[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[idn] stringprep mailing list

Simon Josefsson wrote: 
One way is to incorporate the PR-29 fix, declare the earlier attempt
as buggy, and re-cycle at PROPOSED.  I suspect you prefer that way?  I
am hesitant about that approach, because we have already deployed the
old RFC and it is not clear what problems there will be in mixing the
old and the new code.  Both Kerberos and SASL appears to be going to
use the old StringPrep as well, so we will be seeing security critical
infrastructure based on the old interpretation.

Even if Stringprep is not updated to address the PRI #29 problem, we must at least let the other Stringprep profile authors know about the situation, so that they can make their own decisions for their areas. The IDN mailing list seems to be dedicated to IDNA issues (including Nameprep). Is there a Stringprep mailing list?

http://www.unicode.org/review/pr-29.html
http://www.imc.org/idn/mail-archive/maillist.html

The IANA Stringprep registry has not been updated to point to the new SASLprep RFC:

http://www.iana.org/assignments/stringprep-profiles
ftp://ftp.rfc-editor.org/in-notes/rfc4013.txt

I am Cc'ing the author of RFC 4013 (Kurt Zeilenga) on this email.

I am also Cc'ing the author of the expired Internet Draft of the Kerberos profile of Stringprep (Jeffrey Altman). Kurt and Jeffrey may wish to take a look at the various things I've included URIs for in this email.

http://josefsson.org/cgi-bin/rfcmarkup?url=http://josefsson.org/cgi-bin/viewcvs.cgi/*checkout*/libidn/doc/specifications/draft-ietf-krb-wg-utf8-profile-01.txt

Erik