RE: Unicode in passwords

From: Jonathan Rosenne <jonathan.rosenne_at_gmail.com>
Date: Thu, 1 Oct 2015 07:11:32 +0300

For languages such as Java, passwords should be handled as byte arrays rather than strings. This may make it difficult to apply normalization.

 

Jonathan Rosenne

 

From: Unicode [mailto:unicode-bounces_at_unicode.org] On Behalf Of Clark S. Cox III
Sent: Thursday, October 01, 2015 2:16 AM
To: Hans Åberg
Cc: unicode_at_unicode.org; John O'Conner
Subject: Re: Unicode in passwords

 

 

On 2015/09/30, at 13:29, Hans Åberg <haberg-1_at_telia.com> wrote:

 

On 30 Sep 2015, at 18:33, John O'Conner <jsoconner_at_gmail.com> wrote:

Can you recommend any documents to help me understand potential issues (if any) for password policies and validation methods that allow characters from more "exotic" portions of the Unicode space?

On UNIX computers, one computes a hash (like SHA-256), which is then used to authenticate the password up to a high probability. The hash is stored in the open, but it is not known how to compute the password from the hash, so knowing the hash does not easily allow authentication.

So if the password is

 

… normalized and then …

encoded in say UTF-8 and then hashed, it would seem to take care of most problems.

 

You really wouldn’t want “Schlüssel” and “Schlüssel” being different passwords, would you? (assuming that my mail client and/or OS is not interfering, the first is NFC, while the second is NFD)
Received on Wed Sep 30 2015 - 23:13:17 CDT

This archive was generated by hypermail 2.2.0 : Wed Sep 30 2015 - 23:13:17 CDT