512][draft-melnikov-scram-sha-512] Registers
   SCRAM-SHA-512 and SCRAM-SHA-512-PLUS.
- [draft-melnikov-scram-sha3-512][draft-melnikov-scram-sha3-512] Registers
  SCRAM-SHA3-512 and SCRAM-SHA3-512-PLUS.
- [RFC 5929](https://datatracker.ietf.org/doc/html/rfc5929) Channel Bindings
  for TLS.
- [RFC 9266](https://datatracker.ietf.org/doc/html/rfc9266) Defines the
  `tls-exporter` channel binding, which is
  [not yet supported by Scramp](https://codeberg.org/tlocke/scramp/issues/9).

[draft-melnikov-scram-sha-512]:
  https://datatracker.ietf.org/doc/html/draft-melnikov-scram-sha-512

[draft-melnikov-scram-sha3-512]:
  https://datatracker.ietf.org/doc/html/draft-melnikov-scram-sha3-512

## Missing `tls-exporter` channel binding support

RFC 9266 defines `tls-exporter` as the channel binding type for TLS 1.3, using the
keying-material exporter from [RFC 5705](https://www.rfc-editor.org/rfc/rfc5705)
(TLS ≤1.2) / [RFC 8446 §7.5](https://www.rfc-editor.org/rfc/rfc8446#section-7.5)
(TLS 1.3), i.e. OpenSSL's `SSL_export_keying_material()`.

Scramp can't implement `tls-exporter` because Python doesn't support it in
 [`SSLSocket.get_channel_binding()`](https://docs.python.org/3/library/ssl.html#ssl.SSLSocket.get_channel_binding).
Only the older `tls-unique`/`tls-server-end-point` are supported.

- Relevant Python issue: [python/cpython#25255](https://github.com/python/cpython/pull/25255)
- Relevant [Scramp issue](https://codeberg.org/tlocke/scramp/issues/9).

Once `tls-exporter` is supported by `SSLSocket.get_channel_binding()`, we can
support `tls-exporter` in Scramp.

## Key Derivation Function

If it's present, then Scramp uses the standard
[`hashlib.pbkdf2_hmac`](https://docs.python.org/3/library/hashlib.html#key-derivation)
key derivation function, but if it isn't present, then Scramp uses it's own pure-Python
implementation.

## API Docs

### scramp.MECHANISMS

A tuple of the supported mechanism names.

### scramp.ScramClient

`ScramClient(mechanisms, username, password, channel_binding=None, c_nonce=None)`

Constructor of the `scramp.ScramClient` class, with the following parameters:

- `mechanisms` - A list or tuple of mechanism names. ScramClient will choose
  the most secure. If `cbind_data` is `None`, the '-PLUS' variants will be
  filtered out first. The chosen mechanism is available as the property
  `mechanism_name`.
- `username`
- `password`
- `channel_binding` - Providing a value for this parameter allows channel
  binding to be used (ie. it lets you use mechanisms ending in '-PLUS'). The
  value for `channel_binding` is a tuple consisting of the channel binding name
  and the channel binding data. For example, if the channel binding name is
  `tls-unique`, the `channel_binding` parameter would be `('tls-unique', data)`,
  where `data` is obtained by calling
  [SSLSocket.get\_channel\_binding()][SSLSocket.get\_channel\_binding()]
  The convenience function `scramp.make_channel_binding()` can be used to create
  a channel binding tuple.
- `c_nonce` - The client nonce. It's sometimes useful to set this when testing /
  debugging, but in production this should be omitted, in which case
  `ScramClient` will generate a client nonce.

The `ScramClient` object has the following methods and properties:

- `get_client_first()` - Get the client first message.
- `set_server_first(message)` - Set the first message from the server.
- `get_client_final()` - Get the final client message.
- `set_server_final(message)` - Set the final message from the server.
- `mechanism_name` - The mechanism chosen from the list given in the constructor.

### scramp.ScramMechanism

`ScramMechanism(mechanism='SCRAM-SHA-256')`

Constructor of the `ScramMechanism` class, with the following parameter:

- `mechanism` - The SCRAM mechanism to use.

The `ScramMechanism` object has the following methods and properties:

- `make_auth_info(password, iteration_count=None, salt=None)` - Returns the
  tuple `(salt, stored_key, server_key, iteration_count)` which is stored in the
  authentication database on the server side. It has the following parameters:
  - `password` - The user's password as a `str`.
  - `iteration_count` - The rounds as an `int`. If `None` then use the minimum
    associated with the mechanism.
  - `salt` - It's sometimes useful to set this binary parameter when testing /
    debugging, but in production this should be omitted, in which case a salt
    will be generated.
- `make_server(auth_fn, channel_binding=None, s_nonce=None)` - returns a
  `ScramServer` object. It takes the following parameters:
  - `auth_fn` This is a function provided by the programmer that has one
    parameter, a username of type `str` and returns returns the tuple
    `(salt, stored_key, server_key, iteration_count)`. Where `salt`,
    `stored_key` and `server_key` are of a binary type, and `iteration_count` is
    an `int`. It can optionally return `None` if a user isn't found.
  - `channel_binding` - Providing a value for this parameter allows channel
    binding to be used (ie. it lets you use mechanisms ending in `-PLUS`). The
    value for `channel_binding` is a tuple consisting of the channel binding
    name and the channel binding data. For example, if the channel binding name
    is 'tls-unique', the `channel_binding` parameter would be
    `('tls-unique', data)`, where `data` is obtained by calling
    [SSLSocket.get\_channel\_binding()][SSLSocket.get\_channel\_binding()]. The
    convenience function `scramp.make_channel_binding()` can be used to create a
    channel binding tuple. If `channel_binding` is provided and the mechanism
    isn't a `-PLUS` variant, then the server will negotiate with the client to
    use the `-PLUS` variant if the client supports it, or otherwise to use the
    mechanism without channel binding.
  - `s_nonce` - The server nonce as a `str`. It's sometimes useful to set this
    when testing / debugging, but in production this should be omitted, in which
    case `ScramServer` will generate a server nonce.
  - `salted_password` - A binary object representing the hashed password.
- `iteration_count` - The minimum iteration count recommended for this mechanism.

[SSLSocket.get\_channel\_binding()]:
  https://docs.python.org/3/library/ssl.html#ssl.SSLSocket.get_channel_binding

### scramp.ScramServer

The `ScramServer` object has the following methods:

- `set_client_first(message)` - Set the first message from the client.
- `get_server_first()` - Get the server first message.
- `set_client_final(message)` - Set the final client message.
- `get_server_final()` - Get the server final message.

Note that `ScramServer` doesn't enforce a maximum message or field length, so
that's something you might want to consider doing if you're embedding it in a
network-facing server.

### scramp.make\_channel\_binding(name, ssl\_socket)

A helper function that makes a `channel_binding` tuple when given a channel
binding name and an SSL socket. The parameters are:

- `name` - A channel binding name such as 'tls-unique' or
  'tls-server-end-point'.
- `ssl_socket` - An instance of
  [ssl.SSLSocket](https://docs.python.org/3/library/ssl.html#ssl.SSLSocket).

## Testing

- Activate the virtual environment: `source venv/bin/activate`
- Install `tox`: `pip install tox`
- Run `tox`: `tox`

## OpenSSF Scorecard

It might be worth running the [OpenSSF Scorecard](https://securityscorecards.dev/):

`podman run -e GITHUB_AUTH_TOKEN=<auth_token> gcr.io/openssf/scorecard:stable --repo=github.com/tlocke/scramp`

## Doing A Release Of Scramp

Run `tox` to make sure all tests pass, then update the release notes, then do:

- `git tag -a x.y.z -m "version x.y.z"`
- `rm -r dist`
- `python -m build`
- `twine upload dist/*`

## Release Notes

### Version 1.4.18, 2026-10-22

- Add a pure-Python fallback for `pbkdf2_hmac` since
  [hashlib.pbkdf2_hmac](https://docs.python.org/3/library/hashlib.html#key-derivation)
  is only available if Python has been compiled with OpenSSL.
- Strengthen validation of iteration counts and salts.
- Improve SCRAM message parsing and validation.

### Version 1.4.17, 2026-08-07

- Allow `auth_fn` to be any callable.

### Version 1.4.16, 2026-08-06

- Encapsulate `auth_fn` with `AuthFn`, a class that parses the output.

### Version 1.4.15, 2026-07-26

- Check message attribute values don't have invalid characters.

### Version 1.4.14, 2026-07-25

- Make sure all Salt and Nonce errors can be handled with the protocol.
- Add note in README on tls-exporter.

