Subject: RE: draft-ietf-pkix-srvsan-00

From: "Stefan Santesson" <[email-masked]>
Date: Fri, 23 Sep 2005 02:35:37 +0100

Oh - I'm sorry

Its getting late here and I missed that last line. Thanks James.

In the choice between UTF8String and OCTET STRING I definitely prefer
UTF8String since it makes the information displayable. IF we choose
OCTET STRING we need to specify which encoding we carry inside the OCTET
STRING anyway.

Then I prefer UTF8String and the cost of a potentially more complex
comparison operation.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Manger, James H
> Sent: den 23 september 2005 02:03
> To: pkix
> Subject: RE: draft-ietf-pkix-srvsan-00
> 
> 
> Russ was suggesting OCTET STRING, not IA5String, in place of
UTF8String.
> 
> I don't know much about the specifics of the DNS protocol, but I
assume
> the items of interest are, semantically, either arbitrary byte arrays
or
> character strings.  For byte arrays use OCTET STRING.  For characters
> strings use UTF8String.
> 
> IA5String doesn't hold all byte values and only holds a subset of
> characters so I see no value in using it (or any other ASN.1 string
types
> that can only hold a subset of characters).  New definitions should
use
> UTF8String wherever they want a string.  Any character restrictions
should
> be specified with constraints or comments, not with a different
> [UNIVERSAL] tag.
> 
> --
> IA5String alphabet = 128 characters = values [0, 127]
> 
> 
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> Sent: Friday, 23 September 2005 5:12 AM
> To: Russ Housley
> Cc: [email-masked]
> Subject: RE: draft-ietf-pkix-srvsan-00
> 
> 
> Well,
> 
> A number of voices were raised suggesting UTF8String to better
> accommodate a future of internationalized domain names.
> I didn't really think it mattered since we generally convert
everything
> to Unicode before comparing, but on the other side I can't really see
> the case where IA5String would not be sufficient. DNS can always be
> expressed in punicode and you are probably right that comparing would
be
> generally easier.
> 
> So unless nobody raise their voice against it, I will change back to
> IA5String in next draft.
> 
> For those who don't really understand what we are talking about, this
> refers to the new 00 pkix draft for an otherName based on the DNS SRV
RR
> Syntax which I submitted today, but hadn't yet hit the charter page.
It
> will hopefully be available soon.
> 
> If you need it right now. Send me an e-mail.
> 
> 
> Stefan Santesson
> Program Manager, Standards Liaison
> Windows Security
> 
> 
> > -----Original Message-----
> > From: Russ Housley [mailto:[email-masked]]
> > Sent: den 22 september 2005 20:54
> > To: Stefan Santesson
> > Cc: [email-masked]
> > Subject: draft-ietf-pkix-srvsan-00
> >
> > Stefan:
> >
> > I am much happier with this approach that the one originally
> discussed.  I
> > just have one question.
> >
> > Why UTF8String?  Doesn't this complicate the comparison to the bits
> that
> > come from the DNS.  My understanding is that the DNS is a binary
> protocol,
> > so OCTET STRING ought to be easiest.
> >
> > Russ
> 
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 23 Sep 2005 09:55:39 -0400

Stefan:

The point that I wanted to discuss was the use of OCTET STRING to carry 
exactly the sequence of octets that would appear in the DNS (without the 
protocol portion).

The display issue is exactly the same as displaying information that is 
retrieved from the DNS.  No better, and no worse.

Russ