Subject: Re: A different thought on saslprep

From: [email-masked]
Date: Mon, 12 Jan 2004 16:35:32 -0800

> The second is a security consideration. Running saslprep over a 
> shared secret reduces the entropy of the shared secret by eliminating 
> some characters and mapping others. 

I was looking at SASLPrep this weekend for the first time and this caught my 
eye.

> Not a big deal, but it does make an attacker's job easier.

How big a deal it is, is in the eye of those who're trying to secure their 
resources, especially given the latter observation.

Given that security issue with using SASLPrep on passwords, plus the other two 
issues Paul mentions with that application of SASLPrep, I wonder if the 
requirement that passwords be run thru SASLPrep (section 4.4 of 
draft-ietf-sasl-rfc2222bis-04.txt) really should be a MAY.

JeffH

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 12 Jan 2004 18:18:42 -0800

>resources, especially given the latter observation.

We can't say by how much it makes it easier.

>draft-ietf-sasl-rfc2222bis-04.txt) really should be a MAY.

How would that work? How would one end know whether or not the other 
end had done the saslprep? That seems like an invitation to lack of 
interop.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: [email-masked]
Date: Tue, 13 Jan 2004 09:48:55 -0800

> end had done the saslprep? That seems like an invitation to lack of 

ah, indeed. 

JeffH

---

From: [email-masked]
Date: Mon, 12 Jan 2004 16:35:32 -0800

JeffH

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 12 Jan 2004 18:18:42 -0800

--Paul Hoffman, Director

---

From: [email-masked]
Date: Tue, 13 Jan 2004 09:48:55 -0800

ah, indeed. 

JeffH