SASLprep: Stringprep Profile for User Names and Passwords
obsoleted by
- rfc-7613 — Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords
Extracted elements (13)
A single string preparation algorithm is defined for both user names and passwords to achieve simplicity and implementation ease, even though different handling (such as case folding) might be appropriate for some use cases.
SASLprep is explicitly not intended for identity strings that are not simple user names (e.g., email addresses, domain names, distinguished names) or for passwords that are not character data, because those forms require different handling algorithms.
SASLprep uses Unicode 3.2, which is specified as a fixed version rather than the latest, to ensure stable and predictable string preparation behavior across implementations.
SASLprep is intended for use with SASL mechanisms such as PLAIN, CRAM-MD5, and DIGEST-MD5. Any specification wishing to use SASLprep must explicitly incorporate RFC 4013 and provide precise details as to where and how this algorithm is used.
SASLprep requires checking bidirectional strings as described in StringPrep Section 6. For example, a string containing an Arabic letter followed by a digit (U+0627 U+0031) is rejected as a bidirectional check error.
SASLprep prohibits the following character categories as input: non-ASCII space characters, ASCII and non-ASCII control characters, Private Use characters, non-character code points, surrogate code points, characters inappropriate for plain text or canonical representation, characters that change display properties or are deprecated, and tagging characters.
SASLprep specifies Unicode normalization form KC (NFKC) for string preparation, as described in Section 4 of the stringprep specification.
SASLprep uses the StringPrep A.1 table as its list of unassigned code points, which are treated as prohibited.
The SASLprep profile maps non-ASCII space characters (StringPrep C.1.2) to SPACE (U+0020) and maps 'commonly mapped to nothing' characters (StringPrep B.1) to nothing.
This document registers the 'SASLprep' profile in the stringprep profile registry. The profile is defined in RFC 4013 and is the first version of the SASLprep profile.
Application of SASLprep may affect the feasibility of brute force and dictionary attacks: while the number of possible prepared strings is less than the number of possible Unicode strings, the number of usable names and passwords is greater than if only ASCII were used.
Due to an anomaly (Public Review Issue #29) in the Unicode normalization specification, canonical equivalence is not guaranteed for a select few character sequences. These sequences do not appear in well-formed text, and the specification was published despite this known technical problem, with the expectation it will be revised.
User names and passwords processed by SASLprep should be protected from eavesdropping. General stringprep and Unicode security considerations also apply.