Subject: [abfab] escaping in ABFAB names

From: Sam Hartman <[email-masked]>
Date: Wed, 18 Jul 2012 16:18:44 -0400

Hi.  One of the comments from the secdir review is that we have no way
to escape a slash or @ inside an ABFAB name.  For reference, Kerberos
does have such a mechanism.

I think we at least discussed this in a meeting.

It's much easier to add an escaping mechanism now if we're going to need
it.

I can't think of a reason you'd need such an escaping mechanism in
practice except:

1) To represent Kerberos enterprise names in ABFAB. I cannot think of
why you'd need to do that.

2) To represent pathalogical hostnames or Kerberos names in ABFAB. I
cannot think of why you'd need to do that.

I think that when this was discussed in a meeting people expressed a
preference for simplicity over escaping.  Personally I'm a bit nervous
that we may regret this decision no matter which way we decide.

--Sam

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 18 Jul 2012 16:19:06 -0700

The other place that you might need escaping would be in the service
specifics.   A somewhat contrived example

Ietf//pretend=[email-masked]@augustcellars.com

I don't know if this is even reasonable, but I can see potentially wanting
the characters there.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Sam Hartman
> Sent: Wednesday, July 18, 2012 1:19 PM
> To: [email-masked]
> Subject: [abfab] escaping in ABFAB names
> 
> 
> Hi.  One of the comments from the secdir review is that we have no way to
> escape a slash or @ inside an ABFAB name.  For reference, Kerberos does
> have such a mechanism.
> 
it.
> I can't think of a reason you'd need such an escaping mechanism in
practice
> except:
> 
> 1) To represent Kerberos enterprise names in ABFAB. I cannot think of why
> you'd need to do that.
> 
that we
> may regret this decision no matter which way we decide.
> 
> --Sam
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Thu, 19 Jul 2012 07:19:09 +0000

On Jul 18, 2012, at 10:18 PM, Sam Hartman wrote:

Hi Sam,

I can not recall having discussed this explicitly in a meeting, but that does't mean it didn't happen, it may be that I am just getting old ;-)

Is there a compelling reason NOT to add an escaping mechanism apart from simplicity? It does not seem to add that much complexity….

Klaas

---

From: Sam Hartman <[email-masked]>
Date: Thu, 19 Jul 2012 06:09:46 -0400

>>>>> "Klaas" == Klaas Wierenga (kwiereng) <[email-masked]> writes:

    Klaas> On Jul 18, 2012, at 10:18 PM, Sam Hartman wrote:

    Klaas> Hi Sam,

    Klaas> I can not recall having discussed this explicitly in a
    Klaas> meeting, but that does't mean it didn't happen, it may be
    Klaas> that I am just getting old ;-)

I'm thinking that if it were discussed it was a couple of comments at
 the mic.
So, it was not discussed as much as I thought it had been in my initial
 response to the secdir comments.

my preference is to treat this as something we did not seriously
consider and should seriously consider prior to approval.

    Klaas> Is there a compelling reason NOT to add an escaping mechanism apart from simplicity? It does not seem to add that much complexity….

    Klaas> Klaas

I can't think of one.

I'll note that adopting the krb5 escaping mechanism will be kind of
convenient for the Moonshot implementation as we seem to implement it
already and it's more convenient than removing the code.

If we are going to do an escaping mechanism I'd appreciate it if someone
could help me with the ABNF.

--Sam

---

From: "Klaas Wierenga (kwiereng)" <[email-masked]>
Date: Thu, 19 Jul 2012 12:23:28 +0000

Hi,

> consider and should seriously consider prior to approval.

I agree

>    Klaas> Is there a compelling reason NOT to add an escaping mechanism apart from simplicity? It does not seem to add that much complexity..
> 
>    Klaas> Klaas
> 
> I can't think of one.
> 

sure

Klaas