1 Dec 18:04
Re: When to apply the SASLprep stringprep profile?
Kurt Zeilenga <Kurt.Zeilenga <at> Isode.com>
2008-12-01 17:04:46 GMT
2008-12-01 17:04:46 GMT
On Nov 30, 2008, at 9:49 AM, Tobias Markmann wrote: > Hi, > > when do i have to apply SASLprep and on what? The RFC, http://www.ietf.org/rfc/rfc4013.txt > , just says it's applied on usernames and passwords. It applies where it's called for, generally by protocol specifications saying "SASLprep this username" or "SASLprep this password". There are a few specifications which do so, name RFC 4616 (SASL/PLAIN) and various LDAPv3 specifications (RFC4510). DIGEST-MD5 will not be revised to do SASLprep. It will instead be deprecated in favor of SCRAM (hopefully). > So I'm asking: > > • Do I need to apply SASLprep as server for all possible SASL > mechanism or just Digest-MD5? Well, for Challenge/Response mechanisms, both sides need to agree on how to handle the password. For instance, with CRAM-MD5, the specification (RFC 2195) just says the client/server implementations hash the password. But is that password Unicode or some other character set? Is it UTF-8? Should some code points be mapped to others? How should it be normalized? What code points are disallowed? etc.(Continue reading)
RSS Feed