Subject: [TLS] draft-ietf-tls-psk and identity

From: Sam Hartman <[email-masked]>
Date: Fri, 27 May 2005 16:59:58 -0400

Hi.  The PSK draft is now before the IESG for final approval.

As one of the people reviewing the draft, I have two questions I'd
like to ask.

The first is why is the identity not labeled.  In other cases where
we've had a lot of name spaces, we have chosen to label the identity
with which name space it comes from.  Why did you choose to just have
an opaque string?  How frequent will it be that identities from one
namespace might be confused with identities from another namespace.
It seems like for example NAIs and email addresses might be confused.
These seem like they might both be commonly used.  Other identities
look similar to email addresses.

What would the costs of labeling be?  Would it be worth the cost?

Secondly, I'm concerned about internationalization.  Scetion 5.4 says
that an appropriate stringprep profile should be used but does not say
what this profile is.

The PSK draft seems to want client management interface to be able to
take arbitrary identity forms without knowing about these identity
forms.  However the preparation and normalization strategy the IETF
has adopted assume that the entity processing an ID needs to apply
ID-form-specific normalization to that ID.

What alternatives have been considered for internationalization?  Who
has reviewed the internationalization concerns of this draft?

Would things work better if the client management interface preserved
the ID and never normalized, requiring that the server use some
stringprep (and possibly other) normalization/canonicalization after
determing the appropriate ID form?

Thanks for considering these issues,

--Sam

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls