Subject: Re: [SASL] Comments about draft-ietf-sasl-plain-00.txt

From: Alexey Melnikov <[email-masked]>
Date: Sun, 23 Mar 2003 17:57:00 -0700

More comments below.

Alexey Melnikov wrote:

> 2. PLAIN SASL mechanism
>
>   The mechanism consists of a single message from the client to the
>   server.  The client sends the authorization identity (identity to
>   login as), followed by a NUL character, followed by the authentication
>   identity (identity whose password will be used), followed by a NUL
>   character, followed by the clear-text password.   The client leaves
>   the authorization identity empty if wishes the server to derive the
>   authorization identity from the provided the authentication identity.

Last line: drop "the" before "authentication identity".

> Appendix A.  Changes since RFC 2595
>
>   The specification details how the server is to compare client-provided
>   character strings with stored character strings.

I suggest that the example code be moved to SASLPrep document or the base
SASL spec.
Or maybe not, as it has some PLAIN specific checks, but some pieces of it
are generic and I would hate to cut & paste them into every SASL mechanism
that requires SASLPrep.

>   The ABNF grammar was updated.  In particular, the grammar now allows
>   LINE FEED (U+000A) and CARRIAGE RETURN (U+000D) characters in the
>   authzid, authcid, passwd productions.   However, whether these control
>   characters may be used depends on the string preparation rules
>   applicable to the production.   For authcid, control characters are
>   prohibited.  For passwd, control characters are allowed.

IMHO, CRs and LFs must not be allowed in passwords. They are almost
impossible to enter in UI and this change might break existing protocols,
like ACAP.

>  For authzid,
>   one must consult the application-level SASL profile.

...if the one exists.

Regards,
Alexey
__________________________________________
R & D, ACI Worldwide/MessagingDirect
Watford, UK

Work Phone: +44 1923 81 2877
Home Page: http://orthanc.ab.ca/mel

I speak for myself only, not for my employer.
__________________________________________

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 23 Mar 2003 17:57:00 -0700

More comments below.

...if the one exists.

Regards,
Alexey