Re: [http-auth] UTF-8, usernames, passwords

[Yutaka OIWA <[e-mail]>]

Dear all,

As an author of another PRECIS draft for HTTP authentication
(http://tools.ietf.org/html/draft-oiwa-precis-httpauthprep-00),
I personally feel that limiting allowing characters to
IdentifierClass is feasible and reasonable.
It includes all "sensible IMO" characters for identifiers,
is binary compatible with all printable ASCII characters,
and is character-set compatible with ISO-8859-1 set.
It will not exclude any printable characters which is currently
officially allowed in the spec.

We should allow any number of "ASCII SPACE" U+0020
between printable characters for backward compatibility,
and should not forbid any printable ASCII characters
(except some schema-dependent "forbidden-by-protocol"
character like colon <:> in basic).
I strongly believe we should forbid any control characters.
In both Peter's and my proposals, SPACEs in the
beginning and the tail of the string is not allowed,
which can be a target to discuss.

I'm currently trying to seek for possible merger of
my proposal into saslprepbis, to reduce number of
profiles to implement.


-- 
Yutaka OIWA, Ph.D.
           Senior Researcher, Research Institute for Secure Systems (RISEC)
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[e-mail]>, <[e-mail]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]



2014-10-28 1:12 GMT+09:00 Peter Saint-Andre - &yet <[e-mail]>:
> Over in the PRECIS working group, we've been trying to harmonize the
> username and password definitions from "saslprepbis" (which is intended to
> apply to more than just SASL) with the updated spec for basic auth:
>
> http://datatracker.ietf.org/doc/draft-ietf-precis-saslprepbis/
> http://datatracker.ietf.org/doc/draft-ietf-httpauth-basicauth-update/
>
> See for instance this thread:
>
> http://www.ietf.org/mail-archive/web/precis/current/msg00705.html
> http://www.ietf.org/mail-archive/web/precis/current/msg00704.html
> http://www.ietf.org/mail-archive/web/precis/current/msg00861.html
> http://www.ietf.org/mail-archive/web/precis/current/msg00869.html
>
> Although we've gotten closer to harmony and I've been working to adjust
> draft-ietf-precis-saslprepbis as needed, we're not there yet.
>
> USERNAMES
>
> UTF-8: both saslprepbis and basicauth specify UTF-8 (for basicauth, when the
> new 'charset' parameter is used)
>
> Unicode normalization: NFC
>
> Width mapping: not specified in basicauth, whereas saslprepbis specifies
> that fullwidth and halfwidth characters MUST be mapped to their
> decomposition mappings (is this something that basicauth might specify?)
>
> The major gap appears to be the allowable characters:
>
> - saslprepbis limits username characters to those allowed by the PRECIS
> IdentifierClass, essentially letters and digits and ASCII7 characters, along
> with single space characters separating parts of a string.
>
> - basicauth might (at least based on what I understand) allow a wider range
> of characters, such as multiple spaces in a row or even symbols outside the
> ASCII7 range (see discussion thread above for examples)
>
> As to the space issue, we might be able to work around this by defining an
> application-layer construct in basicauth that reuses the "userpart" rule
> from saslprepbis.
>
> However, for allowable characters if we want to allow basically any
> character in basicauth usernames then in PRECIS terms we'd need to make a
> profile of the FreeformClass, not the IdentifierClass. IMHO that would be
> less than ideal and likely violate the principle of least user astonishment
> ("why does this username work for the web but not email?").
>
> PASSWORDS
>
> Here saslprepbis and basicauth are closer together. In fact the only gaps
> might be:
>
> - width mapping: saslprepbis says MUST NOT perform width mapping, whereas
> basicauth doesn't say anything about that
>
> - spaces: in SASLprep and also saslprepbis, non-ASCII spaces are mapped to
> ASCII space, whereas basicauth doesn't say anything about that
>
> For both usernames and passwords in basicauth, we might want to say
> something about bidi characters.
>
> Is there a way that we can come to agreement on these issues? Do we perhaps
> need time at the next IETF meeting, or a conf call of some kind, to make
> progress?
>
> Peter
>
> --
> Peter Saint-Andre
> https://andyet.com/
>
> _______________________________________________
> http-auth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-auth