Subject: [BEHAVE] Comment on draft-ietf-behave-test-vectors-01

From: Philip Matthews <[email-masked]>
Date: Thu, 13 Mar 2008 10:11:05 -0400

I raised this comment in a private discussion, and was asked to bring  
it to the list to see if anyone else agreed with me.

The username in draft-ietf-behave-test-vectors-01 uses characters  
that are part of the ASCII subset of UTF-8. I suggested that it would  
be useful to include at least one character that is not part of the  
ASCII subset, to test UTF-8 support. I also suggested that it would  
be useful to pad the username with a character which is not a space  
or a null, to test the ability to ignore padding.

Dan and Remi would like to know if anyone besides myself feels this  
is important, given that this comment comes rather late. One option  
might be to include these in a third test vector.

Comments?

- Philip
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: "Dan Wing" <[email-masked]>
Date: Fri, 21 Mar 2008 15:54:03 -0700

Nobody has followed up with "great idea", so I can only assume there is a
chorus of people that don't care for an additional UTF-8 test vector in the
document.

Considering Chris Newmann's DISCUSS
<https://datatracker.ietf.org/idtracker/draft-ietf-behave-rfc3489bis/comment/7
5234/?> the UTF-8 test vector would provide a test for SASLPrep
<http://www.ietf.org/mail-archive/web/behave/current/msg03420.html>.

I will wait until Tuesday for comments; if there aren't any, I will request
publication of -behave-stun-test-vectors-01 as is.

-d

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Philip Matthews
> Sent: Thursday, March 13, 2008 7:11 AM
> To: Behave WG
> Subject: [BEHAVE] Comment on draft-ietf-behave-test-vectors-01
>

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Fri, 21 Mar 2008 16:17:05 -0700

> publication of -behave-stun-test-vectors-01 as is.

In my opinion a test should be added to stun-test-vectors.

I already proposed a test that uses UTF-8, long-term authentication
(which is also missing from stun-test-vectors) and SASLprep:

http://www.ietf.org/mail-archive/web/behave/current/msg03353.html

-- 
Marc Petit-Huguenin           [                                 ]
Home: [email-masked] [RFC1855-compliant space for rent ]
Work: [email-masked]            [                                 ]
[                                                               ]
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Tue, 25 Mar 2008 10:49:49 +0200

Le Saturday 22 March 2008 01:17:05 ext Marc Petit-Huguenin, vous avez écrit :
> > I will wait until Tuesday for comments; if there aren't any, I will
> > request publication of -behave-stun-test-vectors-01 as is.
>

With all due respect, I think your example is not really helpful. It sure 
contains a valid meaningful UTF-8 non-ASCII sequence. However, said sequence 
is unmodified through SASLprep, hence it does not really validate anything. A 
STUN implementation that does not do stringprep would still work, a STUN 
implementation that uses the wrong profile of stringprep would also still 
work.

IMHO, if we really want to check something about SASLprep, we ought to have an 
input that is _modified_ when SASLprep is applied to it. And preferably 
modified differently with the Nameprep profile, so we can root out some 
incorrect invocation of stringprep.

-- 
Rémi Denis-Courmont

---

From: Marc Petit-Huguenin <[email-masked]>
Date: Tue, 25 Mar 2008 08:04:55 -0700

> incorrect invocation of stringprep.

The password in my example is "TheMatrIX" after been processed by
SASLprep and "thematrix" after been processed by Nameprep, so it seems
that my example already fulfill all your requirements.  But let me know
what you would like me to modify and I would be happy to do it.

Thanks.

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Tue, 25 Mar 2008 17:20:04 +0200

> what you would like me to modify and I would be happy to do it.

Oh, mea culpa - I was only looking at the username.