Re: [regext] Alexey Melnikov's Discuss on draft-ietf-regext-login-security-07: (with DISCUSS and COMMENT)

Alexey Melnikov <aamelnikov@fastmail.fm> Fri, 24 January 2020 09:10 UTC

Return-Path: <aamelnikov@fastmail.fm>
X-Original-To: regext@ietfa.amsl.com
Delivered-To: regext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6780812002E; Fri, 24 Jan 2020 01:10:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fastmail.fm header.b=MI3PZLbf; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=cdi2Ijav
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ebBWzmZZg5Bx; Fri, 24 Jan 2020 01:10:13 -0800 (PST)
Received: from wout2-smtp.messagingengine.com (wout2-smtp.messagingengine.com [64.147.123.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61290120072; Fri, 24 Jan 2020 01:10:13 -0800 (PST)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id B779FC71; Fri, 24 Jan 2020 04:10:11 -0500 (EST)
Received: from mailfrontend1 ([10.202.2.162]) by compute7.internal (MEProxy); Fri, 24 Jan 2020 04:10:12 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.fm; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm2; bh=R rV3SkJ5rf9o2JBJbRNNWqSuoWoOo9pQGLPIB7K3wAQ=; b=MI3PZLbfx66kQKRau voh/Ul36GywL4HQ8rYtZdwu0lA0X+l9mpgpY4j7PRvQtF6vSsdDipEEnBktQ+ahy QO2Vi5aXEZK6q56RVmKCM3f64eyciItaJhZuDqOQrVB4UsekxEtFCqzBI6nQuJrO 3ijzFdQxz6ZyiK1IZvqVhH+nONJgWDKHMk7r+OjNgPKM2RHymwQraBakC+vvsio3 zci1Pd4ajbF8obsgWUJfRSGih+eF4HzEeFUygZTT7bXGwSWZyt4VP/KMkXjrX2n7 CWjoYg2feF3jy4ApxIi2nf53D/jY5o2vyVR3OnhwwPilDUXb4kUvVKoLlwdmAJbw OnDkA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=RrV3SkJ5rf9o2JBJbRNNWqSuoWoOo9pQGLPIB7K3w AQ=; b=cdi2IjavZuF7BmvjV6QlMifCA5wsE929oJ96nhVUv4lSsMcSwyCXzdbis xSZqrl1QYWDzX00bhxDfGRrF/z/e9otptiShfhOo7ESFJ7yORCeeaJs0yckWV66Y 0CTneWbOnhYED1P0F5aAE7UjcrH4Eriyd1FP9Gns7NEA/cqXEAwC7OMgoUlhg2ag HEcLuEelKCxg+D55QpSxapK2vLvE+ihXaPtbnXcqQTSIuPWeqUmblu2+DOokgmAD MsoP3gLvs1d4Hwj0I+eCkxrCR0U7nuttFta2Y9TUbE/YpqxCeduhnFqllpFRhu1q omM21ZCh63B6mGWbOftviedCvftBA==
X-ME-Sender: <xms:c7QqXkchLC7P3SriuJtkaH_5HddTeB64LFl_Lwl5mzXc_hIT8dPYCw>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedugedrvdegucetufdoteggodetrfdotffvucfrrh hofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgenuceurghi lhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurh eptggguffhofgjfffgkfhfvfesthhqmhdthhdtvdenucfhrhhomheptehlvgigvgihucfo vghlnhhikhhovhcuoegrrghmvghlnhhikhhovhesfhgrshhtmhgrihhlrdhfmheqnecuff homhgrihhnpeiffedrohhrghenucfkphephedrjedtrddvtddurdejnecuvehluhhsthgv rhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheprggrmhgvlhhnihhkohhvse hfrghsthhmrghilhdrfhhm
X-ME-Proxy: <xmx:c7QqXiCV6jpxVnVGoWqH8C16MpMWflJCRs9c39jKMANjbCW1CvCXdQ> <xmx:c7QqXr9iwyw-3H04WqBa-npgADs3o7O4dRyZaqErWAV3fG-aN30mUA> <xmx:c7QqXmqqJ9h6RGzWPkUsvyDbf_kRhNcTqw5TUH-Ytb9iv4c_NdwtGg> <xmx:c7QqXvOwKV5ykj54KFg3EhQ-9QyOIgmqoguMntt7gKdnkreRvKFAtA>
Received: from [192.168.0.2] (0546c907.skybroadband.com [5.70.201.7]) by mail.messagingengine.com (Postfix) with ESMTPA id E9BF73280059; Fri, 24 Jan 2020 04:10:10 -0500 (EST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Alexey Melnikov <aamelnikov@fastmail.fm>
X-Mailer: iPad Mail (16G102)
In-Reply-To: <A5D19CB8-BEB8-4675-9C6E-43CE6C914464@verisign.com>
Date: Fri, 24 Jan 2020 09:10:09 +0000
Cc: The IESG <iesg@ietf.org>, "draft-ietf-regext-login-security@ietf.org" <draft-ietf-regext-login-security@ietf.org>, Joseph Yee <jyee@afilias.info>, "regext-chairs@ietf.org" <regext-chairs@ietf.org>, "regext@ietf.org" <regext@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <84A60049-F486-4428-B44F-33544B0A325D@fastmail.fm>
References: <157977713547.22794.12692666659052458667.idtracker@ietfa.amsl.com> <A5D19CB8-BEB8-4675-9C6E-43CE6C914464@verisign.com>
To: "Gould, James" <jgould@verisign.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/regext/OEAExUSms1u1YwP47KDoERo-xeU>
Subject: Re: [regext] Alexey Melnikov's Discuss on draft-ietf-regext-login-security-07: (with DISCUSS and COMMENT)
X-BeenThere: regext@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Registration Protocols Extensions <regext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/regext>, <mailto:regext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/regext/>
List-Post: <mailto:regext@ietf.org>
List-Help: <mailto:regext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/regext>, <mailto:regext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jan 2020 09:10:17 -0000

