Subject: RE: Where to store SRV based names

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 1 Sep 2005 16:51:12 +0100

Steve,

Do you have any comments on this issue whether a SRV RR query string
ever will need more than IA5String to be expressed or if we should use
UTF-8 to be on the safe side?

If you are uncertain, could you check with the DNS Directorate for
guidance?

Thanks

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: den 22 augusti 2005 15:58
> To: Stefan Santesson
> Cc: [email-masked]; [email-masked]
> Subject: RE: Where to store SRV based names
> 
> I went to the DNS tutorial at IETF63. One of the points that was made
was
> that the DNS itself did not limit the character set.  It stores an
octet
> string.
> 
> I suggest that we ask the DNS Directorate for advice.  Perhaps you can
> work
> with Steve Bellovin, who is a member of the DNS Directorate to carry
the
> question forward.  I suspect you will have to help him formulate a
concise
> question.
> 
> Russ
> 
> At 10:55 AM 8/22/2005, Stefan Santesson wrote:
> 
> >Originally I suggested IA5String but many voices suggested UTF-8, so
> >that is what will go into next draft unless someone has a reason to
> >suggest otherwise.
> >
> >
> >Stefan Santesson
> >Program Manager, Standards Liaison
> >Windows Security
> >
> > > -----Original Message-----
> > > From: [email-masked]
> >[mailto:[email-masked]]
> > > On Behalf Of David Chadwick
> > > Sent: den 22 augusti 2005 12:22
> > > To: Tom Gindin
> > > Cc: PKIX
> > > Subject: Re: Where to store SRV based names
> > >
> > >
> > >
> > >
> > > Tom Gindin wrote:
> > > >         David:
> > > >
> > > >         We shouldn't use the OID assigned to the subjectAltName
> > > extension.
> > > >  Instead we should assign a new OID, to be assigned to an
> >OTHER-NAME.
> > >
> > >
> > > Hi Tom
> > >
> > > this is what I intended. Sorry if my last email was not clear
enough
> > >
> > >
> > >    We
> > > > also can't use PrintableString with Stefan's syntax, because
> > > > PrintableString doesn't include underscore and the SRV key
normally
> > > > contains underscores.  So what is the right string type:
IA5String,
> > > > VisibleString (a tighter fit than IA5String, but less familiar),
or
> > > > UTF8String (internationalizable)?
> > >
> > > It all depends upon what the DNS can store in its SRV RR.
IA5string
> > > would surely work, but maybe internationalised DNS can store
> >UFT8Strings
> > > as well, which would be better. We need a DNS expert to advise.
> > >
> > > >         I agree with the general approach of defining a syntax
which
> >can
> > > > be used either within GeneralName or in a directory attribute.
> > >
> > > thanks
> > >
> > > David
> > >
> > > >
> > > >                 Tom Gindin
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > David Chadwick <[email-masked]>
> > > > Sent by: [email-masked]
> > > > 08/11/2005 05:25 AM
> > > >
> > > >         To:     PKIX <[email-masked]>
> > > >         cc:
> > > >         Subject:        Where to store SRV based names
> > > >
> > > >
> > > >
> > > > As a result of my previous message and the various replies to
it, it
> > > > seems like the arguments against using the
> >subjectDirectoryAttributes
> > > > extension to store the attribute are
> > > >
> > > > i) we only have a hammer, so the extension has to be a nail
(i.e. we
> > > > only support subjectAltNames (and not SDA) so it has to go
there),
> >and
> > > >
> > > > ii) since attributes can be anything, we dont want to use them
to
> >store
> > > > this attribute, since attributes are a catch all.
> > > >
> > > > I dont actually find either arguement technically convincing,
> >although I
> > > > do find i) pragmatically convincing. (But if we were to extend
this
> > > > argument PKIX could have been stillborn, because by using this
> >argument
> > > > we could have said ten years ago that few people were supporting
> > > > certificate extensions so lets not use any of them :-)
> > > >
> > > > However, I do have a solution to offer as follows. Assume that
n.n.n
> >is
> > > > the OID assigned to the subjectAltNames extension. The we define
the
> > > > following attribute using this OID
> > > >
> > > > srvName ATTRIBUTE                ::=             {
> > > > WITH SYNTAX                              PrintableString (SIZE
> >(1..128))
> > > > EQUALITY MATCHING RULE                           caseIgnoreMatch
> > > > ID                               n.n.n }
> > > >
> > > > By doing this we ensure:
> > > > i) the extension will be carried in the subjectAltNames
extension
> > > > ii) the syntax and matching rules for the srv string are fully
and
> > > > compactly defined
> > > > iii) If anyone also wanted to store the string in LDAP as an
> >attribute
> > > > they could do so using the above definition.
> > > >
> > > > regards
> > > >
> > > > David
> > > >
> > > >
> > >
> > > --
> > >
> > > *****************************************************************
> > > David W. Chadwick, BSc PhD
> > > Professor of Information Systems Security
> > > The Computing Laboratory, University of Kent, Canterbury, CT2 7NF
> > > Tel: +44 1227 82 3221
> > > Fax +44 1227 762 811
> > > Mobile: +44 77 96 44 7184
> > > Email: [email-masked]
> > > Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
> > > Research Web site: http://sec.cs.kent.ac.uk
> > > Entrust key validation string: MLJ9-DU5T-HV8J
> > > PGP Key ID is 0xBC238DE5
> > >
> > > *****************************************************************