secdir review of draft-ietf-idnabis-rationale-13.txt

[John C Klensin]

--On Tuesday, October 06, 2009 07:33 +0000 Charlie Kaufman
<charliek at microsoft.com> wrote:

> My reading of the IDNA spec was that no query response would
> ever contain a U-label, and therefore saying that if the query
> response did contain a U-label then DNSSEC couldn't sign or
> verify it seems nonsensical. I believe that DNSSEC is more
> like part of DNS than up at the layer of IDNA; it can sign
> anything that DNS can return.
> 
> I believe the DNSSEC spec says that what is signed is the
> "wire form" of the name, which should be unambiguous unless
> different wire forms are used in different contexts in the DNS
> protocol. For DNS servers following IDNA, the wire form would
> always be an A-label or an LDH-label.
> 
> I could easily believe that there are problems when DNSSEC
> interacts with non-IDNA compliant names (either because the
> term "wire form" was ambiguous in some contexts or because the
> DNSSEC spec did not consistently use that terminology). But I
> haven't heard anyone claim that yet.

Certainly it is the case that IDNA getting into trouble with
DNSSEC (or vice versa) would require at least one of 

	-- a sloppy reading of the IDNA specs
	
	-- a sloppy reading of the DNSSEC specs
	
	-- some odd case brought about by storing UTF-8 (or
	other) strings in the DNS, as discussed in
	draft-iab-idn-encoding.

Of course, we've seen sloppy readings and odd cases in
abundance, including a TLD or two that has registered strings in
ISO 8859-1, insisted that they are IDNs, and claimed national
sovereignty when criticized for that behavior.  DNSSEC would of
course work even for the latter as long as queries were in
8859-1, matching the stored form (if someone tried to make an
IDNA query to find an 8859-1 label, it would fail with or
without DNSSEC).    It seems to me that the question is whether
those cases are important enough to be worth a comment in
Rationale (not one of the normative IDNA specs, but the
non-normative explanation) and, if so, what it should say.

     john