Subject: Re: internationalization of textual passwords

From: "Hal Henderson" <[email-masked]>
Date: Sat, 01 Mar 2003 13:12:41 -0700

I agree.  Hopefully, they will decided upon UTF-8 and not invent
something new.

Hal

>>> Jim Sermersheim 2/27/2003 10:38:00 PM >>>
I haven't read SASLPrep yet, but recommending (and in doing so, raising
awareness of the issue) a normalized string form sounds very good to
me.

Jim

>>> "Kurt D. Zeilenga" <[email-masked]> 2/27/03 11:12:43 PM >>>
While the simple bind password and userPassword are OCTET STRINGs
and to be compared using octetStringMatch (and I continue to think
this should not be changed, see past discussions), I (as an
individual) think it would be appropriate to RECOMMEND that clients
which provide textual passwords "prepare", using SASLprep, the
string before transmission to the server to ensure that like
passwords will match.  Use of SASLprep here, aside from ensuring
consistency between all LDAP clients desiring to use textual
passwords, would allow the textual strings to be used in various
SASL mechanisms which use SASLprep.

Comments?

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 01 Mar 2003 13:25:39 -0800

>I agree.  Hopefully, they will decided upon UTF-8 and not invent

Saying "UTF-8" is insufficient.  One needs to say exactly how the
strings are to be prepared to increase the likelihood that two
different, but equivalent, user-inputted Unicode strings are
transferred as same sequence of octets and, hence, will match
when compared by the server.

SASLprep defines a new algorithm for preparing Unicode passwords
(as well as user names) for matching.  I'm not aware of a suitable
existing algorithm.

Anyways, I suggest we adopt whatever algorithm the SASL WG
ends up choosing for PLAIN, CRAM-MD5, and DIGEST-MD5 mechanisms
to minimize the implementation burden.

Kurt