Subject: [mile] IDNs

From: <[email-masked]>
Date: Fri, 27 Jan 2012 10:35:22 -0500

Hi,

This is a final check to make sure people are OK with the proposed approach for IDNs in RID:

Addresses in the Node element rely on IP addresses (they are required in each instance).  A DNS name can be contained in the NodeName element of Node, but is derived from the IP address.  Authentication does not and never did rely on DNS names as we use certificates at the RID layer for digital signatures and encryption, and certificates at the TLS layer.  With this in mind, the international considerations, as currently proposed is as follows:

11.  Internationalization Issues

   The Node class identifies a host or network device.  This document
   re-uses the definition of Node from the IODEF specification
   [RFC5070], Section 3.16.  However, that document did not clearly
   specify whether a NodeName could be an Internationalized Domain Name
   (IDN).  RID systems MUST treat the NodeName class as a domain name
   slot [RFC5890].  RID systems SHOULD support IDNs in the NodeName
   class; if they do so, the UTF-8 representation of the domain name
   MUST be used, i.e., all of the domain name's labels MUST be U-labels
   expressed in UTF-8 or NR-LDH labels [RFC5890]; A-labels MUST NOT be
   used.  An application communicating via RID can convert between
   A-labels and U-labels by using the Punycode encoding [RFC3492] for
   A-labels as described in the protocol specification for
   Internationalized Domain Names in Applications [RFC5891].  RID
   systems are expected to obtain an IDN meeting these requirements by
   asking a DNS resolver to return an IDN that does not contain A-labels
   (even if the input contains A-labels).

I am just waiting to hear from one of the ADs and will post the draft once I get an OK from Pete.

Thank you,
Kathleen

Kathleen M. Moriarty, CISSP | GRC Strategy | Office of the CTO | 617-851-5807 | [email-masked]  | EMC Corporation

---

From: "Waltermire, David A." <[email-masked]>
Date: Fri, 27 Jan 2012 10:59:03 -0500

>From my perspective, internationalization concepts are important to support.  I don't really have a dog in this fight as I am not a developer in this area.  This being said, the wording below looks like a reasonable approach.

Regards,
Dave Waltermire

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, January 27, 2012 10:35 AM
To: [email-masked]
Subject: [mile] IDNs

Hi,

Thank you,
Kathleen

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: Brian Trammell <[email-masked]>
Date: Fri, 27 Jan 2012 18:30:01 +0100

Hi, Kathleen,

Given the requirements, UTF8, free convertibility among the label forms, and implementation support for this convertibility, this seems like a good way to go.

Best regards,

Brian (as a random guy off the street)

---

From: Sean Turner <[email-masked]>
Date: Fri, 27 Jan 2012 13:24:21 -0500

Time to speak up if you've got a problem with this approach.

spt

On 1/27/12 12:30 PM, Brian Trammell wrote:
> On Jan 27, 2012, at 4:35 PM,<[email-masked]>  <[email-masked]>  wrote:
>
>> Hi,
>>

---

From: <[email-masked]>
Date: Fri, 27 Jan 2012 14:00:54 -0500

Looks like a fine approach to me, Thanks, --David

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Sean Turner
> Sent: Friday, January 27, 2012 1:24 PM
> To: [email-masked]
> Subject: Re: [mile] IDNs
> 
> > Given the requirements, UTF8, free convertibility among the label forms, and implementation support
> for this convertibility, this seems like a good way to go.
> >
> > Best regards,
> >
> >> Addresses in the Node element rely on IP addresses (they are required in each instance).  A DNS
> name can be contained in the NodeName element of Node, but is derived from the IP address.
> Authentication does not and never did rely on DNS names as we use certificates at the RID layer for
> digital signatures and encryption, and certificates at the TLS layer.  With this in mind, the
> international considerations, as currently proposed is as follows:
> >>
> >> Kathleen M. Moriarty, CISSP | GRC Strategy | Office of the CTO | 617-851-5807 |
> [email-masked]  | EMC Corporation
> >>
> >>
> >>

---

From: "Martin, Robert A." <[email-masked]>
Date: Fri, 27 Jan 2012 14:03:25 -0500

Concur.

On 1/27/12 2:00 PM, [email-masked] wrote:
> .

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 27 Jan 2012 13:41:31 -0700

On 1/27/12 8:35 AM, [email-masked] wrote:
> Addresses in the Node element rely on IP addresses (they are required
> in each instance).  A DNS name can be contained in the NodeName
> element of Node, but is derived from the IP address.  Authentication
> does not and never did rely on DNS names as we use certificates at
> the RID layer for digital signatures and encryption, and certificates
> at the TLS layer.  With this in mind, the international
> considerations, as currently proposed is as follows:
> 
> asking a DNS resolver to return an IDN that does not contain
> A-labels (even if the input contains A-labels).

As long as the WG is fine with it, that works for me.

One small clarifying question: I assume by the phrase "even if the input
contains A-labels" you mean the RID system's input to the DNS resolver.
Correct?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: <[email-masked]>
Date: Fri, 27 Jan 2012 15:43:11 -0500

> contains A-labels" you mean the RID system's input to the DNS resolver.

Correct, and a good clarification.

Thanks,
--David

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
> Sent: Friday, January 27, 2012 3:42 PM
> To: Moriarty, Kathleen
> Cc: [email-masked]; Pete Resnick
> Subject: Re: [mile] IDNs
>

---

From: Sean Turner <[email-masked]>
Date: Fri, 27 Jan 2012 16:25:43 -0500

> As long as the WG is fine with it, that works for me.

At this point it's all thumbs up.

Just waiting on Pete ;)

spt