Subject: Comments on PK-INIT related to Internationalization

From: Jeffrey Altman <[email-masked]>
Date: Sun, 09 Nov 2003 17:39:13 -0600

1. Remove Reference to:

    [11] M. Wahl, S. Kille, T. Howes. Lightweight Directory Access
    Protocol (v3): UTF-8 String Representation of Distinguished Names.
    Request for Comments 2253.

2. The PrincipalName option in the TrustedCA choice should be removed.
  
3. The TrustedCertifiers should be a sequence of caName and not 
PrincipalName.

---------------------------------

The only potential internationalization issue is the representation of the
PrincipalName to which the certificate is mapped.  Valid PrincipalNames are
those belonging to the version of Kerberos being used.  If the Kerberos
implementation is [@CLARIFICATIONS] then the names are limited to US-ASCII.
If a future Kerberos implementation is used, then whatever Principal names
are valid for that implementation may be used by PK-INIT.

There are two places where PrincipalNames are specified in PK-INIT, the
requested PrincipalName and the principal name specified in a certificate
by the use of a subjectAltName extension. 

The requested PrincipalName is the name specified in the AS-REQ.  The
ability to use internationalized strings is dependent entirely on the 
version
of Kerberos being used.  If the version of Kerberos being used provides
for internationalized strings, then the rules associated with that version
of Kerberos protocol must be adhered to.

The subjectAltName extension supports the inclusion of Unicode utilizing
unnormalized UTF-8 encoded strings.  These strings must be processed by
the receiving KDC and string prepared according to the rules for query
strings if any are specified.  In the case of [@CLARIFICATIONS] there are
no rules specified, however, any string which is not restricted to US-ASCII
will fail to match a valid PrincipalName.

Jeffrey Altman