Re: [precis] [Fwd: [pkix] IDNA2008 and PKIX certificates]

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2016-11-23 at 10:51 -0500, John C Klensin wrote:
> Nikos,
> 
> Follow Alexey's advice about where to take this -- LAMPS should
> have constructive suggestions.  However, the evidence I've seen
> suggests that, while most registrars use IDNA2008 as you note,
> many or most browsers are still using IDNA2003 or some hybrid
> involving IDNA2003, UTR46, and, sometimes, unofficial (and
> inconsistent) versions of Stringprep modified to reflect some or
> all Unicode versions since 3.2.
> 
> That makes many situations, not just HTTPS, quite confusing.

Thank you for the suggestions and the comments John and Alexey. I
return on that. I've sent an email to the LAMPS list with no reply. I
find that understandable since few of the PKIX people actually
understand what is going on with IDNA, labels, and unicode. On that
field, we simply need a standard to follow and the current IDNA2003 vs
IDNA2008 situation doesn't help. 

More precisely what is needed is a standard to reference to map UTF-8
hostnames to ACE and vice-versa. I am not sure whether reverse function
required by PKIX (we need to display to the user the actual string),
exists. According to some discussion in libidn2 list, there is no RFC
describing it [0]. Has this changed since then?

About transitioning, my impression is that for PKIX, a transition
method would most likely make things worse rather than provide an
actual fix (IDNA2008 is already deployed in DNS registrars, and PKIX is
currently mandating an obsolete standard).

What is required at the PKIX, is an update of section 7.2 of RFC5280:
https://tools.ietf.org/html/rfc5280#section-7.2

Could someone from the precis list with better understanding of the
IDNA specifics help with updating that section? I could help drafting
it, if required.

regards,
Nikos

[0]. https://lists.gnu.org/archive/html/help-libidn/2013-06/msg00001.html