Subject: Re: I-D ACTION:draft-ietf-pkix-cert-utf8-00.txt

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:40:48 +0100

>Russ,

>The new draft seems ok to me.

>Any reason this is not part of 3280Bis?

Yes. The security considerations section of this draft is missing one major point:
at the Paris IETF meeting last year, there was an interresting conference 
explaining the dangers to use UTF8. The security considerations section 
should adress this topic. 

Once it will be addressed, it might be clearer why the two following rules should apply :

     (a)  if the character set is sufficient, the string MUST be
     represented as a PrintableString;

     (b)  failing (a), if the BMPString character set is sufficient the
     string MUST be represented as a BMPString; 

Denis

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]
>On Behalf Of Russ Housley
>Sent: Saturday, February 18, 2006 6:10 PM
>To: [email-masked]
>Subject: Re: I-D ACTION:draft-ietf-pkix-cert-utf8-00.txt 
>
>
>Dear PKIX WG:
>
> From the recent discussion on the mail list, it is clear to me that 
>3280bis will not be done in the next few weeks.  The DirectoryString 
>processing needs to be updated, and we are very late (by at least two 
>years) publishing an update on this point.
>
>I was able to get Stefan to help me write a very straightforward and 
>simple draft on DirectoryString processing.  I hope that the PKIX WG 
>can quickly reach consensus on this document and get it published.
>
>Please review and comment promptly.
>
>Russ
>
>>A New Internet-Draft is available from the on-line Internet-Drafts 
>>directories.
>>This draft is a work item of the Public-Key Infrastructure (X.509) 
>>Working Group of the IETF.
>>
>>         Title           : Update to DirectoryString Processing in the
>>                           Internet X.509 Public Key Infrastructure
>>                           Certificate and Certificate Revocation 
>> List (CRL) Profile
>>         Author(s)       : R. Housley, S. Santesson
>>         Filename        : draft-ietf-pkix-cert-utf8-00.txt
>>         Pages           : 5
>>         Date            : 2006-2-17
>>
>>This document updates the handling of DirectoryString in the Internet
>>X.509 Public Key Infrastructure Certificate and Certificate
>>Revocation List (CRL) Profile, which is published in RFC 3280.
>>
>>A URL for this Internet-Draft is:
>>http://www.ietf.org/internet-drafts/draft-ietf-pkix-cert-utf8-00.txt

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 24 Feb 2006 10:02:42 -0800

>should adress this topic.

If you are talking about Michel Suignard's talk at SAAG, 
<http://www3.ietf.org/proceedings/05aug/slides/saag-4.pdf>, could you 
point out which parts you are referring to? There was exactly one 
mention of UTF8, namely testing for the shortest form. Or, it was at 
a different meeting, could you say which and be explicit about the 
issues?

>      string MUST be represented as a BMPString;

Are you saying that characters outside the BMP should be prohibited 
from names? Or did you intend to include a step (c)?

--Paul Hoffman, Director
--VPN Consortium