Subject: Comments on the Stringprep aspects of draft-ietf-snmpconf-pm-13.t xt

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Tue, 27 May 2003 12:53:40 +0200

Pls react to these comments from Patrik.
Pls copy patrik explicitly on your responses, cause he
is (probably) not subscribed to our WG list.

Thanks,
Bert 

-----Original Message-----
From: Patrik Fältström [mailto:[email-masked]]
Sent: dinsdag 27 mei 2003 5:46
To: Wijnen, Bert (Bert)
Cc: Ted Hardie (E-mail); Ned Freed (E-mail)
Subject: Re: help with Stringprep review

On måndag, maj 26, 2003, at 23:36 Europe/Stockholm, Wijnen, Bert (Bert) 
wrote:

> Patrik, I think you have been communicating with Steve
> Waldbusser about the use of Stringprep in his document
> draft-ietf-snmpconf-pm-13.txt (current version).
>
> Would you be so kind to check if what he has described and
> documented is OK? The doc is missing an IANA Considerations
> Section, and I have already told them that they must add
> one to at least list what IANA needs to do for the Stringprep
> profile registration.

(1) This spec very explicitly states it uses UTF-8 encoding of Unicode 
all over the place. Still, the basic functions doesn't take that into 
account. Examples: The function Integer only look for the digits in the 
Unicode Codeset which is in the "US-ASCII area". There are digits in 
other locations as well. When searching for specific values, and doing 
string comparisons, no stringprep is applied to the UTF-8 strings (the 
values) before matching is happening. Etc etc. This is a pure US-ASCII 
spec, even though it claims to use UTF-8. Not good. Either this should 
be UTF-8/Unicode compliant, or it should be US-ASCII only.

(2) The stringprep profile uses no normalization at all. Even though 
the stringprep profile say that is correct, I would very strongly 
discourage this for "human readable strings" which are to be compared.

     paf