Subject: Re: IDNA encoding for Kerberos host names

From: Ienup Sung <[email-masked]>
Date: Thu, 09 Oct 2003 16:20:00 -0700 (PDT)

As the section 1.2 of the clarification draft describes, it is, unfortunately
a reality of people using domain style domain and host names to derive
realms and principal names. If the use of ACE isn't satisfactory thing and
should be banned at the extension (or, at the clarification draft) as
the decision of the WG, so be it. I don't have any problem with that. I only
have (good) intention of saying that if that's the case, I hope that the WG
will explicitly mention about it at the extension and also some guidance on
how the Kerberos protocol wants people to deal with the compatibility issues
that I've been writing.

I also hope to point out that I'm not arguing to change the Kerberos extension
per se; I'm only to complement to the extension so that people who use
IDN will just happy and error-free as much as possible with the extension.

With regaeds,

Ienup

] Date: Thu, 09 Oct 2003 18:34:13 -0400
] From: Sam Hartman <[email-masked]>
] Subject: Re: IDNA encoding for Kerberos host names
] To: Ienup Sung <[email-masked]>
] Cc: [email-masked]
] MIME-version: 1.0
] 
] >>>>> "Ienup" == Ienup Sung <[email-masked]> writes:
] 
] 
]     Ienup> Obviously, people are seeing and will see host/domain names
]     Ienup> with IDN (could be in ACE, Japanese Shift_JIS, ISO-8859-15,
]     Ienup> UTF-8, and so on) in grand scale and those IDN names will
]     Ienup> be given to the Kerberos space and vice versa for realms
]     Ienup> and principal names.
] 
] I believe I disagree with this paragraph.
] 
] Both kerberos and DNS will see domain names.  Kerberos should never
] see ACE encoded domains.
] 
] The Kerberos name should never be given to DNS and the DNS name should
] never be given to Kerberos.  Instead, the same user input domain--call
] this string the raw domain-- should be given to both Kerberos and DNS.
] Kerberos converts the string to Unicode, runs saslprep and encodes as
] utf8.  DNS splits the string into labels, converts the string to
] Unicode, runs nameprep, and encodes the string.
]

---

From: Sam Hartman <[email-masked]>
Date: Thu, 09 Oct 2003 19:42:15 -0400

>>>>> "Ienup" == Ienup Sung <[email-masked]> writes:

    Ienup> As the section 1.2 of the clarification draft describes, it
    Ienup> is, unfortunately a reality of people using domain style
    Ienup> domain and host names to derive realms and principal
    Ienup> names. 

This is true, and I believe I have explained to you how this should be
done, using two different stringprep profiles for DNS and Kerberos
from  single input.

    Ienup> If the use of ACE isn't satisfactory thing and
    Ienup> should be banned at the extension (

No spec permits it now.  People explained on this list that Kerberos
contains no domain slots and thus ACE is inappropriate.

As I understand it is already inappropriate to use because of the IDNA specs.

We'll certainly add extra wording on this issue because if you are
confused possibly other people will be confused as well.

We would appreciate you reviewing what we have proposed and helping us
make sure that it will work in practice. There may be cases we are
missing.  Is so we would appreciate your help pointing them out to us.