Subject: draft-santesson-tls-ume Last Call comment

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 07 Mar 2006 16:34:31 -0800

I note the IETF last call was issued for rev. 2.  That
revision no longer exists, hence I reviewed rev. 3.

This document specification of a "User Principal Name",
I believe, is inadequate.

The I-D indicates that a user_principal_name is a sequence of
0 to 65535 bytes in the form of user@domain.  However,
such a form implies the value is a character string,
but there is no mention of what character set/encoding
is used here.  I would think interoperability
requires both client and server to have a common
understand of what character set/encoding is to
be used.  Additionally, there is no discussion
of UPN matching.  Are byte sequences that differ
only due to use of different Unicode normalizations
to be consider the same or differ?  Are values
case sensitive or not?  etc..

The domain_name field suffers not only from the
above problem, but is flawed due to use of the
outdated "preferred name syntax" of RFC 1034.
This syntax doesn't allow domains such as
123.example.  The text should likely reference
the RFC 1123 which updates the "preferred name
syntax" for naming hosts.

Additionally, no mention of how International
domain names (IDNs) are to be handled.

I recommend ABNF be used to detail the syntax
of each of these fields and that the I-D detail
how values of these fields are to be compared.
Additionally, the I-D should discuss how IDNs
are to be handled.
-- Kurt

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Mark Andrews <[email-masked]>
Date: Wed, 08 Mar 2006 12:16:14 +1100

> syntax" for naming hosts.

	Could the IESG / RFC editor please reject any request to
	publish a document which use the '"preferred name syntax"
	of RFC 1034'.

	RFC 952 as modified by RFC 1123 which was the the intent
	of this section of RFC 1034.

	For mail domains it was RFC 821 as modified by RFC 1123
	(even though RFC 1123 fails to mention RFC 821).  If it
	didn't apply you could send mail to the address records
	for 3com.com but not to the MX records and I don't think
	that was ever the intent.

	Domain name, hostname and mail domain are not interchangable
	concepts.  There are too many RFCs which incorrectly
	interchange these concepts which leads to lots of confusion.
	The latter to are very restriced subsets* of the first.

> domain names (IDNs) are to be handled.

	If we restrict to RFC 952 as modified by RFC 1123 then IDN
	comes into play.

	That doesn't help with the user side however unless we
	apply the mailbox translation for the DNS.

> Additionally, the I-D should discuss how IDNs

	* Hostnames that are 254 and 255 characters long cannot be
	expressed in the DNS.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 07 Mar 2006 22:06:07 -0500

> 	* Hostnames that are 254 and 255 characters long cannot be

Actually hostnames are technically defined with a maximum of 63 characters
in total [RFC1123], and there have been some implementations of /etc/hosts
that could not even do that (hence the rule).

But even ignoring that rule (which you shouldn't, if the idea is to have a
meaningful data-type), there is also a maximum length limit inherent in
SMTP's commands which make the maximum practical mail-domain somewhat
smaller than the DNS limit. For example, SMTP only requires maximum
mailbox of 254 octets, but that includes localpart and @ separator. The
relationship between these different limits is undefined within SMTP
specs, but its there if you know about the inheritance.

When it is all said and done, max practical application of mailbox address
is 63 chars for localpart, "@" separator, 63 chars for domain-part.
Anything beyond that runs afoul of one or more standards.

</pedantry>

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Mark Andrews <[email-masked]>
Date: Wed, 08 Mar 2006 14:23:11 +1100

> that could not even do that (hence the rule).

	RFC 1123

      Host software MUST handle host names of up to 63 characters and
      SHOULD handle host names of up to 255 characters.

	63 is not a maximum.  It is a minumum that must be supported.

---

From: "Eric A. Hall" <[email-masked]>
Date: Tue, 07 Mar 2006 22:24:18 -0500

> 	63 is not a maximum.  It is a minumum that must be supported.

Right, sorry. Same results.