Re: Future of SASLprep

["Frank Ellermann" <nobody@xxxxxxxxxxxxxxxxx>]

Simon Josefsson wrote:

>> What further restrictions do you have in mind ?
 
> See RFC 4013 section 2.3 and RFC 3454 section 3.1.

Okay, RFC 5198 might be not radical enough with C0 controls.

If users insist on trying the icon of a fruit (private use)
in their passwords they need a warning that this might be 
difficult to produce on other platforms.  And if they then
still insist on it they have been warned.

Similar case:  One password I need for 'runas' (a kind of
'sudo' for NT) has the funny feature that I can't input it
on a command line.  OTOH it's perfectly non-ASCII.

Some sets in RFC 4013 2.3 are also eliminated in RFC 5198,
e.g., surrogates.  The BOM in RFC 3454 3.1 is a MUST NOT
in RFC 5198, anything else in RFC 3454 is not *obviously*
critical from my POV, e.g., SHY.

> However, some of them may make sense in order to avoid
> display or implementation issues (e.g., change-display
> properties and tagging characters).

Okay, RFC 5198 says the other side should be prepared to
handle the difference between SHOULD NFC and "MUST", this
handler might be confused by invalid tagging attempts...

...on the other hand this WG can't "fix Unicode" for its
purposes.  If we'd want that we could keep SASLprep as is,
maybe updating it to Unicode 5.1.

 Frank