Subject: [idn] stringprep comment 6: casefold and then noramlization is not enough

From: "Soobok Lee" <[email-masked]>
Date: Tue, 12 Feb 2002 02:09:53 +0900

As I and David Hopwood suggested in the list,

  NFC(casefold(x)) or NFKC(casefold(x)) are not correct for <I dot above> and <I><dot above>.

  Rather, NFKC(casefold(NFKC(x)) is the correct one, even though it's not efficient.

  And There may be new UTC or non-UTC normalization that may applid before stringpre
   in various future i18n applications.

But, in current Stringprep draft in its section 2,

"2. Preparation Overview

The steps for preparing strings are:

1) Map -- For each character in the input, check if it has a mapping
and, if so, replace it with its mapping. This is described in Section 4.

2) Normalize -- Possibly normalize the result of step 1 using Unicode
normalization. This is described in Section 5.

3) Look for prohibited output -- Check for any characters that are not
allowed in the output. If any are found, return an error. This is
described in Section 6.

The above steps MUST be performed in the order given to comply with this
specification."

Please suggest a proof that this last enforcement is necessary and sufficient.

I suggest  the last "MUST" be changed to "MAY" .
this 3-staged stringprep may be not sufficient for future
diverse i18n appliations and protocols.
Too early freeze-up of stringprep architures from over-simplifications does
not help the stringprep to last long, IMHO.

Soobok Lee

---

From: David Hopwood <[email-masked]>
Date: Tue, 12 Feb 2002 09:23:16 +0000

-----BEGIN PGP SIGNED MESSAGE-----

>   NFC(casefold(x)) or NFKC(casefold(x)) are not correct for <I dot above>

I suggest that the detail of this should be discussed on the
[email-masked] list.

Suffice it to say that it would be irresponsible to proceed with publication
of the stringprep or nameprep draft just yet. I intend to propose a
replacement for stringprep/nameprep that is simpler, more efficient, and
that takes account of all the comments that have been made (including
Hangul normalisation, BiDi, and spoofing, but excluding TC/SC).

> I suggest the last "MUST" be changed to "MAY".

That would make the problem worse.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

From: "Soobok Lee" <[email-masked]>
Date: Wed, 13 Feb 2002 20:37:26 +0900

----- Original Message ----- 
From: "David Hopwood" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, February 12, 2002 6:23 PM
Subject: Re: [idn] stringprep comment 6: casefold and then noramlization is not enough

> of the stringprep or nameprep draft just yet. 

I agree.

> I intend to propose a

Cheers!  I will help you  anytime if you want my aids. :-)

> That would make the problem worse.

Maybe. It's clear that many changes should be made.
As suggested by many contributers, *more steps* should be introduced and interposed.

Soobok Lee