Subject: Re: SASLPrep vs Full Stop code points

From: Ienup Sung <[email-masked]>
Date: Thu, 06 Nov 2003 16:28:38 -0800 (PST)

Yes, the POSIX/SUS/XPG specifies that the poratble user names be in
the portable file name character set and it includes [A-Za-z._-] with some
additional rules. I also have seen many people using the 0x2e in their user
names and passwords.

And, while I believe I do understand that the SASLprep is intended for
simple user names and passowrds at the moment, I believe I'm seeing
the full stops vs decimal point issue a bit differently... (and maybe in
that way, I'm wrong about it...)

I think there will be problems if we treat the Asian full stops as equivalents
to the ASCII decimal point/dot/full stop character simply because the Asian
full stops are not equivalent to the ASCII decimal points all the time.
In other words, Asian people are and will distinguish (almost implicitly) when
to use the Asian/ASCII full stops and when to use the decimal point character;
if coerced at the protocol level that the Asian full stops are all
mapped to the U+002E for all the cases, people will be, sometimes, confused.

I do see the pros of convenience but that will, in my opinion, come in with
the price of denying the fact that the Asian full stops are only and
conditionally equivalent to the U+002E (when the U+002E means the full stop).
In other words, by having the general full stop mappings, we are denying
the possibility of Asian people using the full stops and decimal points
differently in their user names and passwords.

I personally can live with such general mappings and so thus many other Asians
in my opinion but when we do know about the fact that the characters are
different and virtually and practically we are not capable of distinguishing
when the two groups of characters can be treated equal or not with the
Stringprep and SALSprep, it seems to me that it is not really a good idea to
have a generic, simple table-driven mappings at the SASLprep (even for
the simple user names and passwords)...

Should more opinions needed and if the WG folks agree and assign to me,
I can bring this exactly the same question of whether we can
treat the Asian full stops as the decimal point to the Unicode Technical
Committee and get the opinion of the UTC back to the WGs. 

With regards,

Ienup

PS. By the way, on a bit different topic, reading the SALSprep and also the
PLAIN mechanism drafts, it appears there is no AllowUnassigned flag
setting or mentioning of it in the drafts. Has this issue been discussed
and/or if "Not Allowed" is implclitly meant in the SIMPLE mechanism draft?
If not, it seems either explicitly defining that the unassigned Unicode
characters are not allowed in the drafts, or, allow setting of the
AllowUnassigned flag as either True or False at the PLAIN draft appears
necesary so that the versioning issue is clearly stated... If this question
has been asked and answered, sorry, please let me know and I'll scan more of
the archived emails.

] Date: Thu, 06 Nov 2003 16:35:13 -0500
] From: Sam Hartman <[email-masked]>
] Subject: Re: SASLPrep vs Full Stop code points
] To: Ienup Sung <[email-masked]>
] Cc: [email-masked], [email-masked]
] MIME-version: 1.0
] 
] >>>>> "Ienup" == Ienup Sung <[email-masked]> writes:
] 
]     Ienup> I agree that the SASLprep is more suitable and applicable
]     Ienup> for simple user names and passwords and if the additional
]     Ienup> mappings such as the full stops are needed, they are more
]     Ienup> suitable and correct to be done at the outside of any
]     Ienup> Stringprep/Stringprep profiles and most preferrably before
]     Ienup> the application of the Stringprep profile(s). <-- These are
]     Ienup> also my points all along.
] 
] I think Kurt's point was that since saslprep was for usernames and
] passwords, it is more appropriate to do full-stop mappings there than
] in some more general context.  Do we expect people to need decimal
] points in their usernames?  Do we think it a problem if someone uses a
] decimal point in a password, but can later use one of the other
] full-stop characters and have it work?
] 
] --Sam
]

---

From: Jeffrey Altman <[email-masked]>
Date: Thu, 06 Nov 2003 21:21:08 -0500

The question is not whether or not the different full stops are used by
different people in different ways at the user interface level.  The 
transformations
we are discussing for use with SASLPrep are specific to the use of the 
strings
as Storage and Query strings; not as Display strings.  When a string is 
to be used
as a username or a password is there a reason why we should be concerned 
with
distinguishing the differences?  If there is not a good reason to 
preserve the
differences then there is a reasonable argument to fold them similar to 
the arguments
for folding spacing characters.

Users will always be free to choose one representation over another.  It 
is only
on the wire that there should be a distinction.

Jeffrey Altman

---

From: Jeffrey Altman <[email-masked]>
Date: Sun, 09 Nov 2003 14:13:08 -0500

>has been asked and answered, sorry, please let me know and I'll scan more of
Whether or not Unassigned Code Points are to be allowed or not is 
dependent upon
how the string being prepared is to be used.  As described in RFC 3454 
section 7,
if the use of the string is for storage in a database then Unassigned 
Code Points
are to be excluded.  However, if the string is to be used for the 
purposed of
querying a database, then the string may contain Unassigned Code Points.

I do not believe it is required for SASLprep to highlight this 
distinction. 
It should however be specified in the protocol documents which utilize 
string
preparation methods constructed within the framework of RFC 3454.

Jeffrey Altman