Subject: I-D ACTION:draft-ietf-sasl-saslprep-09.txt (fwd)

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 02 May 2004 18:32:52 -0400

Please make sure you review this, folks.
We're planning on depending on it in kerberos-extensions, and it's now very 
close to IESG approval.

-- Jeff

---------- Forwarded Message ----------
Date: Thursday, April 29, 2004 15:53:13 -0400
From: [email-masked]
To: [email-masked]
Subject: I-D ACTION:draft-ietf-sasl-saslprep-09.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories. This draft is a work item of the Simple Authentication and
Security Layer Working Group of the IETF.

	Title		: SASLprep: Stringprep profile for user names and passwords
	Author(s)	: K. Zeilenga
	Filename	: draft-ietf-sasl-saslprep-09.txt
	Pages		: 7
	Date		: 2004-4-29
	
This document describes how to prepare Unicode strings representing
  user names and passwords for comparison.  The document defines the
  'SASLprep' profile of the 'stringprep' algorithm to be used for both
  user names and passwords.  This profile is intended to be used by
  Simple Authentication and Security Layer (SASL) mechanisms (such as
  PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging
  simple user names and/or passwords.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-09.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of the
message.   You can also visit
https://www1.ietf.org/mailman/listinfo/I-D-announce  to change your
subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-sasl-saslprep-09.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-sasl-saslprep-09.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---------- End Forwarded Message ----------

Subject: I-D ACTION:draft-ietf-sasl-saslprep-09.txt
From: [email-masked]
To: [email-masked]
Cc: [email-masked]
Date: Thu, 29 Apr 2004 15:53:13 -0400
List-Id: <ietf-sasl.imc.org>

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF.

	Title		: SASLprep: Stringprep profile for user names and passwords
	Author(s)	: K. Zeilenga
	Filename	: draft-ietf-sasl-saslprep-09.txt
	Pages		: 7
	Date		: 2004-4-29
	
This document describes how to prepare Unicode strings representing
  user names and passwords for comparison.  The document defines the
  'SASLprep' profile of the 'stringprep' algorithm to be used for both
  user names and passwords.  This profile is intended to be used by
  Simple Authentication and Security Layer (SASL) mechanisms (such as
  PLAIN, CRAM-MD5, and DIGEST-MD5) as well as other protocols exchanging
  simple user names and/or passwords.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sasl-saslprep-09.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-sasl-saslprep-09.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-sasl-saslprep-09.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jeffrey Altman <[email-masked]>
Date: Sun, 02 May 2004 18:45:00 -0400

Jeffrey Hutzelman wrote:

> We're planning on depending on it in kerberos-extensions, and it's now 
> very close to IESG approval.
>
> -- Jeff
>
There is a current issue undergoing discussion on the sasl mailing list
related to the important of Unicode Public Review Issue #29: 
Normalization Issue

   http://www.unicode.org/review/pr-29.html

"There is a problem in the language of the specification of UAX #15: 
Unicode Normalization Forms 
<http://www.unicode.org/unicode/reports/tr15/> for forms NFC and NFKC. A 
textual fix is required to make normalization formally self-consistent. 
Programs that depend on such logical consistency may be subject to 
security problems until fixed, although as yet we know of no realistic 
scenarios that would present such problems. The fix will not have an 
impact on real data found in practice (with the possible exception of 
test cases for the algorithm itself), because the affected sequences do 
not constitute well-formed text in any language."

This will have an impact on SASLPrep.  The question being discussed is 
should SASLPrep
attempt to fix this problem; should we wait for a fix to NamePrep; or 
should this be
fixed by Unicode.