Subject: Allowed characters in SCRAM authentication/authorization identities

From: Alexey Melnikov <[email-masked]>
Date: Sun, 18 Jan 2009 21:48:07 +0000

Hi,
This is a minor issue with existing SCRAM ABNF:

> saslname        = 1*(value-safe-char / "=2C" / "=3D")
>                            ;; Conforms to <value>
>
> value-safe-char = %20-2B / %2D-3C / %3E-7E /
>                               UTF8-2 / UTF-3 / UTF8-4
> ;; UTF8-char except CTL, "=", and ",".
>
> authzid         = "a=" saslname

Authorization identity is protocol specific, so I don't think the 
document should disallow US-ASCII CTLs in it.
So, any objections of changing "value-safe-char" to be any UTF-8 encoded 
Unicode character except for NUL (which is universally disallowed), "=" 
and ","?

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 19 Jan 2009 12:23:55 +0100

Alexey Melnikov <[email-masked]> writes:

> So, any objections of changing "value-safe-char" to be any UTF-8
> encoded Unicode character except for NUL (which is universally
> disallowed), "=" and ","?

I think per RFC 4422 you should only exclude NUL.

3.4.1.  Authorization Identity String

   The authorization identity string is a sequence of zero or more
   Unicode [Unicode] characters, excluding the NUL (U+0000) character,
   representing the identity to act as.
...

   While the character encoding schema used to transfer the
   authorization identity string in the authentication exchange is
   mechanism specific, mechanisms are expected to be capable of carrying
   the entire Unicode repertoire (with the exception of the NUL
   character).

/Simon

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 19 Jan 2009 11:27:18 +0000

>I think per RFC 4422 you should only exclude NUL.
Yes.
But "=" and "," are special characters in SCRAM, so they are encoded as 
"=2C" and "=3D".

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 19 Jan 2009 12:52:05 +0100

Alexey Melnikov <[email-masked]> writes:

> But "=" and "," are special characters in SCRAM, so they are encoded
> as "=2C" and "=3D".

Ok, if all non-NUL characters are escaped, I don't see a problem.  +1
from me.

/Simon

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 19 Jan 2009 11:53:45 -0500

> Unicode character except for NUL (which is universally disallowed), "="

Sounds good to me.

---

From: Abhijit Menon-Sen <[email-masked]>
Date: Tue, 20 Jan 2009 06:47:42 +0530

> disallowed), "=" and ","?

Fine with me.

-- ams