Subject: Re: Last Call: 'Update to DirectoryString Processing in the Internet

From: Alicia da Conceicao <[email-masked]>
Date: Fri, 7 Apr 2006 07:23:18 -0400 (EDT)

> I think it is a bad idea to select the type of the encoding i.e. 
> printable string vs utf8 dynamically, i.e. encode printable string
> when possible else do utf8.  The printable string certs will probably
> be usable everywhere but the utf8 may have problems.

Agreed!!!  Either you only allow printable strings or only allow UTF8
strings.  If you allow both, there is no real security gain, since a
phisher can still have an accented UTF8 organization name that looks
similar to the printable string of a different organization.

> Would a CA tell users: Well, if you could remove your Umlaut or Accent ...
> I don't think that everybody have the money as France Telecom to remove the
> two accents on the "e"s.

True, but Europeans including myself are use to having our personal and
organizational names stripped of accents.  Try booking a flight, most
airline booking systems (Sabor, Gemini, etc.) remove accents.  The same
is true for DNS, in which a company has to remove accents fro its domain
name.

Personally I am on the fence regarding printable or utf8 for directory
strings.  Although whatever is decided it should always be consistant.
Things are already complicated enough for CA's and developers.

Alicia.

---

From: Sam Hartman <[email-masked]>
Date: Sat, 08 Apr 2006 18:34:05 -0400

>>>>> "Alicia" == Alicia da Conceicao <[email-masked]> writes:

    >> I think it is a bad idea to select the type of the encoding
    >> i.e.  printable string vs utf8 dynamically, i.e. encode
    >> printable string when possible else do utf8.  The printable
    >> string certs will probably be usable everywhere but the utf8
    >> may have problems.

    Alicia> Agreed!!!  Either you only allow printable strings or only
    Alicia> allow UTF8 strings.  If you allow both, there is no real
    Alicia> security gain, since a phisher can still have an accented
    Alicia> UTF8 organization name that looks similar to the printable
    Alicia> string of a different organization.

Hi.  Hi.  Only allowing one string form would be a significant
departure from RFC 3280 and existing practice.  I believe it would
break a lot of deployed architecture.  You would need to show
significant support for your comment for it to stand.

--Sam