Subject: RE: Last Call summary for draft-ietf-pkix-cert-utf8

From: Russ Housley <[email-masked]>
Date: Thu, 13 Apr 2006 12:11:24 -0400

Ted:

Thanks for the improved text.  Here it is all put together:

    When strings are mapped from internal representations to visual 
representations,
    sometimes two different strings will have the same or similar 
visual representations.
    This can happen for many different reasons, including use of 
similar glyphs and
    use of composed characters (such as e + ' equaling U+00E9, the Korean
    composed characters, and vowels above consonant clusters in 
certain languages).
    As a result of this situation, people doing visual comparisons between two
    different names may think they are the same when in fact they are 
not.  Also,
    people may mistake one string for another.  Issuers of 
certificates and relying
    parties both need to be aware of this situation.

This does not impose any untestable requirements.  Any concerns with this text?

Russ

At 11:05 AM 4/13/2006, you wrote:
>At 10:32 AM -0400 4/13/06, Russ Housley wrote:
> >I suggest the following.  I think it adds the concept of "similar looking."
> >
> >   When strings are mapped from internal representations to visual 
> representations,
> >   sometimes two different strings will have the same or similar 
> visual representations.
> >   This can happen for many different reasons, including use of 
> similar glyphs and
> >   multiple items being combined into a single glyph.
>
>"Multiple items being combined into a single glyph" sounds like you mean
>"the use of composed characters" (e + ' equaling U+00E9, the Korean composed
>characters, vowels above consonant clusters in certain 
>languages).  Each of the
>cases in which that occurs  has a raft of different instances, each 
>with their own
>tricky bits.  If that is what you mean, I'd suggest using that 
>phrasing, as it is a
>more recognized term of art.   If you mean something else, I don't think I'm
>clear on what exactly you mean.
>                                 Ted
>
>
>
>
> >As a result of this situation,
> >   people doing visual comparisons between two different names may 
> think they are
> >   the same when in fact they are not.  Also, people may mistake 
> one string for
> >   another.  Issuers of certificates and relying parties both need 
> to be aware of
> >   this situation.
> >
> >This does not impose any untestable requirements.  Any concerns 
> with this text?
> >
> >Russ
> >
> >
> >At 07:36 AM 4/13/2006, Santosh Chokhani wrote:
> >>When strings are mapped from internal representations to visual
> >>representations, sometimes two different strings will have
> >>the same visual representations.  This can happen due to similar glyphs,
> >>multiple items being combined into a single glyph among other reasons.
> >>When
> >>this happens people doing visual comparisons between two different names
> >>may
> >>think they are the same when in fact they are not.  Also, people may
> >>mistake one string for another.  Issuers of certificates and relying
> >>parties both need to be aware of these facts.

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 13 Apr 2006 10:04:07 -0800

works for me

Mike

-----Original Message-----
From: Russ Housley
Sent: Thursday, April 13, 2006 8:11 AM

Ted:

When strings are mapped from internal representations to visual
representations, sometimes two different strings will have the
same or similar visual representations. This can happen for many
different reasons, including use of similar glyphs and use of
composed characters (such as e + ' equaling U+00E9, the Korean
composed characters, and vowels above consonant clusters in
certain languages).  As a result of this situation, people doing
visual comparisons between two different names may think they
are the same when in fact they are not.  Also, people may mistake
one string for another.  Issuers of certificates and relying
parties both need to be aware of this situation.

This does not impose any untestable requirements.  Any concerns with this
text?

Russ

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 13 Apr 2006 12:48:22 -0700

I concur with this text.

jim 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Russ Housley
> Sent: Thursday, April 13, 2006 9:11 AM
> To: Ted Hardie
> Cc: [email-masked]; [email-masked]
> Subject: RE: Last Call summary for draft-ietf-pkix-cert-utf8
> 
> 
> Ted:
> 
>     When strings are mapped from internal representations to 
> visual representations,
>     sometimes two different strings will have the same or 
> similar visual representations.
>     This can happen for many different reasons, including use 
> of similar glyphs and
>     composed characters, and vowels above consonant clusters 
> in certain languages).
>     different names may think they are the same when in fact 
> they are not.  Also,
> >"Multiple items being combined into a single glyph" sounds like you 
> >mean "the use of composed characters" (e + ' equaling U+00E9, the 
> >Korean composed characters, vowels above consonant clusters 
> in certain 
> >languages).  Each of the cases in which that occurs  has a raft of 
> >different instances, each with their own tricky bits.  If 
> that is what 
> >you mean, I'd suggest using that phrasing, as it is a
> > >>representations, sometimes two different strings will 
> have the same 
> > >>visual representations.  This can happen due to similar glyphs, 
> > >>this happens people doing visual comparisons between two 
> different 
> > >>names may think they are the same when in fact they are 
> not.  Also, 
> certificates 
> > >>and relying parties both need to be aware of these facts.
> 
> 
>

---

From: "Stefan Santesson" <[email-masked]>
Date: Sat, 15 Apr 2006 11:52:46 +0100

I'm fine with this text.

I would oppose inclusion of requirements on the CA regarding name
assignments of reasons stated in the thread.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Russ Housley
> Sent: den 13 april 2006 18:11
> To: Ted Hardie
>     As a result of this situation, people doing visual comparisons
between
> two
mean
> >more recognized term of art.   If you mean something else, I don't
think
> I'm