Re: Future of SASLprep

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

"Frank Ellermann" <nobody@xxxxxxxxxxxxxxxxx> writes:

>> Possibly SASLprep2 could be a profile of RFC 5198: applying
>> certain algorithmic tests to restrict some characters on
>> top of the RFC 5198 output.
>
> Simplified RFC 5198 is UTF-8 NFC minus some control chars.
> What further restrictions do you have in mind ?

See RFC 4013 section 2.3 and RFC 3454 section 3.1.  I'm sure that some
of those prohibited characters are a bad idea for passwords (because the
prohibited characters would have added entropy).  However, some of them
may make sense in order to avoid display or implementation issues (e.g.,
change-display properties and tagging characters).

/Simon