Re:NIST’s new password rules – what you need to know
by kibwen on Tuesday November 22, 2016 @07:49PM
(#13019019)
> UTF-8, for example, allows to encode the character "ä"
> [...]
> I believe that it makes sense to display a warning
Both of these are addressed in section 5.1.1.2:
"If Unicode characters are accepted in memorized secrets, the verifier SHOULD apply the Normalization Process for Stabilized Strings defined in Section 12.1 of Unicode Standard Annex 15 [UAX 15] using either the NFKC or NFKD normalization. Subscribers choosing memorized secrets containing Unicode characters SHOULD be advised that some characters may be represented differently by some endpoints, which can affect their ability to authenticate successfully."
"If Unicode characters are accepted in memorized secrets, the verifier SHOULD apply the Normalization Process for Stabilized Strings defined in Section 12.1 of Unicode Standard Annex 15 [UAX 15] using either the NFKC or NFKD normalization. Subscribers choosing memorized secrets containing Unicode characters SHOULD be advised that some characters may be represented differently by some endpoints, which can affect their ability to authenticate successfully."
https://pages.nist.gov/800-63-3/sp800-63b.html