Re: Future of SASLprep

["Frank Ellermann" <nobody@xxxxxxxxxxxxxxxxx>]

Simon Josefsson wrote:

> Passwords have quite different properties than domain names:
> it is normal and encouraged for passwords to contain characters
> from different scripts.

Yes.  Recently I looked into a years old archive about the
creation of tables inverting simple passwords from various
forms (incl. MD5), and the various pre-configured subsets
of supported characters where limited to what you'd see on
US keyboard layouts.

The size of the tables and the time to compute them (once)
increased dramatically with the number of supported input
characters.  That's (in theory) no obsctacle for say 128
characters, it could be hopeless for 100,000 characters...

> Possibly SASLprep2 could be a profile of RFC 5198: applying
> certain algorithmic tests to restrict some characters on
> top of the RFC 5198 output.

Simplified RFC 5198 is UTF-8 NFC minus some control chars.
What further restrictions do you have in mind ?

 Frank