Subject: [eap] Re: passphrases in EAP

From: [email-masked] ([email-masked])
Date: Mon, 5 May 2003 17:29:15 +0300

Jari Arkko wrote:

>> FWIW, both the EAP SIM and EAP AKA drafts require usernames to
>> conform to RFC 2486 "The Network Access Identifier".  This RFC limits =

>> the username character set to 82 characters unless quoted in=20
>> hexidecimal.
>=20
> Hmm... good point. I can see that we don't actually say *anything*
> about the format in the Identity Response packet in 2284bis. If we
> can mandate anything there, my guess is that NAI would be a=20
> more logical choice here than UTF-8. The question is if we can=20
> mandate this -- any reasons not to?

Well, I proposed this in my message on Friday:

    "EAP does not place any other requirements on the contents
    of the Identity Response, as different representations may
    be appropriate in different contexts.=20
=20
    In the absence of other guidance, the Identity MAY be a=20
    Network Access Identifier (NAI) conforming to [RFC2486],=20
    with the following exceptions allowed:

    - The username portion MAY be empty. This can be useful with
      EAP methods that have their own identity protection mechanism,
      but use the realm portion to route messages to the correct
      backend server.
    - The username portion MAY contain Unicode characters greater=20
      than U+007F encoded using UTF-8 [RFC2279]."

(NAI RFC was written a long time ago when i18n wasn't a big
issue. I guess nowadays we should allow non-ASCII characters=20
in usernames)

Best regards,
Pasi

---

From: [email-masked] (Jari Arkko)
Date: Mon, 05 May 2003 17:33:16 +0300

[email-masked] wrote:

> issue. I guess nowadays we should allow non-ASCII characters 
> in usernames)

That is reasonable, but I would still rather reference the
old NAI RFC and have someone update that separately... NAI
appears in strange places and it wouldn't do good for
overall systems interoperability if we changed NAI only
in one place. Or?

--Jari