Subject: Re: [kitten] Fwd: I-D Action: draft-ietf-precis-saslprepbis-01.txt

From: Nico Williams <[email-masked]>
Date: Fri, 3 May 2013 14:39:36 -0500

Please forgive my apparent apathy.  I lost track of this due to business travel.

I'm not sure where the case mapping requirement for usernames came
from.  I guess it has something to do with the Turkish I and such.  I
can't say I'm excited about this case mapping requirement; if anything
it strikes as silly.

Why would we apply mappings to usernames (which are sent on the wire)
that we don't apply to passwords (which servers generally don't get
the plaintext of)?  We need mappings for passwords to make password
entry reliable.  The same does NOT apply to usernames.

Also, looking at SASLprep and PRECIS, I see no mention of query
strings vs. display vs. storage.  These distinctions matter.  But
maybe I'm just failing to search for the right terms.  Heck, we're not
even told whether these rules should be applied by the client, the
server, or both.

Anyways, I'm for applying as few transformations as possible to
usernames on the *client* side and leaving the server to apply
RECOMMENDED, and a few REQUIRED rules for matching.  I don't see room
for case folding in general, but I do for specific cases (e.g.,
Turkish I handling).

If this review is too late to make a difference, well, c'est la vie.
But do give the above some thought before rejecting my comments for
being late.  Once more, I'm sorry I let this slip.

Nico
--