Subject: [Fwd: Re: Kerberos Revisions and UTF8]

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 08 Aug 2001 08:31:31 -0500

Directions on the use of UTF8

-------- Original Message --------
Subject: Re: Kerberos Revisions and UTF8
Date: Wed, 08 Aug 2001 13:53:49 +0100
From: Harald Tveit Alvestrand <[email-masked]>
To: "Douglas E. Engert" <[email-masked]>
References: <[email-masked]>

--On 8. august 2001 04:02 -0500 "Douglas E. Engert" <[email-masked]> 
wrote:

> RFC 1510 used GeneralString, but all of the implementations in effect
> treat this  as a ASCI string, or a locale string type. We have been
> looking at the problems which would arise if this was changed to UTF8,
> and there are many. (If need be I can get you  a list from those who
> understand the issues better then I) We know that this must be
> addressed, but would like to address this as a separated document from
> the revisions as listed above.

The GeneralString is a troublesome ASN.1 type in many ways, most of all 
because it can be used to represent ANY string that can be encoded using 
ISO 2022 code page switching.
And, as you say, it has been abused in many different ways; RFC 1502 gives 
a brief guide to how one should abuse it in a standards conformant manner.

I think you can take it as given that if the revised document does NOT 
outlaw totally the use of national character sets without the appropriate 
escape sequences, this will cause the IESG to object severely to the 
specification; this is a violation of RFC 2277, ASN.1 and common sense, and 
can never be made to function interoperably on a global scale.
(feel free to quote me on that, BTW!)

For a permanent solution: If the working group takes either of the paths of

- Switching to ASN.1(92?) and using a CHOICE(UTF8STRING), with a clear 
preference for using it, just like PKIX did
- Continuing to use GeneralString, but insist that the only permitted (or 
at least strongly preferred) escape sequence is the one for UTF-8

there is reasonable hope to go forward.

Note that the use of wide character sets in identifiers has LOTS of funny 
issues, many of which have been hashed over ad nauseam in the IDN group; 
you will want to consult the IDN group's requirements and NAMEPREP 
documents before locking yourself to an approach.

Good luck!

                  Harald