Internationalized Domain Name (idn)

Michel Suignard | 14 Sep 2004 01:43

Picon

IDNA and Control codes (0-1F) and 7F

By excluding table C.2.1 from the StringPrep profile used by IDNA, the
ToASCII operation allows all C0 control codes and 7F in its default mode
(UseSTD3ASCIIRules flag unset). This is rather troublesome as these
control codes, especially the 00 value, may create all sorts of issues
for run time libraries that use zero as string terminator on input. When
such usage is performed it makes quite cumbersome to detect when the
zero character is a terminator or part of the character string itself.
I understand the value of allowing all ASCII non control characters but
allowing by default the control characters in a ToASCII function seems
to open the door for all sorts of abuse and security risks.

Would a library that by default only allow the range 20-7E be still
considered conformant? In all cases, it would still honor the
UseSTD3ASCIIRules. Allowing the C0 control codes and 7F doesn't seem
that useful. I would have preferred to have a default mode excluding
them and if the full 00-7F is really required make it another optional
flag.

Was this intended? Or is it an error? Or maybe I am not reading the spec
correctly 

Michel
----------
References:
RFC 3490 IDNA, section 2. Terminology says:
<<
An "internationalized label" is a label to which the ToASCII operation
(see instruction 4) can be applied without failing (with the
UseSTD3ASCIIRules flag unset).
>>

(Continue reading)

Paul Hoffman / IMC | 14 Sep 2004 02:33

Picon

Re: IDNA and Control codes (0-1F) and 7F

At 4:43 PM -0700 9/13/04, Michel Suignard wrote:
>By excluding table C.2.1 from the StringPrep profile used by IDNA, the
>ToASCII operation allows all C0 control codes and 7F in its default mode
>(UseSTD3ASCIIRules flag unset).

There is no "default mode" for IDNA. This was debated, but in the end 
we had to allow both methods of processing names. If anything, the 
UseSTD3ASCIIRules flag being *set* is probably the default for most 
systems processing domain names today, probably unconsciously.

>Would a library that by default only allow the range 20-7E be still
>considered conformant? In all cases, it would still honor the
>UseSTD3ASCIIRules. Allowing the C0 control codes and 7F doesn't seem
>that useful. I would have preferred to have a default mode excluding
>them and if the full 00-7F is really required make it another optional
>flag.

If such a library followed the IDNA spec with the UseSTD3ASCIIRules 
being set, it would certainly be conformant.

--Paul Hoffman, Director
--Internet Mail Consortium

Adam M. Costello | 14 Sep 2004 08:57

Re: IDNA and Control codes (0-1F) and 7F

Michel Suignard <michelsu <at> windows.microsoft.com> wrote:

> By excluding table C.2.1 from the StringPrep profile used by IDNA, the
> ToASCII operation allows all C0 control codes and 7F in its default
> mode (UseSTD3ASCIIRules flag unset).

As Paul said, there is no default mode.  It is up to the application
to decide whether to set UseSTD3ASCIIRules.  Of course a library could
make one mode or the other the default, and it is free to choose either
mode to be the default.  A library could also, I suppose, implement only
one mode or the other, in which case I guess it would be an incomplete
conformant implementation of ToASCII.

> This is rather troublesome as these control codes, especially the 00
> value, may create all sorts of issues for run time libraries that use
> zero as string terminator on input.

If the programming environment customarily uses a string representation
that does not allow embedded NULs to be represented, then it will be a
moot point whether your ToASCII implementation handles NUL correctly,
because it cannot be tested anyway.  You can reasonably claim that it's
not your IDN library that's incomplete, but the programming environment
that's incomplete.

Note that ToASCII and ToUnicode will never try to output an embedded NUL
character if they never receive an embedded NUL character as input.

For an example of a C library that handles embedded NULs, see GNU
libidn:

(Continue reading)

Krall, Gary | 14 Sep 2004 22:30

Picon

RE: IDNA and Control codes (0-1F) and 7F

All:

Just as an fyi, the C library in the Verisign SDK ("Xcode") has the
UseSTD3ASCIIRules  rule set by default.  It is a compile switch option which
can be changed in the library's configuration file.

Also note that the library does not accept null characters embedded in input
strings regardless of how this flag is set. Control characters other than
null will pass through as expected without the std3 flag set.

Gary.

-----Original Message-----
From: Adam M. Costello [mailto:idn.amc+0 <at> nicemice.net.RemoveThisWord]
Sent: Monday, September 13, 2004 11:58 PM
To: IETF idn working group
Subject: Re: [idn] IDNA and Control codes (0-1F) and 7F

Michel Suignard <michelsu <at> windows.microsoft.com> wrote:

> By excluding table C.2.1 from the StringPrep profile used by IDNA, the
> ToASCII operation allows all C0 control codes and 7F in its default
> mode (UseSTD3ASCIIRules flag unset).

As Paul said, there is no default mode.  It is up to the application
to decide whether to set UseSTD3ASCIIRules.  Of course a library could
make one mode or the other the default, and it is free to choose either
mode to be the default.  A library could also, I suppose, implement only
one mode or the other, in which case I guess it would be an incomplete
conformant implementation of ToASCII.

