Re: [kitten] changing "mapped to nothing" in SASLprep-bis

[Simon Josefsson <[e-mail]>]

I believe we can live with that potential problem.

I wouldn't characterise users' current SASLprep experiences as "smooth
operation", so adding another potential source of problems will mean
little considering the already long list of potential source of
problems.

/Simon

Peter Saint-Andre <[e-mail]> writes:

> Dear SASL experts,
>
> RFC 4013 states that certain Unicode code points that are commonly
> mapped to nothing (see Appendix B.1 of RFC 3454) can indeed be so
> mapped when preparing passwords (and usernames) in SASLprep.
>
> In working on draft-melnikov-precis-saslprepbis (which is intended to
> obsolete RFC 4013), Alexey Melnikov and I have followed the general
> approach of the PRECIS framework (and before that IDNA2008) by
> specifying that such code points would simply be disallowed. In
> Unicode 3.2 there are only 27 code points that are affected by this
> rule (e.g., U+00AD = SOFT HYPHEN), and since currently they are mapped
> to nothing they would not be stored in an authentication database.
> However, users might have included such characters in their usernames
> or passwords and thus might expect to input those characters when
> providing usernames or passwords for authentication purposes.
> Therefore, if we change these code points from "mapped to nothing" to
> disallowed, it is possible a small number users might experience an
> error when inputting these characters with updated versions of their
> software, instead of the smooth operation they experienced in the past.
>
> Alexey and I would like to solicit feedback on this issue from
> participants in the KITTEN WG and especially from those who have
> implemented and deployed software that uses SASLprep. Please send your
> feedback to the [e-mail] list or directly to me and Alexey.
>
> Thanks!
>
> Peter