Subject: Remark on paragraphs 7.3/7.2 : IDN rules in DN versus IDN rules in General Names

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 13 May 2009 13:48:06 +0200

Hi,

I'm currently comparing paragraph 7.3 and 7.2 of RFC5280 and checking 
what the difference in the handling of Internationalized Domain Names 
inside DN (domainComponent attribute) and inside General Names consists 
of exactly.

AFAICT the only difference is between
   - the rule given in paragraph 7.3 to include a label inside a 
domainComponent attribute and
   - the rule given in paragraph 7.2 to include an IDN inside a dNSName 
field
and seems to be the following :
      * set the UseSTD3ASCIIRules flag for the IDN, don't set it for the 
label
      * change all label separators to U+002E (full stop) for the IDN, 
don't do that for the label

The second step is not applicable for the label, as there will not be a 
label separator inside an individual label.

But why is UseSTD3ASCIIRules not set ?

In RFC3490, the consequence of setting UseSTD3ASCIIRules seems to be to 
activate the following checks (paragraph 4.1 "ToASCII" ):

  [...]

  3. If the UseSTD3ASCIIRules flag is set, then perform these checks:
      (a) Verify the absence of non-LDH ASCII code points; that is, the
          absence of 0..2C, 2E..2F, 3A..40, 5B..60, and 7B..7F.
      (b) Verify the absence of leading and trailing hyphen-minus; that
          is, the absence of U+002D at the beginning and end of the
          sequence.

I may be missing something but I don't see why you'd want to check that 
for the dNSName field, but not when it's a domainComponent attribute.

For context, I'll precise that the ToASCII operation description starts 
with this :

    The ToASCII operation takes a sequence of Unicode code points that
    make up one label and transforms it into a sequence of code points in
    the ASCII range (0..7F).  If ToASCII succeeds, the original sequence
    and the resulting sequence are equivalent labels.

So as ToASCII is applied to labels individually, there's really no 
difference between the case of processing a full IDN and an individual 
label.

If it were not for this point, it would be possible in paragraph 7.3 to 
say something like : Just do the same as in paragraph 7.2, considering 
that changing label separators to U+002E is not applicable as there will 
not be label separator inside an individual label.

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 13 May 2009 08:36:42 -0700

>But why is UseSTD3ASCIIRules not set ?

Probably an oversight.

>If it were not for this point, it would be possible in paragraph 7.3 to say something like : Just do the same as in paragraph 7.2, considering that changing label separators to U+002E is not applicable as there will not be label separator inside an individual label.

That seems like a reasonable change for RFC 7280.

--Paul Hoffman, Director
--VPN Consortium