Subject: key generation from passphrase, UTF-8

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 28 Jan 1998 15:46:52 +0100

I stumbled across the enclosed text in RFC 1890.
Is this something we need to take into consideration in SASL
(as in "bless, curse or negotiate")?

                      Harald

   The pass phrase typed by the user is transformed to a canonical form
   before applying the hash algorithm. For that purpose, we define
   return, tab, or vertical tab as well as all characters contained in
   the Unicode space characters table. The transformation consists of
   the following steps: (1) convert the input string to the ISO 10646
   character set, using the UTF-8 encoding as specified in Annex P to
   ISO/IEC 10646-1:1993 (ASCII characters require no mapping, but ISO
   8859-1 characters do); (2) remove leading and trailing white space
   characters; (3) replace one or more contiguous white space characters
   by a single space (ASCII or UTF-8 0x20); (4) convert all letters to
   lower case and replace sequences of characters and non-spacing
   accents with a single character, where possible. A minimum length of
   16 key characters (after applying the transformation) should be
   enforced by the application, while applications must allow up to 256
   characters of input.

NOTE: New Email address: [email-masked]
I am working for Maxware (www.maxware.no) as of Dec 1, 1997

---

From: "Larry Osterman (Exchange)" <[email-masked]>
Date: Wed, 28 Jan 1998 10:10:36 -0800

Doesn't this canonicalization also mean that dictionary attacks are
significantly easier?  After all this removes multiple spaces and upper
case letters from the keyspace.  Yes there is a 16 character recommended
minimum key length, but since the new key space only has lower case
characters and punctuation characters in it, it's significantly smaller
than the original keyspace

Larry Osterman
Via Exchange 5.5 on Larryo-Laptop.dns.microsoft.com.
Please notify the sender of any difficulties.

-----Original Message-----
From: Chris Newman [mailto:[email-masked]]
Sent: Wednesday, January 28, 1998 9:50 AM
To: Harald Tveit Alvestrand
Cc: [email-masked]
Subject: Re: key generation from passphrase, UTF-8

On Wed, 28 Jan 1998, Harald Tveit Alvestrand wrote:
>    8859-1 characters do);

This is the only part I agree with.  I'd also add that use of NUL is
forbidden and use of non-printing characters is discouraged.

>    (2) remove leading and trailing white space

These are all bad ideas, IMHO.  When you go to 10646, it's very hard to
determine if something is a spacing character or a lower/upper case
letter.  What happens when a new character is added with a critical
property you don't know about?  In addition, multiple spaces and mixed
case are good techniques to make a pass phrase harder to guess and to
defeat dictionary attacks.

Finally, this may not be implementable without using Unicode in addition
to 10646 -- I'm not sure 10646 lists spacing and case properties of
characters.

		- Chris