Re: [idn] stringprep: PRI #29

[Erik van der Poel <erik@vanderpoel.org>]

> Keep in mind that Unicode may add new characters 
> in the future that may also be affected.

New characters are not recognized by old implementations, so they are 
less relevant. Sorry about that part. This relatively small mistake in 
my email should not diminish the overall argument, however.

> > Both Kerberos and SASL appears to be going to
> > use the old StringPrep as well, so we will be seeing security critical
> > infrastructure based on the old interpretation.

SASLprep is for user names and passwords. People sometimes put strange 
character sequences into passwords to make them harder to guess, but I 
don't know if apps make it easy to enter the strange sequences affected 
by PRI #29. Just a thought -- not particularly important.

Erik