Subject: I-D ACTION: draft-nerenberg-sasl-crammd5-02.txt

From: Lyndon Nerenberg <[email-masked]>
Date: Tue, 18 Jun 2002 10:21:37 -0600

This version was pushed to replace the about-to-expire -01 draft;
there are no changes to the content from the -01 version.

I haven't received any comments since the publication of -01,
therefore I plan to submit this for last call a few days after the
upcoming IETF meeting ends.

--lyndon

------- Forwarded Message

To: IETF-Announce: ;
From: [email-masked]
Subject: I-D ACTION:draft-nerenberg-sasl-crammd5-02.txt
Date: Tue, 18 Jun 2002 07:26:37 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: The CRAM-MD5 SASL Mechanism
	Author(s)	: J. Klensin, P. Krumviede, L. Nerenberg
	Filename	: draft-nerenberg-sasl-crammd5-02.txt
	Pages		: 6
	Date		: 17-Jun-02
	
This document defines a simple challenge-response [SASL] authenti-
cation mechanism, using a [KEYED-MD5] digest.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-nerenberg-sasl-crammd5-02.txt

---

From: Simon Josefsson <[email-masked]>
Date: Sun, 23 Jun 2002 16:28:27 +0200

> upcoming IETF meeting ends.

I have two comments regarding the use of Unicode NFKC normalization:

1) It can be made more clear that using other normalization tables
   than the one referenced may result in interoperability problems:

--- draft-nerenberg-sasl-crammd5-02.txt.orig	Mon Jun 17 20:01:40 2002
+++ draft-nerenberg-sasl-crammd5-02.txt	Sun Jun 23 16:21:13 2002
@@ -87,7 +87,11 @@
      The user name and shared secret MUST be represented in the Unicode
      character set [UNICODE], and MUST be normalised using the Unicode
      Normalisation Form KC [NFKC]. The resulting values MUST be encoded
-     as UTF-8 [UTF8].
+     as UTF-8 [UTF8].  An application MUST NOT use newer normalization
+     tables even when such are available because it is not possible to
+     know if the other protocol entity also utilizes these newer tables.
+     This includes any Unicode normalization erratas that may be issued
+     in the future.

 3.1.  Formal Syntax

2) Update CRAM-MD5 to use Unicode 3.2. According to
   http://www.imc.org/idn/mail-archive/msg06650.html there was one
   backwards incompatible change in the NFKC normalization tables
   between 3.1 and 3.2, it could be good to use the latest version to
   support that character properly.

--- draft-nerenberg-sasl-crammd5-02.txt.orig	Mon Jun 17 20:01:40 2002
+++ draft-nerenberg-sasl-crammd5-02.txt	Sun Jun 23 16:04:43 2002
@@ -200,8 +200,8 @@
      [NFKC]
           Davis, M., M. Durst, "Unicode Standard Annex #15: Unicode Nor-
           malisation Forms", An integral part of The Unicode Standard,
-          Version 3.1.1 (http://www.uni-
-          code.org/reports/tr15/tr15-21.html).
+          Version 3.2.0 (http://www.uni-
+          code.org/reports/tr15/tr15-22.html).

      [SASL]
@@ -210,12 +210,11 @@

      [UNICODE]
-          The Unicode Consortium, "The Unicode Standard, Version 3.1.1",
+          The Unicode Consortium, "The Unicode Standard, Version 3.2.0",
           defined by: The Unicode Standard, Version 3.0 (Reading, MA,
           Addison-Wesley, 2000.  ISBN 0-201-61633-5), as amended by the
-          Unicode Standard Annex #27: Unicode 3.1 (http://www.uni-
-          code.org/reports/tr27/) and the Unicode 3.1.1 Update Notice
-          (http://www.unicode.org/versions/ Unicode3.1.1.html).
+          Unicode Standard Annex #28: Unicode 3.2 (http://www.uni-
+          code.org/reports/tr28/tr28-3.html).

      [UTF8]

Perhaps one also can discuss the problem of using different
transcoding tables to convert from legacy character sets to Unicode in
clients and servers, since such tables aren't standardized, but
hopefully that is mostly academic.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 23 Jun 2002 22:53:27 -0700

It might be appropriate for 2222bis to provide a SASL
string profile(s) [draft-hoffman-stringprep] for
authentication identities, authorization identities,
and passwords which mechanisms can reference as needed.

Kurt

---

From: Simon Josefsson <[email-masked]>
Date: Sun, 23 Jun 2002 16:28:27 +0200

3.1.  Formal Syntax

      [SASL]
@@ -210,12 +210,11 @@

      [UNICODE]

      [UTF8]

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 23 Jun 2002 22:53:27 -0700

Kurt