Unless they changed their entire auth mechanism, it's definitely case insensitive.

IIRC, the client encrypts the password using some variant of SRP6 plus some additional magic, but the last time I dabbled in wow emulation was quite some time ago.

EDIT Here's a link to a moderator confirmation: http://eu.battle.net/wow/en/forum/topic/2679778775#3