Subject: Re: Testing the concensus of the krb-wg on IDN

From: Ienup Sung <[email-masked]>
Date: Fri, 24 Oct 2003 12:51:41 -0700 (PDT)

I also agree that it will be beneficial for pretty much everyone if
the canonicalization is supported in general.

Re your second remark, I see it as it's not really streingprep(nameprep(x))
issue or IDN WG actually but of this WG issue iff the WG choose to do upper
casing as a mean of canonicalization on the Realm name with Internet
domain-style names; in that case, the WG will need to come up with a profile of
its own (since we don't have any that do just that).

As I already mentioned in my previous emails, for the IDN names, Nameprep
can be used as an option of the IDN names' canonicalization. (But as you
know, the case-folding employeed in the Nameprep will yield a side effect of
lower casing for many of Unicode characters.)

With regards,

Ienup

] Date: Fri, 24 Oct 2003 12:36:09 -0700
] From: Nicolas Williams <[email-masked]>
] Subject: Re: Testing the concensus of the krb-wg on IDN
] To: Ienup Sung <[email-masked]>
] Cc: [email-masked]
] Mail-followup-to: Ienup Sung <[email-masked]>, [email-masked]
] MIME-version: 1.0
] 
] On Fri, Oct 24, 2003 at 12:33:44PM -0700, Ienup Sung wrote:
] > I also think non-Internet domain-style domain name components also need
] > canonicalization; that canonicalization could be slightly different from
] > the canonicalization on the IDN names even though case conversion issues
] > should benefit both BTW. Since Mr. Jeffrey Altman appears already working on
] > it, I didn't see reason for me to really add anything else at the moment
] > and so didn't mention about it.
] 
] We've never had case folding for non-domain names in Kerberos.  Perhaps
] we should though, for non-ASCII names, in extensions.  The Internet
] already suffers from attacks based on misspelled domain names -
] case-sensitivity would only make this worse, and I can see such an
] argument applying to principal names in general also.
] 
] > Re your concern, well, actually, it has almost nothing to do with IDN WG
] > in my opinion since such case conversion requirements are unique (at least at
] > this point in my opinion) to the Kerberos extension + IDN. I certainly think
] > this WG with some help of UTC, we will be able to come up with mapping tables 
] > that can be used with the canonicalizations and I hope that's not just me.
] 
] How so?  Why is stringprep(nameprep(x)) not enough to properly interop
] when it comes to using IDNs as principal name components?
] 
] Nico
] --

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 24 Oct 2003 12:56:58 -0700

> its own (since we don't have any that do just that).

Right, and I think now that it would be best if we stuck to
stringprep(nameprep(x)) for non-ASCII realm names also (though not for
X.500 realm names).  This even though I've found the upper casing of
ASCII realm names useful.

> lower casing for many of Unicode characters.)

I'm happy with that.

Just so you know, "canonicalization" is a bit of a loaded words in these
here parts.  So one must be careful to indicate what sort of
canonicalization one means.

Types of canonicalization often referred to in this WG:

 - stringprepping

 - use of getXbyY() to canonicalize domain names (insecure when DNSSEC
   is not used)

 - KDC "canonicalization" of client or service principal names in
   KDC-REP messages  (which we've decided against - but see another post
   from me today about this)

 - gss_canonicalize_name() (about which there has been a lot of
   controversy)

Cheers,

Nico
--