Subject: Re: Testing the concensus of the krb-wg on IDN

From: Ienup Sung <[email-masked]>
Date: Fri, 24 Oct 2003 12:33:44 -0700 (PDT)

I also think non-Internet domain-style domain name components also need
canonicalization; that canonicalization could be slightly different from
the canonicalization on the IDN names even though case conversion issues
should benefit both BTW. Since Mr. Jeffrey Altman appears already working on
it, I didn't see reason for me to really add anything else at the moment
and so didn't mention about it.

Re your concern, well, actually, it has almost nothing to do with IDN WG
in my opinion since such case conversion requirements are unique (at least at
this point in my opinion) to the Kerberos extension + IDN. I certainly think
this WG with some help of UTC, we will be able to come up with mapping tables 
that can be used with the canonicalizations and I hope that's not just me.

With regards,

Ienup

] Date: Fri, 24 Oct 2003 12:18:31 -0700
] From: Nicolas Williams <[email-masked]>
] Subject: Re: Testing the concensus of the krb-wg on IDN
] To: Ienup Sung <[email-masked]>
] Cc: [email-masked]
] Mail-followup-to: Ienup Sung <[email-masked]>, [email-masked]
] MIME-version: 1.0
] 
] On Fri, Oct 24, 2003 at 12:12:04PM -0700, Ienup Sung wrote:
] > There is another tricky part in this. By either asserting
] > upper casing or lower casing what the Kerberos was able to achieve on the
] > ASCII names was, as you know, a name canonicalization, e.g., whether you type
] > test.com, Test.com, or TEST.COM, the realm name would be the TEST.COM.
] > 
] > Similar level of canonicalization would be also necessary for the IDN names
] > one way or another. And, if a new Stringprep profile isn't a cup of tea for
] > everyone, the Nameprep could be used for Internet domain-style IDN names
] > since it will do case-folding mappings, i.e., erasing caseness, before
] > the NFKC. (SASLprep won't be an answer for the IDN names inthat matter since
] > it doesn't do any case mappings.) I also believe the support of some sort of
] > case canonicalization will definitely benefit the users of the 
scripts/alphabets
] > with case notions.
] 
] I'm with you upto the point of adding canonicalization in the KDC
] exchanges (which you don't ask for but which Jeff Altman offered).
] 
] BTW, I'm ok with one sort of name canonicalization in the KDC
] exchanges: a ticket extension that lists the target principal's
] canonical name and a non-critical authorization data type that lists the
] client principal's canonical name.
] 
] > By the way, defining one wouldn't that be difficult or time consuming;
] > I/We can also ask for help to Unicode Techincal Committee for their thoughts
] > and also verifications once the tables are done.
] 
] I'm concerned that you're asking that we do something that the IDN WG
] chose not to do or didn't know they should have done.  I think that
] would be beyond the scope of this WG.
] 
] Cheers,
] 
] Nico
] -- 
] 
]

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 24 Oct 2003 12:36:09 -0700

> and so didn't mention about it.

We've never had case folding for non-domain names in Kerberos.  Perhaps
we should though, for non-ASCII names, in extensions.  The Internet
already suffers from attacks based on misspelled domain names -
case-sensitivity would only make this worse, and I can see such an
argument applying to principal names in general also.

> that can be used with the canonicalizations and I hope that's not just me.

How so?  Why is stringprep(nameprep(x)) not enough to properly interop
when it comes to using IDNs as principal name components?

Nico
--