Re: [http-auth] Normalization forms in draft-ietf-httpauth-basicauth-enc

[Paul Hoffman <[e-mail]>]

On Jun 30, 2013, at 2:14 PM, Yaron Sheffer <[e-mail]> wrote:

> Paul, your proposed text doesn't make sense to me, because with Basic auth, the server might keep a hash of the password instead of the raw password (to reduce the damage if the entire database gets stolen). In which case I would expect the server to normalize the password before it is being hashed without any check of the "expected value".

The process that is checking for equivalence is not necessarily the process that stored the (possibly normalized) password, and the two processes might have different views of what normalization to use. Normalizing takes time. Thus, I would expect that the server would do a straight check first, and only fall back to one or more forms of string conversion (normalization, fixing of various i18n digit forms, removing points in Hebrew, etc.) if the first test failed.

This isn't to say that your assumption is wrong, but it is not the only one. Thus, my particularly wavy wording.

--Paul Hoffman