Subject: [NNTP] Fwd: Discuss: nntp authinfo and tls

From: Russ Allbery <[email-masked]>
Date: Thu, 21 Jul 2005 18:23:13 -0700

Here's more on the canonicalization point.  Ted Hardie also indicated that
a byte-for-byte comparison was okay with him.

To: Russ Allbery <[email-masked]>
Cc: "Scott Hollenbeck" <[email-masked]>,
        "'Wijnen, Bert (Bert)'" <[email-masked]>, [email-masked]
Subject: Re: Discuss: nntp authinfo and tls
From: Sam Hartman <[email-masked]>
Date: Thu, 21 Jul 2005 12:36:34 -0400

>>>>> "Russ" == Russ Allbery <[email-masked]> writes:

    Russ> Sam Hartman <[email-masked]> writes:
    >>>>>>> "Scott" == Scott Hollenbeck <[email-masked]> writes:

    Scott> Beat me to it, Bert.  I think the saslprep piece of what
    Scott> Sam asked for is already covered.

    >> no, that's the authorization identity, which is only used in
    >> authinfo sasl, not authinfo user/authinfo pass.

    Russ> authinfo user / authinfo pass is documentation of a legacy
    Russ> protocol.  I'm not sure we really should have even said the
    Russ> character set was UTF-8, since in practice what existing
    Russ> servers do is a byte-for-byte comparison of what's sent to
    Russ> those commands with their authentication database.

I'd be happy with not specifying a character string.  I don't know if the
rest of the IESG would agree with this.

    Russ> I'm not sure the best way to deal with this.  Guidance would
    Russ> be welcome.  Requiring a normalization pass would mean that
    Russ> existing software would have to be modified to support the
    Russ> protocol, which pretty much defeats the whole point; at that
    Russ> point, existing software may as well just implement SASL
    Russ> (which is the recommendation going forward).

I would recommend a normalization pass, not require it.  It is a true
statement that if you don't normalize then you have interoperability
problems for all the reasons that stringprep exists.  IIf I were in
your position I'd change the document to briefly describe why you want
to normalize and to give a specific recommendation for one way to do
normalization.  I understand that legacy servers will not implement
this.  However it seems like for a modern server that backs the same
database for user/pass and for sasl plain would want to do
normalization for both.