Subject: Re: base32 alphabet rant - rhaaaaa rfc3548

From: Simon Josefsson <[email-masked]>
Date: Sun, 23 Oct 2005 18:13:00 +0200

"Christian Huitema" <[email-masked]> writes:

>> I'll check with the SASL WG if they wish to continue using the A-Z2-7
>> alphabet for the GSS-API mechanism document.  If not, I think we
>> should make the 0-9A-V alphabet the default alphabet.
>
> If we change the alphabet, we should consider a somewhat more
> sophisticated solution than 0-9A-V, in order to avoid name collisions
> and letter confusion.
>
> Name collision is a classic problem with literal representation of
> binary numbers. You can inadvertently obtain a string of letters that
> include dictionary words, some of which can be offensive. A simple way
> to minimize the problem is to avoid commonly used vowels.
>
> Letter confusion occurs when people have to copy or type in labels. For
> example, there is a significant risk of confusing the number 0 and the
> letter O, the number 1 and the letter I or the lower case letter l.
>
> The set 0-9A-Z includes 36 code points. The 0-9A-V solution just drops
> the last letters in sequence, WXYZ. It may be more productive to remove
> the letters A (vowel), E (vowel),  I (vowel, confusion with number 1)
> and O (vowel, confusion with number 0).

Changing the alphabet would be fine if rfc3548bis aimed for the
standards track.  However, currently, rfc3548 is merely informative,
and the aim was to try to document existing practices.  We know 0-9a-z
is used, it is from rfc 2938, and a-z2-7 was used in the SASL WG
document.

I believe base-n encoding are important enough to be on the standards
track.  I will aim for that in the revised document, and see if people
approve.

I'll propose to make the "standard" base32 alphabet be the
0-9b-df-hj-np-z alphabet.  It preserve sort order (which was the
requirement here) and it avoid some easily visually confusing letters
(which was the requirement in rfc3548).  It sometime also avoid
offensive words, which is a nice feature.  However, if that was a
requirement, we would need a more complicated set of rules (I believe
there are offensive words that don't contain a, e, i, or o).

Thanks,
Simon

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Sun, 23 Oct 2005 22:04:12 +0200 (W. Europe Daylight Time)

> and O (vowel, confusion with number 0).

The I!=1 and O!=0 confusion I can somewhat understand, eventhough this 
doesn't really apply to NSEC3 imho.

Trying to create an alphabet that avoids base32 encoded data parts 
colliding with some dictionary word in some language is a nice social 
idea, but just doesn't scale, hence rediculous to require. (You may still 
upset those Tashlhiyt' Berber speaking folk if you'd avoid vowels). It 
might be a classic problem, but not on this layer.

Roy