Subject: [kitten] changing "mapped to nothing" in SASLprep-bis

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 13 Sep 2012 15:25:07 -0600

Dear SASL experts,

RFC 4013 states that certain Unicode code points that are commonly
mapped to nothing (see Appendix B.1 of RFC 3454) can indeed be so
mapped when preparing passwords (and usernames) in SASLprep.

In working on draft-melnikov-precis-saslprepbis (which is intended to
obsolete RFC 4013), Alexey Melnikov and I have followed the general
approach of the PRECIS framework (and before that IDNA2008) by
specifying that such code points would simply be disallowed. In
Unicode 3.2 there are only 27 code points that are affected by this
rule (e.g., U+00AD = SOFT HYPHEN), and since currently they are mapped
to nothing they would not be stored in an authentication database.
However, users might have included such characters in their usernames
or passwords and thus might expect to input those characters when
providing usernames or passwords for authentication purposes.
Therefore, if we change these code points from "mapped to nothing" to
disallowed, it is possible a small number users might experience an
error when inputting these characters with updated versions of their
software, instead of the smooth operation they experienced in the past.

Alexey and I would like to solicit feedback on this issue from
participants in the KITTEN WG and especially from those who have
implemented and deployed software that uses SASLprep. Please send your
feedback to the [email-masked] list or directly to me and Alexey.

Thanks!

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 14 Sep 2012 00:33:58 +0200

I believe we can live with that potential problem.

I wouldn't characterise users' current SASLprep experiences as "smooth
operation", so adding another potential source of problems will mean
little considering the already long list of potential source of
problems.

/Simon