Subject: [pcp] ID Indicator option

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 24 Nov 2014 20:21:23 -0700

Dave Thaler has asked me to take a look at the ID Indicator option in 
draft-ietf-pcp-authentication with respect to internationalization.

First, it's not clear to me exactly what the ID indicator indicates. The 
spec says that it is "the identity of the authority that issued the 
credentials" and that "the method of generating this value is out of 
scope". Are there at least any examples of what an ID indicator might 
look like? For example, what kinds of characters are allowable in an ID 
indicator?

Over in the PRECIS WG, we have put a great deal of thought into the 
handling of internationalized strings within protocols. The PRECIS 
"IdentifierClass" is intended to provide the foundation for identifiers 
that are quite safe to use (e.g., by forbidding "expressive" characters 
such as symbols). See draft-ietf-precis-framework for details.

Based on what I know so far, I think that using the Username profile of 
the IdentifierClass (defined in draft-ietf-precis-saslprepbis) might 
make sense here. It maps fullwidth and halfwidth characters (common in 
certain East Asian languages), applies Unicode Normalization Form C 
(NFC), etc. We have had some debate about handling of case mapping vs. 
case preservation, and it seems likely that we will end up specifying 
two Username profiles, one with case mapping and one with case 
preservation (e.g., does an ID indicator of FooBarCity match an ID 
indicator of foobarcity during comparison operations?). As Dave pointed 
out in a recent message to this list, RFC 6943 might be consulted here 
as well.

(I shall remain subscribed to this list until we work out an agreeable 
solution, so there's no need to cc me.)

Peter

-- 
Peter Saint-Andre
https://andyet.com/