RFC 4013

RFC 4013: SASLprep: Stringprep Profile for User Names and Passwords ✨

Okay bestie, here's the RFC header tea 🍓. It's from the Network Working Group, written by Kurt D. Zeilenga of the OpenLDAP Foundation, dated February 2005. It's on the Standards Track 🎀. It doesn't obsolete or update anything, because the header doesn't list any obsoletes or updates.

Status of This Memo

This is an Internet standards track protocol for the Internet community, and it's literally begging for discussion and suggestions for improvements 🫶. For the standardization state and status of this protocol, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈.

Copyright Notice

Copyright (C) The Internet Society (2005) 💜.

Abstract

This doc explains how to prep Unicode strings that represent user names and passwords so they can be compared 🦋. It defines the "SASLprep" profile of the "stringprep" algorithm, and that one profile is used for both user names and passwords. It's meant for Simple Authentication and Security Layer (SASL) mechanisms like PLAIN, CRAM-MD5, and DIGEST-MD5, plus any other protocols that swap simple user names and/or passwords 💅.

1. Introduction ✨

Simple user names and passwords are everywhere on the Internet, so this doc makes rules for prepping internationalized user names and passwords for comparison 🌸. The goal is that input and comparison work in ways that make sense for regular people all over the world. For simplicity and easy implementation, there's one single algorithm for both user names and passwords. Literally so chill 😭.

The algorithm assumes every string is made of characters from the Unicode [Unicode] character set.

This doc defines the "SASLprep" profile of the "stringprep" algorithm [StringPrep].

The profile is designed for SASL mechanisms like [PLAIN], [CRAM-MD5], and [DIGEST-MD5], which is literally the whole point of [SASL]. It might also apply anywhere simple user names and passwords are used 🎀. It is NOT meant for identity strings that aren't simple user names (like email addresses, domain names, or distinguished names). It's also not for identity or password strings that aren't character data, or that need different handling (like case folding) 🙈.

This doc doesn't change the technical spec of any existing protocol. If a spec wants to use this algorithm, it has to explicitly bring this doc in and give precise details on where and how implementations of that spec use the algorithm 🧚.

2. The SASLprep Profile 💖

This section defines the "SASLprep" profile of the "stringprep" algorithm [StringPrep]. It's for prepping strings that represent simple user names and passwords 💅.

This profile uses Unicode 3.2 [Unicode] 🌈.

Character names here use the code point and name notation from the Unicode Standard [Unicode]. For example, the letter "a" can be written as either <U+0061> or <LATIN SMALL LETTER A> ✨. In the mapping lists and the prohibited characters lists, the "U+" is dropped to make them easier to read. The comments for character ranges sit in square brackets (like "[CONTROL CHARACTERS]") and they don't come from the standard, so don't panic 🫶.

Note: A glossary of Unicode terms lives in [Glossary]. Info on the Unicode character encoding model is in [CharModel] 🤓.

2.1. Mapping

This profile specifies two things 🍓:

• non-ASCII space characters [StringPrep, C.1.2] that can be mapped to SPACE (U+0020), and
• the "commonly mapped to nothing" characters [StringPrep, B.1] that can be mapped to nothing.

2.2. Normalization

This profile uses Unicode normalization form KC, as described in Section 4 of [StringPrep] 💜.

2.3. Prohibited Output

This profile says the following characters are prohibited input. Not a single one of these is getting through the door 🚫💅:

• Non-ASCII space characters [StringPrep, C.1.2]
• ASCII control characters [StringPrep, C.2.1]
• Non-ASCII control characters [StringPrep, C.2.2]
• Private Use characters [StringPrep, C.3]
• Non-character code points [StringPrep, C.4]
• Surrogate code points [StringPrep, C.5]
• Inappropriate for plain text characters [StringPrep, C.6]
• Inappropriate for canonical representation characters [StringPrep, C.7]
• Change display properties or deprecated characters [StringPrep, C.8]
• Tagging characters [StringPrep, C.9]

2.4. Bidirectional Characters

This profile says to check bidirectional strings the way [StringPrep, Section 6] describes 🔄.

2.5. Unassigned Code Points

For its list of unassigned code points, this profile uses the [StringPrep, A.1] table 🧩.

3. Examples 🎀

This table shows how different character data gets transformed by the SASLprep string preparation algorithm. It's giving before and after 🦋.

   #  Input            Output     Comments
   -  -----            ------     --------
   1  I<U+00AD>X       IX         SOFT HYPHEN mapped to nothing
   2  user             user       no transformation
   3  USER             USER       case preserved, will not match #2
   4  <U+00AA>         a          output is NFKC, input in ISO 8859-1
   5  <U+2168>         IX         output is NFKC, will match #1
   6  <U+0007>                    Error - prohibited character
   7  <U+0627><U+0031>            Error - bidirectional check

Look at example 5: the Roman numeral <U+2168> gets NFKC-ed into IX, which matches example 1 after the soft hyphen gets dropped 💀✨. Example 3 is the cautionary tale, because USER keeps its case and so won't match "user" 🙈.

---

Part 2 picks up with Security Considerations next, and it's a whole vibe 🫶🔥.

Intellectual Property ✨

okay bestie, let's talk legal stuff but make it cute 🎀 The IETF is literally not taking a side on whether any Intellectual Property Rights or other rights could be claimed over the tech in this doc, or whether you can even get a license for it. They also didn't do their own independent check to find any of that, so no promises 💅 If you want the rules on how the IETF handles rights in IETF Documents, check out BCP 78 and BCP 79 📚

If you're an implementer or user and want to see IPR disclosures sent to the IETF Secretariat, any assurances of licenses, or the results of trying to get a general license or permission for those proprietary rights, head to the IETF on-line IPR repository at http://www.ietf.org/ipr 🦋

And lowkey, if you know about any copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard, the IETF wants you to tell them! Just send the info to ietf-ipr@ietf.org 🫶 they're literally asking for it 😭

---

Acknowledgement

Okay, so the RFC Editor function is currently funded by the Internet Society 🌈 Big thanks to them for keeping the lights on ✨