Hi James,
Just replying to 1 point below:

> On 23 Jan 2020, at 21:29, Gould, James <jgould@verisign.com> wrote:
> 
>    2) In the same section:
> 
>       <loginSec:pw>:  OPTIONAL plain text password that is case sensitive,
>           has a minimum length of 6 characters, and has a maximum length
>           that is up to server policy.  All leading and trailing whitespace
>           is removed, and all internal contiguous whitespace that includes
>           #x9 (tab), #xA (linefeed), #xD (carriage return), and #x20
>           (space) is replaced with a single #x20 (space).  This element
>           MUST only be used if the [RFC5730] <pw> element is set to the
>           "[LOGIN-SECURITY]" value.
> 
>    What is the definition of "whitespace"? Does this only include characters
>    listed above or does it also include other Unicode characters (e.g. Unicode
>    whitespace property)? If the former, then instead of using "whitespace that
>    includes ..." use something like "whitespace is defined as one of ..."
> 
> JG - The definition of "whitespace" is based on the definition for XML schema whiteSpace (https://www.w3.org/TR/xmlschema11-2/#rf-whiteSpace), which does not include non-ASCII whitespace.  Validating XML parsers will apply the XML schema whitespace rules defined for the XML Schema "token" type (https://www.w3.org/TR/xmlschema11-2/#token), which is explicitly included in the description of the <loginSec:pw> element based on feedback from the working group.  I don't recommend use of non-ASCII characters for passwords, but I don't believe the extension should disallow it.  

Please clarify this in the document. Probably the easiest way is to add definition of whitespace to the terminology section.

BTW, I believe Precis framework will canonicalize all Unicode whitespaces (around 33 different characters) to ASCII space.


Best Regards,
Alexey