Skip to content
Dialova

IRC Documentation · Intermediate

SASL on IRC: Authenticating an account

SASL authenticates an account with the IRC service, often before the end of the connection. It does not alone encrypt the transport and is not confused with the requested nickname or the server certificate verification.

Dialova Team · Verified on

TLS, SASL, and NickServ: Three Roles #

MechanismRole
TLSProtect the connection and verify the server's identity using a certificate.
SASLAuthenticate an account via a negotiated mechanism.
NickServAccount/nickname management service whose commands depend on the network.

SASL is useful for entering a channel that requires an identified account upon arrival. The account name can be different from the nickname. A server may also have a login authentication PASS: do not confuse these fields.

Choose an announced mechanism #

The server may announce sasl=PLAIN,EXTERNAL in CAP LS 302. PLAIN uses an account secret in a Base64-encoded exchange; this is not encryption. EXTERNAL relies on an external identity accepted, for example, a client certificate associated with the account. Neither mechanism nor client certificate should be assumed available on all networks.

  • Use TLS and verify the server's name and certificate chain.
  • Activate SASL with CAP REQ, then wait for ACK.
  • Choose a mechanism understood and offered by the server.
  • Handle success, failure, and abandonment before finalizing registration.

PLAIN example with fictitious identifiers #

After CAP ACK sasl, on a TLS link: fictitious example
C: AUTHENTICATE PLAIN
S: AUTHENTICATE +
C: AUTHENTICATE AGFsaWNlAG1vdC1kZS1wYXNzZS1leGVtcGxl
S: :irc.example 903 Alice :SASL authentication successful

This Base64 represents an empty authorization identity, the account 'alice', and the password 'example-password', separated by NUL. It serves to explain the format, not to provide a secret to copy. The AUTHENTICATE sheet specifies the 400-octet chunks and the marker +.

Do not mask an identity failure #

A 904 indicates a failure; a timeout or the disappearance of sasl do not constitute successful authentication. If the network requires SASL, stop the attempt and display an exploitable cause without logging the secret. Reauthentication after registration described by SASL 3.2 depends on the server.

For Dialova, create a dedicated IRC key in the account settings. This key is for the IRC software; do not use your Web password in a script example or a published file.

Sources & Verification

Examples use pseudonyms and fictional domains, except for explicitly documented connection points. Network-specific extensions and settings are noted in the text.