Subject: Re: userPassword comment

From: Hallvard B Furuseth <[email-masked]>
Date: Mon, 19 May 2003 20:01:02 +0200

Kurt D. Zeilenga writes:
> that applications SHOULD prepare textual strings used as passwords
> before storing them in the directory to improve the likelihood
> that passwords work as expected.   To prepare a textual string,
> the application MUST transcode to Unicode, apply SASLprep, and
> transfer using UTF-8.

SHOULD prepare, but MUST transcode and so on?  Do you mean that
IF it prepares, it MUST do it by transcoding and so on?

Is 'transcode to Unicode, apply SASLprep, and transfer using UTF-8' the
definition of 'to prepare' the string, or can 'prepare' mean something
else?  If the former, how about:

  ...the application SHOULD prepare textual strings used as passwords
  by transcoding them to Unicode, applying SASLprep, and encoding as
  UTF-8.

Though I don't think the schema draft should talk about 'transfer'.
That's a protocol thing.  How about 'encode' as UTF-8?

Finally, where is SASLprep defined?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 19 May 2003 10:33:18 -0700

draft-ietf-ldapbis-user-schema should say that as userPassword
syntax is octet string and has octetExactMatch equality matching,
that applications SHOULD prepare textual strings used as passwords
before storing them in the directory to improve the likelihood
that passwords work as expected.   To prepare a textual string,
the application MUST transcode to Unicode, apply SASLprep, and
transfer using UTF-8.

This should be applied to simple bind's password field as well.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 19 May 2003 11:19:12 -0700

>IF it prepares, it MUST do it by transcoding and so on?

I meant:
  It is RECOMMENDED that applications prepare textual strings
  used as password to improve matching.  Applications which
  prepare textural strings used as password are REQUIRED to
  prepare them as follows:
     a) transcode to Unicode,
     b) apply SASLprep, and
     c) encode as UTF-8.

>  by transcoding them to Unicode, applying SASLprep, and encoding as

I am fine with this as well.

>That's a protocol thing.  How about 'encode' as UTF-8?

encode is fine.

>Finally, where is SASLprep defined?

draft-ietf-sasl-saslprep-xx.txt

Kurt