Subject: set-passwd protocol and stringpreps, again

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Jul 2004 01:21:48 -0500

I'm almost ready to post an updated I-D.

I think most issues are resolved, but the name and password
encoding/stringprep issues are not, as I recall.

The issue is:

 - we want the new protocol to use UTF-8 throughout, even though
   rfc1510/clarifications does not really support anything other than
   ASCII (IA5String), and we want to avoid major revisions to this
   protocol.

My original proposal was to leave a sort of "typed hole" in the language
of the spec (something like "names and passwords are constrained as
per-the version of Kerberos used for the AP exchange").  The consensus,
as I recall, was that this would not pass IESG muster.

My revised proposal (based on recent input from Sam and input I remember
from Jeff A. and others):

 - use UTF8String now, but constrained to IA5String
 - change the constraint to SASLPREP after/along with extensions

Comments?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 16 Jul 2004 17:21:52 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas>  - use UTF8String now, but constrained to IA5String -
    Nicolas> change the constraint to SASLPREP after/along with
    Nicolas> extensions

    Nicolas> Comments?

We need to make sure that just-send-8 implementations get the
information they need to migrate on the server side.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Jul 2004 16:31:02 -0500

> information they need to migrate on the server side.

I'd hope that set-passwd clients and servers would never just-send-8;
but are non-ASCII, non-UTF-8 princ names, realm names and passwords not
usable then?  Perhaps we need a CHOICE of OCTET STRING (just-send-8) and
UTF8String (compliant).

Suggestions?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 16 Jul 2004 17:45:48 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Fri, Jul 16, 2004 at 05:21:52PM -0400, Sam Hartman
    Nicolas> Comments?
    >> information they need to migrate on the server side.

    Nicolas> I'd hope that set-passwd clients and servers would never
    Nicolas> just-send-8; 

Agreed.  But we need to make sure that a utf8 extensions set-password
server has enough information to construct all the encodings it may
need for the KDC to interoperate with just-send-8 clarifications
clients.

---

From: Nicolas Williams <[email-masked]>
Date: Sat, 17 Jul 2004 16:19:58 -0500

> need for the KDC to interoperate with just-send-8 clarifications

Ok, I'll make some quick surgery on the text...

I think the relevant strings will have to be a CHOICE so we can have
them be tagged as "encoding what's that?," clarifications (IA5String)
and extensions (UTF8String w/ SASLprep).

Alternatively, the entire protocol should work in one negotiated string
mode, rather than tag the strings.

New error codes will be needed ("hey, don't just send 8").

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Sat, 17 Jul 2004 18:14:25 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> Ok, I'll make some quick surgery on the text...

    Nicolas> I think the relevant strings will have to be a CHOICE so
    Nicolas> we can have them be tagged as "encoding what's that?,"
    Nicolas> clarifications (IA5String) and extensions (UTF8String w/
    Nicolas> SASLprep).

Was there some reason stringprep running on the server is
insufficient?

I don't think we care about anything that cannot be represented in
Unicode.

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 18 Jul 2004 18:12:00 -0500

> Was there some reason stringprep running on the server is

So just send unnormalized UTF-8 from the client?

> I don't think we care about anything that cannot be represented in

What about migration issues.  If I have a principal name that is not
ASCII but also not UTF-8 and I still want to be able to reference it,
how do I do that?  I'm happy to say "oh well."

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 18 Jul 2004 18:48:35 -0500

> So just send unnormalized UTF-8 from the client?

Ok, this is good.

> how do I do that?  I'm happy to say "oh well."

Er, never mind -- such strings can be converted to UTF-8 or we just
should not care.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 18 Jul 2004 20:45:45 -0500

> > So just send unnormalized UTF-8 from the client?

Ok, so the I-D I'm about to submit will use UTF8String with an
extensible constraint to IA5String.

When extensions passes we can rev the minor version of this protocol to
extend the constraint and specify the stringprep profile for the various
strings.

Nico
--