Subject: OpenPGP and IDNA/IMAA

From: Marc Mutz <[email-masked]>
Date: Tue, 28 Oct 2003 17:07:59 +0100

Hi!

After getting IDNA (internationalized domain names in applications) out 
as RFCs, people are now looking at the local-part of email addresses.

How is the relevant to the OpenPGP spec?

OpenPGP UIDs are essentially free-form, but with the
  Name (Comment) <mail@address>
convention for interop.

The whole string is in utf-8. This opens up two possible ways to encode 
a IDN (or an internationalized email address later) in the UID:

1. In ACE form (ASCII compatible encoding)
2. In UTF-8

The ACE form (obtained from the Unicode form by IDNA's ToAscii 
transformtion) would look a bit silly given that the slot is 
Unicode-aware, but it would work out of the box if you enter it in 
encoded form.

The UTF-8 form might or might not work, depending on whether the 
software used to create the key would validate the address according to 
rfc 2822 or 2821 or simply encode the whole thing in UTF-8.

In any case, I think that rfc 2440bis as an IETF protocol that uses 
UTF-8 needs to include at least a stringprep profile to use. I'm no 
IETF expert, though, and it may suffice to reuse whatever comes out of 
IMAA, but that's still at least half a year away.

If nothing is said and it's accepted as such, then the slot is 
automatically an IDNA-unaware one, to be filled with the ACE form.

Some pointers:
3454 Preparation of Internationalized Strings ("stringprep"). P.
     Hoffman, M. Blanchet. December 2002. (Format: TXT=138684 bytes)
     (Status: PROPOSED STANDARD)

3490 Internationalizing Domain Names in Applications (IDNA). P.
     Faltstrom, P. Hoffman, A. Costello. March 2003. (Format: TXT=51943
     bytes) (Status: PROPOSED STANDARD)

3491 Nameprep: A Stringprep Profile for Internationalized Domain Names
     (IDN). P. Hoffman, M. Blanchet. March 2003. (Format: TXT=10316 
bytes)
     (Status: PROPOSED STANDARD)

3492 Punycode: A Bootstring encoding of Unicode for Internationalized
     Domain Names in Applications (IDNA). A. Costello. March 2003.
     (Format: TXT=67439 bytes) (Status: PROPOSED STANDARD)

And discussions on [email-masked] and [email-masked].

Marc

-- 
It has become fashionable in the post Cold War world to label
opponents as terrorists [...]. By doing so, the authorities instill
within society a culture of fear, leading people to accept that their
rights (and the rights of others) be trampled on for the sake of the
common good. In other words, it justifies the loss of privacy and a
state of surveillance they would otherwise not accept. Both communism
and fascism were examples of this technique used to perfection.
                  -- John Horvath: The Internet: A Terrorist Network?
                     Telepolis 2001/08/22 (#9350)

---

From: Ian Grigg <[email-masked]>
Date: Wed, 29 Oct 2003 00:35:45 -0500

Marc Mutz wrote:
...
> OpenPGP UIDs are essentially free-form,

Yes, this is one of the advantages of OpenPGP
over other PKI contenders.  It says nothing
about how the UserIds are handled.  Which means
we are free to design the contents to suit our
requirements.

It's certainly a key benefit for my company's
use.  You can't pay enough money to get that
sort of design feature!

> but with the
...
> automatically an IDNA-unaware one, to be filled with the ACE form.

I think the key word here is _convention_.  If
there was a desire to document that and other
conventions more clearly, than an adjunct
informational track RFC may be a better bet
than putting it into the base RFC.

That way, applications could be aware of the
convention, but can happily know that any other
form is also quite acceptable.

iang