Re: [pkix] [apps-discuss] character repertoire for fragment identifiers

[Sean Leonard <[e-mail]>]

On 1/11/2015 2:24 PM, Sam Ruby wrote:
> On 01/11/2015 05:10 PM, Sean Leonard wrote:
>>
>> I fully agree with Julian on the matter of US-ASCII for URIs. URIs (RFC
>> 3986) are only made of US-ASCII characters.
>>
>> If someone wishes to extend URIs (as opposed to IRIs or whatever) to
>> include non-US-ASCII characters, that's a problem for web browsers and
>> all other Internet software alike. This goes exactly to my point about
>> protocol slots.
>>
>> Certificates, CRLs, and other security objects are just as fundamentally
>> a part of the Web (and web browser) infrastructure as HTML. In
>> X.509/PKIX security objects, the GeneralName uniformResourceIdentifier
>> construct is US-ASCII only (IA5String). If you extend "URIs" to be
>> beyond US-ASCII, RFC 5280 has to be updated...and all the security
>> libraries that depend upon it. Just because HTML(5) can be served as
>> UTF-8 or use & encoding or whatever, doesn't make the problem go 
>> away.
>>
>> Does the URL Interop test-results explicitly test for certificates? I
>> suggest attempting to put some non-US-ASCII characters in a GeneralName
>> protocol slot (say, for revocation) and see what happens.
>
> The topic is character repertoire for fragment identifiers, not 
> schemes.  I am not suggesting that we allow non-US-ASCII protocols.
>
> I am willing to accept that GeneralName's that are expressed in the 
> form of a URI must be ASCII-only.
>
> The next question is: are all possible URIs valid GeneralNames?
>
> Here are two examples:
>
> data:image/gif;base64,R0lGODlhyAAiALM...DfD0QAADs=

Yes. Use case: Certificate Image. RFC 6170 (previously RFC 3709).

> https://www.ietf.org/#related

Yes. Use case: Certification Practice Statement (CPS) Pointer 
(Certificate Policies, id-qt-cps). Section 4.2.1.4 of RFC 5280. I have 
seen fragments in there in the wild.

Both examples are valid.

Note: the examples I provide here are actually examples where the URIs 
are encoded directly in IA5Strings; there is no GeneralName CHOICE. But 
the premise still stands. Others with PKIX experience can point to 
systems/protocols where uniformResourceIdentifier is in use with the 
appropriate.

One offhand example that I was able to find, via a Google search, is the 
GS1 Certificate Profile Standard v2.0 
<http://www.gs1.org/gsmp/kc/epcglobal/cert/cert_2_0-standard-20100610.pdf>. 
That happens to use GeneralName. It's a bit elliptical, and refers to 
RFC 4043 (which I rarely see), but...it's there.

Sean