CHARSET-POLICY Re: WG Last Call: draft-ietf-sasl-rfc2222bis-02.txt

["Kurt D. Zeilenga" <[e-mail]>]

My main gripe here is that the I-D implied incorrectly that
the IETF character set policy RECOMMENDs protocols be able
to use UTF-8 when the police that protocols are REQUIRED
to be able to use UTF-8.

I think both these "Per IETF character set policy" statements
should be deleted.  Inserting a note like shown below might
be appropriate.

>   The character encoding scheme used (see [CHARSET-POLICY]
for IETF policy regarding character sets in IETF protocols)
for
>   transmitting an authorization identity over protocol is
>    specified in each authentication mechanism (with the
>   authentication mechanism's blob being further
>   restricted/encoded by the protocol profile).  


At 08:43 AM 10/1/2003, Jeffrey Hutzelman wrote:
>>>  Per IETF character set
>>>  policy [CHARSET-POLICY], authentication mechanisms SHOULD encode
>>>  these and other strings in UTF-8 [UTF-8].
>>
>>This seems counter to [CHARSET-POLICY] as it allows a mechanism to
>>not support UTF-8 transfer of character data.
>>[CHARSET-POLICY] says:
>>   Protocols MUST be able to use the UTF-8 charset, which consists of
>>   the ISO 10646 coded character set combined with the UTF-8 character
>>   encoding scheme, as defined in [10646] Annex R (published in
>>   Amendment 2), for all text.
>
>It would probably be appropriate to require applications to deal, though the truth is that CHARSET-POLICY already does that without our help.
>While we can impose requirements on SASL mechanisms, we really can't impose requirements on the authentication technologies upon which they are built.
> Requiring mechanisms to use UTF-8 might impose an impossible burden on the SASL mechansim designer, forcing them to do transformations between Unicode and some other character set.
>
>So, it is appropriate to REQUIRE that authorization identities (which are not really owned by the mechanism anyway) be encoded as UTF-8, and I think we should do so.  But it may not be appropriate for "other strings".