Subject: RE: [Ltru] [psg.com #944] MAY a conformant implementation imposelength constraints?

From: "Addison Phillips" <[email-masked]>
Date: Tue, 31 May 2005 17:25:40 -0700

Won't work: Variants and private use subtags are not bounded in number. Neither can extension lengths be known in advance.

Addison

Addison P. Phillips
Globalization Architect, Quest Software
Chair, W3C Internationalization Core Working Group

Internationalization is not a feature.
It is an architecture. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Randy Presuhn
> Sent: mardi 31 mai 2005 17:26
> To: LTRU Working Group
> Subject: Re: [Ltru] [psg.com #944] MAY a conformant implementation
> imposelength constraints?
> 
> Hi -
> 
> In light of the recent discussion, would it make sense to simply nail down
> the maximum length of a tag, and require all conformant implementations to
> support that length, thus eliminating the question of truncation?
> 
> Randy
> 
> 
> 
> 
> _______________________________________________
> Ltru mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ltru

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 31 May 2005 17:47:16 -0700

Hi -

(as a technical contributor)

> From: "Addison Phillips" <[email-masked]>
> To: "Randy Presuhn" <[email-masked]>; "LTRU Working Group" <[email-masked]>
> Sent: Tuesday, May 31, 2005 5:25 PM
> Subject: RE: [Ltru] [psg.com #944] MAY a conformant implementation imposelength constraints?
>
> Won't work: Variants and private use subtags are not bounded in number.
> Neither can extension lengths be known in advance.
...

Then I think we really need to add something like the following to the security
considerations section, as part of this issue's resolution / rejection:

Since there is no limit to the number of variant and private use subtags,
and consequently no limit on the possible length of a tag, implementations
need to guard against buffer overflow attacks.  See section ## for
details on tag truncation, which can occur as a consequence of defenses
against buffer overflow.

Randy