Subject: Use of NFKC in SASLprep

From: Simon Josefsson <[email-masked]>
Date: Fri, 23 Apr 2004 01:19:30 +0200

FYI, as SASLprep is using NFKC per Unicode 3.2, you might be
interested in the NFKC stability problem discussed on
<http://www.unicode.org/review/pr-29.html>.  The page mention a
strategy to maintain stability across NFKC revisions, which might be
relevant for SASLPrep.  I'd be interested to hear people's opinions on
the problem.

Thanks,
Simon

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 30 Apr 2004 08:08:52 -0700

At 04:19 PM 4/22/2004, Simon wrote:
>relevant for SASLPrep.
>I'd be interested to hear people's opinions on the problem.

Well, I concur that there is a minor inconsistency issue which
*might* lead to a security issue.  However, as PR-29, "we know
of no realistic scenarios that would present such problems."

I have no problem noting that this inconsistency issue exists
and that it *might* lead to a security issue (with an informational
reference to PR-29).  (However, I wouldn't mind if someone suggested
some wording here.)

Beyond that, I don't think we should say much more.  And, in
particular, I don't think we should change the SASLprep algorithm
based upon PR-29 suggestions as the UTC has not yet produced a
corrigendum in this area.

Kurt