Subject: [xmpp] Fwd: [precis] draft evaluation of Nodeprep (RFC 3920)

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 13 Dec 2010 09:59:20 -0700

FYI. If you have feedback, please discuss on the PRECIS list:

https://www.ietf.org/mailman/listinfo/precis

/psa

-------- Original Message --------
Subject: [precis] draft evaluation of Nodeprep (RFC 3920)
Date: Mon, 13 Dec 2010 09:58:20 -0700
From: Peter Saint-Andre <[email-masked]>
To: [email-masked]

This message evaluates the Nodeprep profile of stringprep in accordance
with the template established by the PRECIS WG:

http://trac.tools.ietf.org/wg/precis/trac/wiki/StringprepReviewTemplate

###

Specification:

   RFC 3920

Brief Description:

   Localpart of JabberID ("JID"), as in:
   <localpart@domainpart/resourcepart>

How It's Used:

   - Usernames (e.g., [email-masked])
   - Chatroom names (e.g., [email-masked])
   - Publish-subscribe nodes
   - Bot names

Enforcement:

   - Rules enforced by server / add-on service (e.g., chatroom
     service) on registration of account, creation of room, etc.

Comparison Method:

   "Type 2" (common algorithm)

   (see http://tools.ietf.org/html/draft-ietf-precis-problem-statement )

Case Folding, Sensitivity, Preservation:

   - Strings are always folded to lowercase
   - Case is not preserved

Impact of Comparison:

   False positives:
     - unable to authenticate at server
       (or authenticate to wrong account)
     - add wrong person to buddy list
     - join the wrong chatroom
     - improperly grant privileges (e.g., chatroom admin)
     - subscribe to wrong pubsub node
     - interact with wrong bot
     - allow communication with blocked entity

   False negatives:
     - unable to authenticate
     - unable to add someone to buddy list
     - unable to join desired chatroom
     - unable to use granted privileges (e.g., chatroom admin)
     - unable to subscribe to desired pubsub node
     - unable to interact with desired bot
     - disallow communication with unblocked entity

User Input:

   - Typed by user
   - Copy-and-paste
   - Perhaps voice input

Normalization:

   NFKC

Mapping:

   Spaces are mapped to nothing

Disallowed Characters:

   - "
   - &
   - '
   - /
   - :
   - <
   - >
   - @

String Classes:

   - Often similar to generic username
   - Often similar to localpart of email address
   - Sometimes same as localpart of email address

Internal Structure:

   None

User Output:

   - vCard
   - email signature
   - web page / directory
   - text of message (e.g., in a chatroom)

Operations:

  - Sometimes concatenated with other data and then
    used as input to a cryptographic hash function

###