Subject: [Spasm] WG Last Call for draft-ietf-lamps-rfc5280-i18n-update-00

From: Russ Housley <[email-masked]>
Date: Fri, 26 May 2017 15:39:46 -0400

This is the LAMPS WG Last Call for "Internationalization Updates to RFC 5280” <draft-ietf-lamps-rfc5280-i18n-update-00>.  Please review the document and send your comments to the list by 9 June 2017. 

Since I am the document author and the LAMPS WG Chair, our Area Director will be making the consensus call at the end of the WG Last Call.

Thanks,
Russ

---

From: "Patrik Fältström" <[email-masked]>
Date: Sun, 28 May 2017 14:48:51 +0200

> Since I am the document author and the LAMPS WG Chair, our Area Director will be making the consensus call at the end of the WG Last Call.

I like the updates that makes the text more suitable for IDNA2008 than IDNA2003. That said, the Security Considerations Section is not updated accordingly. As A-labels and U-labels are 1:1 mapping to each other and it by definition is possible to map back and forth however much one wants, the text does not make sense.

I suggest the following change:

OLD:

Conforming CAs SHOULD ensure that IDNs are represented as valid A-labels.  This can be accomplished by taking a provided U-label, validating the code points, converting it to an A-label, back to an U-label, and then checking to see that the result is the same as the original U-label.  Failure to use valid A-labels may yield a name that cannot be correctly represented in the Domain Name System (DNS).

NEW:

Conforming CAs SHOULD ensure that IDNs are valid. This can be done by validating all code points according to IDNA2008 [RFC5892]. Failure to use valid A-labels may yield a name that cannot be correctly represented in the Domain Name System (DNS).

   Patrik

---

From: Russ Housley <[email-masked]>
Date: Wed, 31 May 2017 15:23:19 -0400

> On May 28, 2017, at 8:48 AM, Patrik Fältström <[email-masked]> wrote:
> 

Thanks for the review.  A-Lables are used everywhere except SmtpUTF8Name, which uses U-Labels.  Therefore, I think this needs to talk about using valid A-Labels and valid U-Labels.

I suggest:

3.  Security Considerations

   Conforming CAs SHOULD ensure that IDNs are valid.  This can be done
   by validating all code points according to IDNA2008 [RFC5892].
   Failure to use valid A-labels and valid U-labels may yield a domain
   name that cannot be correctly represented in the Domain Name System
   (DNS).  In addition, the CA/Browser Forum offers some guidance
   regarding internal server names in certificates [CABF].

Russ

---

From: "Patrik Fältström" <[email-masked]>
Date: Wed, 31 May 2017 15:24:10 -0400

On 31 May 2017, at 15:23, Russ Housley wrote:

> Thanks for the review.  A-Lables are used everywhere except SmtpUTF8Name, which uses U-Labels.

Of course!

> Therefore, I think this needs to talk about using valid A-Labels and valid U-Labels.
>
> I suggest:
>
>    Conforming CAs SHOULD ensure that IDNs are valid.  This can be done   by validating all code points according to IDNA2008 [RFC5892].
>    Failure to use valid A-labels and valid U-labels may yield a domain   name that cannot be correctly represented in the Domain Name System   (DNS).  In addition, the CA/Browser Forum offers some guidance   regarding internal server names in certificates [CABF].

Works for me.

   paf