Update to DirectoryString Processing in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
draft-ietf-pkix-cert-utf8-03

[Ballot comment]
The security consideration section seems very strange:

  The replacement text is much clearer.  The direction is much less
  prone to implementation error.  Also, the use of consistent encoding
  for name components will ensure that name constraints work as
  expected.

As a minimal it seems to be lacking a reference to the base line in RFC 3280 that it tries to change. But also the statement that this should be more secure is not really clear on what aspects and why.

I expect this to be fixed when taking care of the Discuss about the similar looking names.

[Ballot comment]
I am concerned about how the visual comparisons of names security problem will be solved. I would be supportive of text that pointed out the problem and did not try to provide a solution. I would change to a discuss if we put in text that required anyone to implement something that is a research problem.

[Ballot comment]
(actually picked up by David Black's Gen-ART review of the previous draft)

This sentence in section 5 lacks a verb:

|  When the subjectAltName extension contains a DN in the directoryName,
|  the same encoding preference as in 4.1.2.4.

[Ballot discuss]
A last call comment brought up the fact that spoofing of names has not
been documented as a security consideration either here or in 3280.

PROTO Write-up

1.a) The chairs have personally reviewed this version of the Internet Draft
(ID), and believe this ID is ready to forward to the IESG for publication. Tim
Polk is the WG Chair Shepherd for this document.

1.b) This document has been thoroughly reviewed by key WG members and key non-WG members. The technical content in this draft was first presented in draft-ietf-pkix-rfc3280bis-02.txt, so this information has undergone WG review for most of a year. I have no concerns about the depth or breadth of this review.

1.c) This document reflects the internationalization persepctive and
implementation experience gained from the publication of RFC 3280. I do not
believe additional review is needed.

1.d) I have no specific concerns/issues with this document.

1.e) WG consensus is solid with respective to this document. The content in
this document is widely understood and supported.

1.f) No one threatened an appeal or otherwise indicated extreme discontent.

1.g) The chairs verified that the document checks out against all the ID nits?
Two minor issues were detected; these issues were not judged sufficient to
preclude forwarding the document. The issues are:

There is a typographical error in the boilerplate "Status of this Memo". The
statement about referencing IDs ends with cite them other than a "work in progress." instead of cite them other than as "work in progress."

The IPR disclosure & notices were also omitted from this draft. Since the ID
Checklist states "If these notices are not present, then the RFC-Editor will add them" it was my interpretation that this ommission should not preclude
forwarding the document out of the Working Group.

1.h) This document includes only normative references. These references are
both to current RFCs.

1.i) Standards track publication is rfequested.

1.j)

Technical Summary

This document updates the handling of DirectoryString in the Internet X.509
Public Key Infrastructure Certificate and Certificate Revocation List (CRL)
Profile, which is published in RFC 3280. This update to RFC 3280 aligns support for international character sets with recent implementation and deployment experience, and the direction of the IETF PKIX Working Group. This
specification establishes UTF8String and PrintableString as the preferred
encodings. UTF8String provides support for international character sets, and
PrintableString preserves support for the vast bulk of the certificates that
have already been deployed.

Working Group Summary

The Working Group has extensively reviewed this technical content. The document entered Last Call on March 1. All last call issues were resolved with
publication of the current draft. Discussion during Last Call demonstarted
working group conensus. This document has strong WG support.

Protocol Quality

This specification aligns RFC 3280 with current implementations, reflecting the international PKI community's deployment experience.