Subject: Re: Testing the concensus of the krb-wg on IDN

From: Ienup Sung <[email-masked]>
Date: Fri, 24 Oct 2003 12:12:04 -0700 (PDT)

There is another tricky part in this. By either asserting
upper casing or lower casing what the Kerberos was able to achieve on the
ASCII names was, as you know, a name canonicalization, e.g., whether you type
test.com, Test.com, or TEST.COM, the realm name would be the TEST.COM.

Similar level of canonicalization would be also necessary for the IDN names
one way or another. And, if a new Stringprep profile isn't a cup of tea for
everyone, the Nameprep could be used for Internet domain-style IDN names
since it will do case-folding mappings, i.e., erasing caseness, before
the NFKC. (SASLprep won't be an answer for the IDN names inthat matter since
it doesn't do any case mappings.) I also believe the support of some sort of
case canonicalization will definitely benefit the users of the scripts/alphabets
with case notions.

By the way, defining one wouldn't that be difficult or time consuming;
I/We can also ask for help to Unicode Techincal Committee for their thoughts
and also verifications once the tables are done.

With regards,

Ienup

] Date: Fri, 24 Oct 2003 14:33:56 -0400
] From: Jeffrey Hutzelman <[email-masked]>
] Subject: Re: Testing the concensus of the krb-wg on IDN
] To: Nicolas Williams <[email-masked]>, Ienup Sung 
<[email-masked]>
] Cc: [email-masked]
] MIME-version: 1.0
] Content-transfer-encoding: 8BIT
] 
] On Friday, October 24, 2003 08:37:53 -0700 Nicolas Williams 
] <[email-masked]> wrote:
] 
] > Lately I've been advocating recommending (requiring) that where one
] > knows that a principal name component [or a realm] is a domain name (an
] > IDN) then apply saslprep(nameprep(x)) to the string in question.
] >
] > Apparently, current practice is to always lower-case domain names as
] > principal name components, in software, but to leave realm names as
] > entered (though it is recommended that realm names be created in all
] > upper case).  We should extend this to IDNs and recommend that non-ASCII
] > realm names also be case folded in SW.
] 
] This is very nearly a correct description of what happens.  Kerberos 
] doesn't downcase anything passed to it _as a principal name_, but it does 
] provide tools for applications to use in constructing principal names from 
] domain names, and such tools do downcase the domain name.  IMHO it would be 
] appropriate for applications to apply nameprep to domain names before using 
] them to construct principal names (but the Kerberos spec needs to be 
] explicit about whether applications MUST or MUST NOT do this; ambiguity 
] will lead to trouble).  I think it's up to the implementors whether 
] krb5_sname_to_principal() or its equivalent runs nameprep or expects its 
] caller to have already done so; I can see advantages to both approaches.
] 
] Also, I believe your description of current practice wrt realm names is 
] correct -- Kerberos never upcases a realm name passed to it, though it 
] might upcase a domain name being used to construct a realm name, as in the 
] last-resort case of finding the realm for a service.  Of course, this 
] entire discussion is relevant only for domain-style realm names; we 
] certainly wouldn't want to randomly go around applying nameprep or case 
] conversion to X.500-style realm names!
] 
] 
] 
] I'm beginning to wonder whether "upcase your domain name" is a realistic 
] recommendation in an IDN world.  For example, I must assume that 
] 'strasse.de' and 'straße.de' are in fact not the same domain; however, a 
] German realm administrator will upcase them both as 'STRASSE.DE'.  It might 
] be better to suggest "upcase your domain name only if it is all ASCII". 
] That would be consistent with the text we have regarding principal name 
] components, which requires case folding only "Where the name of the host is 
] not sensitive" -- a condition which is met for ASCII domain names, but not 
] for IDN names.
] 
] Comments?
] 
] -- Jeff
] 
]

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 24 Oct 2003 12:18:31 -0700

> case canonicalization will definitely benefit the users of the scripts/alphabets

I'm with you upto the point of adding canonicalization in the KDC
exchanges (which you don't ask for but which Jeff Altman offered).

BTW, I'm ok with one sort of name canonicalization in the KDC
exchanges: a ticket extension that lists the target principal's
canonical name and a non-critical authorization data type that lists the
client principal's canonical name.

> and also verifications once the tables are done.

I'm concerned that you're asking that we do something that the IDN WG
chose not to do or didn't know they should have done.  I think that
would be beyond the scope of this WG.

Cheers,

Nico
--