The IESG has approved the following document: - 'Update to DirectoryString Processing in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile ' <draft-ietf-pkix-cert-utf8-03.txt> as a Proposed Standard This document is the product of the Public-Key Infrastructure (X.509) Working Group. The IESG contact person is Sam Hartman. A URL of this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-pkix-cert-utf8-03.txt Technical Summary This document updates the handling of DirectoryString in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, which is published in RFC 3280. This update to RFC 3280 aligns support for international character sets with recent implementation and deployment experience, and the direction of the IETF PKIX Working Group. This specification establishes UTF8String and PrintableString as the preferred encodings. UTF8String provides support for international character sets, and PrintableString preserves support for the vast bulk of the certificates that have already been deployed. Working Group Summary The WG has a strong consensus behind this document. Protocol Quality This specification aligns RFC 3280 with current implementations, reflecting the international PKI community's deployment experience. This specification has been reviewed by Sam Hartman for the IESG. Note to RFC Editor Please revise the first sentence in the replacement text in Section 5. OLD: | When the subjectAltName extension contains a DN in the directoryName, | the same encoding preference as in 4.1.2.4. NEW: | When the subjectAltName extension contains a DN in the directoryName, | the encoding preference is defined in 4.1.2.4. In section 6: OLD: The replacement text is much clearer. The direction is much less prone to implementation error. Also, the use of consistent encoding for name components will ensure that name constraints work as expected. NEW: The use of consistent encoding for name components will ensure that name constraints specified in [PKIX1] work as expected. When strings are mapped from internal representations to visual representations, sometimes two different strings will have the same or similar visual represe ntations. This can happen for many different reasons, including use of similar glyphs and use of composed characters (such as e + ' equaling U+00E9, the Korean composed characters, and vowels above consonant clusters in certain language s). As a result of this situation, people doing visual comparisons between two different names may think they are the same when in fact they are not. Also , people may mistake one string for another. Issuers of certificates and rely ing parties both need to be aware of this situation. _______________________________________________ IETF-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce
