RE: [TLS] Review of draft-housley-tls-authz-extns-05

Scott Hollenbeck wrote:

> Section 5.1 of RFC 3470/BCP 70 includes relevant text.  In a
> nutshell, UTF-8 is a MUST if you're using XML.  UTF-16 is
> recommended since you get it for free with XML parsers, but it's not
> required.  An XML declaration is not needed if you're using either
> UTF-8 or UTF-16.  A byte order mark is required with UTF-16.  Other
> encodings are possible, but if something else is used it must be
> identified with an appropriate XML declaration.

Thanks for the pointer; it looks like Section 4.1 of the document 
is also relevant:

   In some uses of XML as an embedded protocol element, the XML used
   is a small fragment in a larger context, where the XML version is
   fixed at "1.0" and the character encoding is known to be "UTF-8".
   In those cases, an XML declaration might add extra overhead.  In
   cases where the XML is a larger component which may find its way
   alone as an external entity body (transported as a MIME message,
   for example), the XML declaration is an important marker and is
   useful for reliability and extensibility.  The XML declaration is
   also an important marker for character set/encoding (see Section
   5.1), if any encoding other than UTF-8 or UTF-16 is used.  Note
   that in the case of UTF-16, XML requires that the entity starts
   with a Byte Order Mark (BOM), which is not part of the character
   data.  Note that the XML Declaration itself is not part of the XML
   document's Information Set.

   Protocol specifications must be clear about use of XML
   declarations.  XML [8] notes that "XML documents should begin with
   an XML declaration which specifies the version of XML being used."
   In general, an XML declaration should be encouraged ("SHOULD be
   present") and must always be allowed ("MAY be sent").  An XML
   declaration should be required in cases where, if allowed, the
   character encoding is anything other than UTF-8 or UTF-16.  

Since the latter paragraph says that XML declaration must always be
allowed, the simplest approach would be to always require it here.
In other words, draft-housley-tls-authz-extns should say something
like this, right?

   "When SAMLAssertion is used, the field contains an XML text
   declaration, followed by an <Assertion> element using the
   AssertionType complex type as defined in [SAML1.1][SAML2.0]. 
   The field MUST also follow the rules of [XML] for including
   the Byte Order Mark (BOM) in encoded entities."

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls