Re: [apps-discuss] [dane] AppsDir review of

[Andrew Sullivan <[e-mail]>]

On Sat, May 05, 2012 at 07:21:51AM -0700, Paul Hoffman wrote:
> 
> Note that the document explicitly states in the last paragraph of
> section 1.2 that "This document only relates to securely associating
> certificates for TLS and DTLS with host names".  We are not talking
> just "domain names" (which are made up of labels of octets) but
> "host names" which are made up of labels of ASCII. We were told
> (wisely) not to try to reopen this can of worms, so we didn't.

Aha, good point.  I guess this needs a normative reference to RFC 952,
then?  That's actually the most recent RFC that establishes the host
rules.

> OLD
>   3.  The domain name is appended to the result of step 2 to complete
>       the prepared domain name.
> 
> NEW
> 
>   3.  The domain name is appended to the result of step 2 to complete
>       the prepared domain name.  (The domain name is the fully
>       qualified DNS domain name [RFC1035] of the TLS server and is
>       represented as a byte string where each label is encoded
>       using ASCII; this enables support for internationalized
>       domain names through the use of A-labels as defined in
>       [RFC5890].)

I'm still uncomfortable with this, because it's not technically
accurate.  When you send the QNAME, it's not a "byte string" and the
labels aren't encoded.  They're octets, not strings.

How about 

    3.  The base domain name is appended to the result of step 2 to
        complete the prepared domain name.  The base domain name is the 
        fully-qualified DNS domain name [RFC1035] of the TLS server,
        with the additional restriction that every label must meet the
        rules of [RFC952].  The latter restriction means that, if the
        query is for an internationalized domain name, it must use the
        A-label form as defined in [RFC5890].

?  I added the modifier "base" to this to make it clear that we're not
defining what domain names are, although I don't myself feel too
strongly about that addition.

A

-- 
Andrew Sullivan
[e-mail]