SCRAM authentication

SCRAM (Salted Challenge Response Authentication Mechanism) is a secure challenge-response authentication method that allows clients to prove their identity without transmitting the actual password over the network. It is a SASL mechanism (defined in RFC 5802 and RFC 7677); rather than being part of MQTT itself, TBMQ carries it over the MQTT 5.0 enhanced-authentication framework — the AUTH packet together with the Authentication Method and Authentication Data properties. It provides stronger security guarantees than Basic authentication, and TBMQ supports two mechanisms: SCRAM-SHA-256 and SCRAM-SHA-512.

Unlike Basic authentication, where credentials are sent directly in the CONNECT packet, SCRAM performs a multi-step handshake:

1. The client sends an initial authentication message with the username.
2. The broker responds with a server challenge (a random nonce and salt).
3. The client computes a cryptographic response using the password and challenge data.
4. The broker verifies the response without ever receiving the plaintext password.

This approach protects against replay attacks and password interception even on unencrypted connections.