Subject: Re: SASLprep in rfc2222bis-06

From: Sam Hartman <[email-masked]>
Date: Mon, 01 Mar 2004 23:47:21 -0500

>>>>> "Kurt" == Kurt D Zeilenga <[email-masked]> writes:

    Kurt> Hence, it is very important that where a mechanism uses the
    Kurt> authorization identity as input to a cryptographic function
    Kurt> that it uses the precise form transferred (or to be
    Kurt> transferred) by the mechanism.

In a discussion today, we came to an additional constraint.  The
mechanism should not use the authorization identity in any long-term
cryptographic keys/hashes.  For example, it would be wrong to change
the digest-md5 spec to include the authz id in the a1 hash.

The reason is that there may be multiple forms of the authz id that
compare the same and some clients may use one form while other clients
use a different form.

We don't yet have text for this constraint.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 01 Mar 2004 23:47:21 -0500