Re: [DNSOP] Looking for IANA registry for --xn

[Phillip Hallam-Baker <[e-mail]>]

​​


On Thu, Oct 6, 2016 at 1:24 PM, <[e-mail]> wrote:

>
> >I have been looking for the IANA registry in which the IDNA prefix xn--
> is allocated and have not been able to find it. I can see the following
> possibilities
>
> >1) There isn't such a registry. The allocation is purely ad hoc
>
> >2) There is a registry but none of the IDNA RFCs bother to list it as a
> normative reference.
>
> >Either one would be bad. The existence or non existence of a registry,
> the allocation or non allocation of a code point is not going to cause me
> to decide whether or not to use functionality. All that the registry
> achieves is to avoid collisions.
>
> Phil, this is very interesting.
>
> The 'xn--', of course, is the prefix for punycode used for International
> Domain Names.   I have seen it used for DNS resolution quite a bit in the
> last couple of months.   So, it is certainly used.   In fact, that appears
> to be the only way one can do DNS resolution (at least in my experience).
> That is, do the translation from IDN to punycode.   Then, it seems to work
> like a charm.
>
>
​I am not looking to extend the xn-- system, I have another parallel
application.​

Imagine for the sake of argument that someone who was a VIP (VERY VIP)
needed a secure email system and imagine that they wanted something that
was completely compatible with the existing email infrastructure. ​


​A UDF fingerprint MAY be encoded as a DNS label by prefixing the Base32
text representation with the string ‘zz--‘.

A DNS name that includes a UDF fingerprint as a DNS label carries the
implicit assertion that the interpretation of the address MUST be
authorized by a security policy that is validated under a key that matches
the corresponding fingerprint.


Placing such a DNS label as the top level (rightmost) label in a DNS
address creates an address that is not legal and thus cannot be resolved by
the Internet DNS infrastructure. Thus ensuring that the address is rejected
by applications that are not capable of performing the associated
validation steps.


For example, Alice has the email security key with fingerprint
MB2GK-6DUF5-YGYYL-JNY5E. She uses the following email addresses:

​* ​
[e-mail]

Alice publishes this email address when she does not want the other party
to use the secure email system.

​* ​
[e-mail]

Alice publishes this email address when she wants to give the other party
the option of using secure email if their system supports it.

The DNS server for example.com has been configured to redirect requests to
resolve zz--mb2gk-6duf5-ygyyl-jny5e.example.com to the mail server
example.com.

​* ​
[e-mail]--mb2gk-6duf5-ygyyl-jny5e

Alice uses this email address when she wants the other party to be able to
send her email if and only if their client supports use of the secure
messaging system.

While there should never be a DNS label of the form zz--* in the
authoritative DNS root, such labels MAY be introduced by a trusted local
resolver. This would allow attempts at making an untrusted communication
request to be transparently redirected through a locally trusted security
enhancing proxy.​