Subject: RE: [TLS] Review of draft-housley-tls-authz-extns-05

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 5 Jun 2006 07:01:22 -0400

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> Sent: Monday, June 05, 2006 5:00 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: RE: [TLS] Review of draft-housley-tls-authz-extns-05
> 
> Sam Hartman wrote:
> 
> > p> We also need to specify the character-to-octet encoding (UTF-8
> > p> would be the most logical alternative).
> > 
> > It's my understanding that saying it is XML already gives us that:
> > mandatory UTF8 or UTF16 support at the encoder's option.
> 
> Yes, but the recipient has to know which encoding was used (others 
> than UTF8/UTF16 are permitted). 
> 
> In a complete XML document, the XML declaration usually contains 
> this information (e.g. "<?xml encoding='UTF-8'?>">, but currently
> the AuthorizationData contains just one Assertion element, not
> a complete document.
> 
> I'm not really an XML expert, but I think the options available
> to use would be including this information in the "transport"
> (e.g., specify it's UTF-8, or include a field for encoding name),
> or mandating that AuthorizationData has to include the XML text
> declaration before the Assertion element.
> 
> Any opinions from XML experts?

Section 5.1 of RFC 3470/BCP 70 includes relevant text.  In a nutshell,
UTF-8 is a MUST if you're using XML.  UTF-16 is recommended since you
get it for free with XML parsers, but it's not required.  An XML
declaration is not needed if you're using either UTF-8 or UTF-16.  A
byte order mark is required with UTF-16.  Other encodings are possible,
but if something else is used it must be identified with an appropriate
XML declaration.

-Scott-

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Mon, 5 Jun 2006 14:47:56 +0300

Scott Hollenbeck wrote:

> Section 5.1 of RFC 3470/BCP 70 includes relevant text.  In a
> nutshell, UTF-8 is a MUST if you're using XML.  UTF-16 is
> recommended since you get it for free with XML parsers, but it's not
> required.  An XML declaration is not needed if you're using either
> UTF-8 or UTF-16.  A byte order mark is required with UTF-16.  Other
> encodings are possible, but if something else is used it must be
> identified with an appropriate XML declaration.

Thanks for the pointer; it looks like Section 4.1 of the document 
is also relevant:

   In some uses of XML as an embedded protocol element, the XML used
   is a small fragment in a larger context, where the XML version is
   fixed at "1.0" and the character encoding is known to be "UTF-8".
   In those cases, an XML declaration might add extra overhead.  In
   cases where the XML is a larger component which may find its way
   alone as an external entity body (transported as a MIME message,
   for example), the XML declaration is an important marker and is
   useful for reliability and extensibility.  The XML declaration is
   also an important marker for character set/encoding (see Section
   5.1), if any encoding other than UTF-8 or UTF-16 is used.  Note
   that in the case of UTF-16, XML requires that the entity starts
   with a Byte Order Mark (BOM), which is not part of the character
   data.  Note that the XML Declaration itself is not part of the XML
   document's Information Set.

   Protocol specifications must be clear about use of XML
   declarations.  XML [8] notes that "XML documents should begin with
   an XML declaration which specifies the version of XML being used."
   In general, an XML declaration should be encouraged ("SHOULD be
   present") and must always be allowed ("MAY be sent").  An XML
   declaration should be required in cases where, if allowed, the
   character encoding is anything other than UTF-8 or UTF-16.  

Since the latter paragraph says that XML declaration must always be
allowed, the simplest approach would be to always require it here.
In other words, draft-housley-tls-authz-extns should say something
like this, right?

   "When SAMLAssertion is used, the field contains an XML text
   declaration, followed by an <Assertion> element using the
   AssertionType complex type as defined in [SAML1.1][SAML2.0]. 
   The field MUST also follow the rules of [XML] for including
   the Byte Order Mark (BOM) in encoded entities."

Best regards,
Pasi