(Continue reading)

JFC (Jefsey) Morfin | 15 Sep 2004 00:31

RE: IDNA and Control codes (0-1F) and 7F

Dear Gary,
were can this DSK be found. Or is it proprietary?
thanks
jfc morfin

At 22:30 14/09/2004, Krall, Gary wrote:

>All:
>
>Just as an fyi, the C library in the Verisign SDK ("Xcode") has the
>UseSTD3ASCIIRules  rule set by default.  It is a compile switch option which
>can be changed in the library's configuration file.
>
>Also note that the library does not accept null characters embedded in input
>strings regardless of how this flag is set. Control characters other than
>null will pass through as expected without the std3 flag set.
>
>Gary.
>
>-----Original Message-----
>From: Adam M. Costello [mailto:idn.amc+0 <at> nicemice.net.RemoveThisWord]
>Sent: Monday, September 13, 2004 11:58 PM
>To: IETF idn working group
>Subject: Re: [idn] IDNA and Control codes (0-1F) and 7F
>
>
>Michel Suignard <michelsu <at> windows.microsoft.com> wrote:
>
> > By excluding table C.2.1 from the StringPrep profile used by IDNA, the
> > ToASCII operation allows all C0 control codes and 7F in its default

(Continue reading)

Krall, Gary | 15 Sep 2004 01:06

Picon

RE: IDNA and Control codes (0-1F) and 7F

Jefsey:

Our SDK (which includes both C as well as a Java implementation) is open
sourced and covered under BSD licensing provisions.  For the specific
information about our library you may go to:  

http://www.verisign.com/products-services/naming-and-directory-services/nami
ng-services/internationalized-domain-names/idn-registrars/page_001408.html

Additionally for a list of current environments which support IDNA (includes
both applications as well as programming languages) you may go to:

http://www.verisign.com/products-services/naming-and-directory-services/nami
ng-services/internationalized-domain-names/page_002201.html

Hope this helps.

Gary.

-----Original Message-----
From: JFC (Jefsey) Morfin [mailto:jefsey <at> jefsey.com]
Sent: Tuesday, September 14, 2004 3:32 PM
To: Krall, Gary; 'IETF idn working group'
Subject: RE: [idn] IDNA and Control codes (0-1F) and 7F

Dear Gary,
were can this DSK be found. Or is it proprietary?
thanks
jfc morfin

(Continue reading)

Joel Rowbottom | 23 Sep 2004 13:54

Re: Re:

At 12:40 23/09/2004, Harald wrote:

>[]
><virus attachment removed>

Please can someone LART this joker from the list. It's getting annoying now.

--
  Joel Rowbottom, http://www.centralnic.com - CTO and self-confessed Unix geek
  <t> +44 (0)20 7751 9000   <f> +44 (0)20 7736 9253   <e> joel <at> centralnic.com
  # Note: Contents may not necessarily represent the opinions of CentralNic.

William Tan | 24 Sep 2004 22:03

Re: Re:

It's probably forged by a worm. You might want to configure your mail 
scanner to reject virus-infected mails at SMTP stage rather than 
sanitizing it.

Cheers,
wil.

Joel Rowbottom wrote:

> At 12:40 23/09/2004, Harald wrote:
>
>> []
>> <virus attachment removed>
>
>
> Please can someone LART this joker from the list. It's getting 
> annoying now.
>
>
> -- 
>  Joel Rowbottom, http://www.centralnic.com - CTO and self-confessed 
> Unix geek
>  <t> +44 (0)20 7751 9000   <f> +44 (0)20 7736 9253   <e> 
> joel <at> centralnic.com
>  # Note: Contents may not necessarily represent the opinions of 
> CentralNic.
>
>

(Continue reading)

Group

gmane.ietf.idn.

Search Archive

Page

1

Articles in period: 8

September 2004

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Revised IDN Guidelines Open for Public Comments (21 Sep 2005)
IDN Implementation Status Update (22 Jul 2005)
(14 Jul 2005)
a way toward homograph resolution ? (was "improving WG operation") (11 May 2005)
homographs in TrueType fonts (5 May 2005)
Mac OS X Safari and IDN spoofing (28 Mar 2005)
Mac OS X Safari and IDN spoofing (22 Mar 2005)
list: productive discussion (18 Mar 2005)
IDNA section 3.1 requirement 3 (16 Mar 2005)
stability (16 Mar 2005)
stability (16 Mar 2005)
stability (16 Mar 2005)
character tables (3 Mar 2005)
character tables (3 Mar 2005)
mailing list (25 Feb 2005)
gTLD Registry Constituency's statement (25 Feb 2005)
punctuation (24 Feb 2005)
homographs of the delimiters aka syntax chars (23 Feb 2005)
another BIDI/ASCII representation problem on w3.org (23 Feb 2005)
another BIDI/ASCII representation problem on w3.org (23 Feb 2005)
nameprep, IDN spoofing and the registries (22 Feb 2005)

Archives

1	March 2008
1	February 2008
1	February 2006
1	September 2005
2	July 2005
6	May 2005
4	April 2005
88	March 2005
271	February 2005
1	November 2004
8	September 2004
23	August 2004
6	July 2004
4	June 2004
2	May 2004
1	April 2004
3	March 2004
2	February 2004
19	January 2004
1	December 2003
4	November 2003
60	October 2003
1	September 2003
4	August 2003
2	July 2003
2	June 2003
13	May 2003
27	April 2003
98	March 2003
16	February 2003
22	January 2003
31	December 2002
65	November 2002
97	October 2002
207	September 2002
24	August 2002
60	July 2002
211	June 2002
206	May 2002
51	April 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template