### Version 1.4.13, 2026-07-23

- Have a Nonce class for validation.
- Have a Salt class for validation.
- Handle exceptions from the auth function.
- Optional extensions should be ignored.
- Check for invalid GS2 header.

### Version 1.4.12, 2026-07-05

- Check for invalid escape chars in username.

### Version 1.4.11, 2026-07-04

- Make sure all errors detected by the server get returned to the client as
  valid errors.

### Version 1.4.10, 2026-06-27

- Implement max and min guards for iteration count.
- The xor() function should fail if the two values are of unequal lengths
- Handle the case of an error in first server message
- Fix formatting in channel binding error message
- SHA3-512 didn't work, but it should do now

### Version 1.4.9, 2026-06-19

- Fix typo in error message.
- Strictly validate on base 64 decoding
- Handle escaping in usernames according to the spec.
- [SASLprep](https://www.rfc-editor.org/info/rfc8265/): Raise exception rather
  than using assert

### Version 1.4.8, 2026-01-06

- Use the [`secrets`](https://docs.python.org/3/library/secrets.html) module from
  the Standard Library for generating the salt and nonce.

### Version 1.4.7, 2026-01-04

- The main change in this release is that we now use
  [`hashlib.pbkdf2_hmac()`](https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf2_hmac)
  from the standard library, rather than our own Python implementation.
  Since this is fast, we no longer need to provide a way of using a custom
  key derivation function, and so `make_stored_server_keys()` has been removed.
- To avoid timing attacks we now use
  [`hmac.compare_digest()`](https://docs.python.org/3/library/hmac.html#hmac.compare_digest)
  for digest comparisons.

### Version 1.4.6, 2025-07-05

- Drop support for Python 3.8, and add support for 3.13

### Version 1.4.5, 2024-04-13

- Drop support for Python 3.7, which means we're not dependent on
  `importlib-metadata` anymore.
- Various changes to build system, docs and automated testing.

### Version 1.4.4, 2022-11-01

- Tighten up parsing of messages to make sure that a `ScramException` is raised
  if a message is malformed.

### Version 1.4.3, 2022-10-26

- The client now sends a gs2-cbind-flag of 'y' if the client supports channel
  binding, but thinks the server does not.

### Version 1.4.2, 2022-10-22

- Switch to using the MIT-0 licence <https://choosealicense.com/licenses/mit-0/>
- When creating a ScramClient, allow non ``-PLUS`` variants, even if a
  `channel_binding` parameter is provided. Previously this would raise and
  exception.

### Version 1.4.1, 2021-08-25

- When using `make_channel_binding()` to create a tls-server-end-point channel
  binding, support certificates with hash algorithm of sha512.

### Version 1.4.0, 2021-03-28

- Raise an exception if the client receives an error from the server.

### Version 1.3.0, 2021-03-28

- As the specification allows, server errors are now sent to the client in the
  `server_final` message, an exception is still thrown as before.

### Version 1.2.2, 2021-02-13

- Fix bug in generating the AuthMessage. It was incorrect when channel binding
  was used. So now Scramp supports channel binding.

### Version 1.2.1, 2021-02-07

- Add support for channel binding.
- Add support for SCRAM-SHA-512 and SCRAM-SHA3-512 and their channel binding variants.

### Version 1.2.0, 2020-05-30

- This is a backwardly incompatible change on the server side, the client side
  will work as before. The idea of this change is to make it possible to have an
  authentication database. That is, the authentication information can be
  stored, and then retrieved when needed to authenticate the user.
- In addition, it's now possible on the server side to use a third party hashing
  library such as passlib as the hashing implementation.

### Version 1.1.1, 2020-03-28

- Add the README and LICENCE to the distribution.

### Version 1.1.0, 2019-02-24

- Add support for the SCRAM-SHA-1 mechanism.

### Version 1.0.0, 2019-02-17

- Implement the server side as well as the client side.

### Version 0.0.0, 2019-02-10

- Copied SCRAM implementation from [pg8000](https://github.com/tlocke/pg8000).
  The idea is to make it a general SCRAM implemtation. Credit to the
  [Scrampy](https://github.com/cagdass/scrampy) project which I read through to
  help with this project. Also credit to the
  [passlib](https://github.com/efficks/passlib) project from which I copied the
  `saslprep` function.
