Struct ScramClient 

pub struct ScramClient {
    pub client_nonce_b64: String,
    pub client_first_bare: String,
    pub client_first: String,
}

SCRAM-SHA-256 client state.

Holds the client nonce and first message needed for the authentication exchange.

Fields

client_nonce_b64: String

Base64-encoded client nonce (18 random bytes)

client_first_bare: String

Client-first-message-bare (without channel binding prefix)

client_first: String

Complete client-first-message to send to server

Implementations

impl ScramClient

pub fn new(username: &str) -> ScramClient

Create a new SCRAM client with a random nonce.

Arguments

• username - PostgreSQL username (will be SASL-escaped)

pub fn parse_server_first(server_first: &str) -> Result<(String, String, u32)>

Parse server-first-message.

Extracts:

• r: Combined nonce (client nonce + server nonce)
• s: Base64-encoded salt
• i: Iteration count

Errors

Returns error if any required field is missing or malformed.

pub fn client_final( &self, password: &str, server_first: &str, ) -> Result<(String, String, Vec<u8>)>

Compute client-final-message.

Arguments

• password - User’s password
• server_first - Server-first-message received from server

Returns

Tuple of:

• client_final: Message to send to server
• auth_message: Full auth message (needed for server verification)
• salted_password: Derived key (needed for server verification)

Errors

• Nonce doesn’t start with client nonce (possible MITM)
• Invalid base64 in salt

pub fn verify_server_final( server_final: &str, salted_password: &[u8], auth_message: &str, ) -> Result<()>

Verify server-final-message.

This provides mutual authentication - ensures we’re talking to a server that knows the password, not an impostor.

Arguments

• server_final - Server-final-message received
• salted_password - From client_final() return value
• auth_message - From client_final() return value

Errors

• Missing server signature
• Invalid base64
• Signature mismatch (server doesn’t know password)

Trait Implementations

impl Clone for ScramClient

fn clone(&self) -> ScramClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScramClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.