Re: Normalization of passwords in SASL and SSH

[Sam Hartman <hartmans-ietf%mit.edu@localhost>]

>>>>> "Niels" == Niels Möller <nisse%lysator.liu.se@localhost> writes:


    Niels> If I understand your proposal, as it applies to ssh, you're
    Niels> suggesting that we should

    Niels> 1. Strike the new text on normalization, in effect
    Niels> reverting to what was in older drafts
    Niels> (e.g. draft-ietf-secsh-userauth-18.txt says "Note that the
    Niels> password is encoded in ISO-10646 UTF-8. It is up to the
    Niels> server how it interprets the password and validates it
    Niels> against the password database.").

    Niels> 2. Add some new text saying that we recommend that systems
    Niels> supporting non-ascii passwords always normalize passwords
    Niels> and usernames whenever they are added to the database, or
    Niels> compared (with or without hashing) to existing entries in
    Niels> the database.

And say that ssh implementations that both store the passwords and
compare them SHOULD use saslprep for normalization.