I think the BCP18 (RFC2277) states, that you MUST define charset for all character data, and you MUST be able to use UTF-8 charset. So I think it is against that RFC to say that CRACK_MESSAGE is an ASCII string. Changing it to "ISO-10646 UTF-8 string" should fix this issue.
Also we may want to add "standard" warning about escape/control characters (from the draft-ietf-secsh-architecture-04.txt).
--Paul Hoffman, Director --VPN Consortium