Re: [pkix] IDNA2008 and PKIX certificates

Thank you Sean. Should I forward the initial question to the precis
working group? (or at least a version of the question which asks their
recommendation).

On Wed, 2016-11-23 at 05:57 -0500, Sean Turner wrote:
> Nikos,
> 
> I asked about this in 2011 and here’s the response I got from an
> “apps” person (shared with permission):
> 
> spt
> 
> > 
> > On Apr 13, 2011, at 14:51, Pete Resnick <presnick@qualcomm.com>
> > wrote:
> > 
> > > 
> > > I'm curious if there's something that lists the differences
> > > between the IDNA 2003 and 2008 for a layman. I've got a WG that
> > > wants to update the references, but I don't think it's just as
> > > easy as that.
> > 
> > It is most certainly *not* as easy as that. You could send them to
> > RFC 5894, but that's not a list of differences; it's an entirely
> > new design philosophy. If you've got a WG that wants to update
> > references, send them to PRECIS. We're here to help.™
> > 
> > pr
> 
> 
> > 
> > On Nov 22, 2016, at 05:02, Nikos Mavrogiannopoulos <nmav@redhat.com
> > > wrote:
> > 
> > Hi,
> >  RFC5280 and its update (6818), reference IDNA2003 (rfc3490) for
> > storing internationalized DNS names. However, IDNA2003 is already
> > obsolete standard (it seems it was already deprecated when RFC6818
> > was
> > published [0]) and in practice phased out. What is the current best
> > practice on internationalized names with certificates?
> > 
> > Is it transparently switch to IDNA2008 (rfc5890), and let software
> > figure out the reverse mappings to utf8 somehow?
> > 
> > Or is it store UTF-8 dns names on the certificate, and let the
> > software
> > comparing DNS names do any mapping it deems necessary prior to
> > comparison?
> > 
> > regards,
> > Nikos
> > 
> > [0]. https://www.ietf.org/mail-archive/web/pkix/current/msg28386.ht
> > ml
> > 
> > _______________________________________________
> > pkix mailing list
> > pkix@ietf.org
> > https://www.ietf.org/mailman/listinfo/pkix
> 