Re: [xmpp] SASLprep vs. nodeprep

[Dave Cridland <[e-mail]>]

On Mon Aug 10 20:46:21 2009, Peter Saint-Andre wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> The SCRAM I-D (draft-ietf-sasl-scram-04) says the following:
> 
>    Before sending the username to the server, the client MUST
>    prepare the username using the "SASLPrep" profile [RFC4013]
>    of the "stringprep" algorithm [RFC3454].
> 
> This might be perceived as contradicting 3920bis, where we say that  
> the
> localpart of a JabberID "MUST be formatted such that the Nodeprep
> profile of [STRINGPREP] can be applied without failing". However, I
> think that nodeprep is more strict than SASLprep, so perhaps we are  
> OK.
> 
> 
I don't think there's a contradiction:

A jid node MUST pass Nodeprep.

A simple username MUST be the jid node.

A simple username used in SCRAM MUST have SASLprep applied before  
transmission.

None of the above have a conflict I can see - it's merely that a  
jid's node might be have more restrictions than previously we've  
considered. It would be worthwhile mentioning this case in  
particular, and in general, that implementations may have further  
restrictions on the form of a node identifier, in section 3.3.


> In any case, I think that the text in the SCRAM I-D needs to say  
> that
> the SASLprep profile can be applied without failing, not that the
> username must be prepared using SASLprep.
> 
> 
I'll answer this one on the SASL list.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade