Subject: [Medup] Fwd: New Version Notification for draft-birk-pep-trustwords-03.txt

From: Hernâni Marques (p≡p foundation) <[email-masked]>
Date: Tue, 19 Mar 2019 19:07:28 +0100

Dear MEDUP list

Please be aware of the trustwords drafts (now in rev 03), which -- as is
-- is a mapping of fingerprints to natural language words: in messaging
contexts, it's usuable to authenticate peers in a less cumbersome way.

Greets

Hernani

-------- Forwarded Message --------
Subject: New Version Notification for draft-birk-pep-trustwords-03.txt
Date: Mon, 11 Mar 2019 15:54:31 -0700
From: [email-masked]
To: Bernie Hoeneisen (bernhard.hoeneisen AT ucom.ch)
<[email-masked]>, Volker Birk <[email-masked]>,
Hernani Marques <[email-masked]>

A new version of I-D, draft-birk-pep-trustwords-03.txt
has been successfully submitted by Hernani Marques and posted to the
IETF repository.

Name:		draft-birk-pep-trustwords
Revision:	03
Title:		IANA Registration of Trustword Lists: Guide, Template and IANA
Considerations
Document date:	2019-03-11
Group:		Individual Submission
Pages:		14
URL:
https://www.ietf.org/internet-drafts/draft-birk-pep-trustwords-03.txt
Status:         https://datatracker.ietf.org/doc/draft-birk-pep-trustwords/
Htmlized:       https://tools.ietf.org/html/draft-birk-pep-trustwords-03
Htmlized:
https://datatracker.ietf.org/doc/html/draft-birk-pep-trustwords
Diff:
https://www.ietf.org/rfcdiff?url2=draft-birk-pep-trustwords-03

Abstract:
   This document specifies the IANA Registration Guidelines for
   Trustwords, describes corresponding registration procedures, and
   provides a guideline for creating Trustword list specifications.

   Trustwords are common words in a natural language (e.g., English) to
   which the hexadecimal strings are mapped to.  This makes verification
   processes (e.g., comparison of fingerprints), more practical and less
   prone to misunderstandings.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Bernie Hoeneisen <[email-masked]>
Date: Fri, 22 Mar 2019 23:55:40 +0100 (CET)

Dear MEDUP list

The IANA Registration for trustwords (a basic concept applied in pEp)
https://www.ietf.org/internet-drafts/draft-birk-pep-trustwords-03.txt
has several open issues, we'd need your feedback on, e.g.:

1) Localization:
    How should non-ASCII-7bit letters or language symbols be represented
    in the wordlists? UTF-8? HTML-like encoding? IDNA? Any better solution?

2) Registration format:
    The format for registrations of at IANA is normaly (peudo-)XML.
    While XML is concise for registering wordlists, the files
    for registration will contain lot of XML overhead and thus get rather
    long. Is this an issue? Use another format, e.g. CSV?

3) ISO language code:
    Which ISO language code either 639-1 or 639-3 shall be used, to
    designate the language, i.e.,
    ISO-639-1 (e.g., ca, de, en, ...) as currently used in pEp
    implementations (running code) or ISO-639-3 (eng, deu, ita, ...)
    With ISO-639-3 more languages can be addressed, in particular
    less widespread languages and dialects.

4) Bitsize (how many bits can be mapped with a wordlist):
    e.g. a bitsize of 16 allows for a list containing 2^16 = 655536 words.

    Should this be kept open or should only certain values for bitsize
    be allowed to be registerd?
    If latter applies, which values are useful (e.g. 8, 12 and 16)

Looking forward to your input!

So long!

  Bernie

---

From: Christian Grothoff <[email-masked]>
Date: Sat, 23 Mar 2019 06:14:12 +0100

>    in the wordlists? UTF-8? HTML-like encoding? IDNA? Any better solution?

UTF-8. IDNA/HTML add unnecessary horrific complexity. Also, with IDNA
you are stuck on Unicode 6.0 "forever".

>    long. Is this an issue? Use another format, e.g. CSV?

I don't see it as a major issue, but it might be nice to offer
alternative formats as a convenience (or scripts to convert to CSV/SQL).

>    If latter applies, which values are useful (e.g. 8, 12 and 16)

Any size is technically usable, and if I have a usable list with say
2^14 words it makes no sense to require me to restrict to 2^8 or expand
to 2^16.  So I would definitively not limit to any particular number of
bits. However, maybe a minimum makes sense, like at least 2^8, to ensure
that the generated trustword-sentences are somewhat sane (otherwise some
joker might define a 2-word list for a language...).

My 2 cents

Christian

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 26 Mar 2019 19:00:01 +0100

>    in the wordlists? UTF-8? HTML-like encoding? IDNA? Any better solution?

UTF-8, the other precursors are not quite as universal.

>    long. Is this an issue? Use another format, e.g. CSV?

If the registration requires a specification, a plain text format would seem to
be easier and more conforming to classic RFCs.  E.g.:

language code: en
bit size: 8
...

IANA may provide HTML, XML, CSV versions as needed.

>    less widespread languages and dialects.

ISO-639-1, the less languages the better.  Similar languages generate
confusion; for example, aig (Antigua and Barbuda Creole English) contains many
words that look like English, so it would be harder for a verifier to first
establish what wordlist is being used.

>    e.g. a bitsize of 16 allows for a list containing 2^16 = 65536 words.
> 

Open sound better.  Using wordlists may give rise to a totally new kind of
blockchains, where meaningful phrases are the target.  We shouldn't limit
creativity by imposing a fixed size.

jm2c

Ale
--

---

From: Volker Birk <[email-masked]>
Date: Tue, 26 Mar 2019 20:40:22 +0100

> UTF-8, the other precursors are not quite as universal.

That's what we're using today – NFC normalized to be exact. We did this
to unify characters, which have an identical appearance (like Ohm sign
and Greek capital letter Omega).

> language code: en

Today we're using ISO 639-1, so this is the case already.

> ISO-639-1, the less languages the better.

Fully agreed. Supporting your reasoning.

> creativity by imposing a fixed size.

Word lists like Trustwords require a variable length concept, because
there's languages with quite different numbers of words in dictionaries.

Yours,
VB.
-- 
Volker Birk, p≡p project
mailto:[email-masked]
https://pep.software