Subject: RE: draft-ietf-pkix-srvsan-00

From: "Manger, James H" <[email-masked]>
Date: Fri, 23 Sep 2005 10:02:53 +1000

Russ was suggesting OCTET STRING, not IA5String, in place of UTF8String.

I don't know much about the specifics of the DNS protocol, but I assume the items of interest are, semantically, either arbitrary byte arrays or character strings.  For byte arrays use OCTET STRING.  For characters strings use UTF8String.

IA5String doesn't hold all byte values and only holds a subset of characters so I see no value in using it (or any other ASN.1 string types that can only hold a subset of characters).  New definitions should use UTF8String wherever they want a string.  Any character restrictions should be specified with constraints or comments, not with a different [UNIVERSAL] tag.

--
IA5String alphabet = 128 characters = values [0, 127]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, 23 September 2005 5:12 AM
To: Russ Housley
Cc: [email-masked]
Subject: RE: draft-ietf-pkix-srvsan-00

Well,

A number of voices were raised suggesting UTF8String to better
accommodate a future of internationalized domain names.
I didn't really think it mattered since we generally convert everything
to Unicode before comparing, but on the other side I can't really see
the case where IA5String would not be sufficient. DNS can always be
expressed in punicode and you are probably right that comparing would be
generally easier.

So unless nobody raise their voice against it, I will change back to
IA5String in next draft.

For those who don't really understand what we are talking about, this
refers to the new 00 pkix draft for an otherName based on the DNS SRV RR
Syntax which I submitted today, but hadn't yet hit the charter page. It
will hopefully be available soon.

If you need it right now. Send me an e-mail.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: den 22 september 2005 20:54
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: draft-ietf-pkix-srvsan-00
> 
> Stefan:
> 
> I am much happier with this approach that the one originally
discussed.  I
> just have one question.
> 
> Why UTF8String?  Doesn't this complicate the comparison to the bits
that
> come from the DNS.  My understanding is that the DNS is a binary
protocol,
> so OCTET STRING ought to be easiest.
> 
> Russ

---

From: Olivier Dubuisson <[email-masked]>
Date: Fri, 23 Sep 2005 08:36:32 +0200

Manger, James H wrote:
> 
> For byte arrays use OCTET STRING.  For characters strings use UTF8String.

Exactly!

> IA5String doesn't hold all byte values and only holds a subset of
 > characters so I see no value in using it (or any other ASN.1
 > string types that can only hold a subset of characters).  New
 > definitions should use UTF8String wherever they want a string.
 > Any character restrictions should be specified with constraints or
 > comments, not with a different [UNIVERSAL] tag.

I am in 100% agreement with this.
-- 
Olivier DUBUISSON (ITU-T ASN.1 Project leader)

---

From: Peter Sylvester <[email-masked]>
Date: Fri, 23 Sep 2005 13:44:01 +0200

>IA5String doesn't hold all byte values and only holds a subset of characters so I see no value in using it (or any other ASN.1 string types that can only hold a subset of characters).  New definitio…
The subjectAltname has a IA5text since the. DNS has 7-bit ASCII.

Using UTF8String will raise th question for I18N names, i.e. will
we see punicode inside UTF8 or the punicode to UTF8 converted
name? Why is it necessary for a certificate using application to
convert between UTF8 and punicode?

---

From: Michael Ströder <[email-masked]>
Date: Fri, 23 Sep 2005 16:04:50 +0200

> Russ was suggesting OCTET STRING, not IA5String, in place of

Aarrgh! Please not another string with unknown character set where every
implementor stuffs into it what he/she likes!

> I don't know much about the specifics of the DNS protocol, but I
> assume the items of interest are, semantically, either arbitrary byte
> arrays or character strings.  For byte arrays use OCTET STRING.  For
> characters strings use UTF8String.

Yes! I couldn't agree more.

Ciao, Michael.