From stpeter@stpeter.im Tue Sep 6 13:28:52 2011 Return-Path: X-Original-To: precis@ietfa.amsl.com Delivered-To: precis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58BFD21F8E8C for ; Tue, 6 Sep 2011 13:28:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.585 X-Spam-Level: X-Spam-Status: No, score=-102.585 tagged_above=-999 required=5 tests=[AWL=0.014, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFavQSzWFr4U for ; Tue, 6 Sep 2011 13:28:51 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id C4A0A21F8E78 for ; Tue, 6 Sep 2011 13:28:51 -0700 (PDT) Received: from dhcp-64-101-72-178.cisco.com (unknown [64.101.72.178]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 703DA418BB for ; Tue, 6 Sep 2011 14:33:33 -0600 (MDT) Message-ID: <4E6682EE.8020303@stpeter.im> Date: Tue, 06 Sep 2011 14:30:38 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:6.0.1) Gecko/20110830 Thunderbird/6.0.1 MIME-Version: 1.0 To: precis@ietf.org References: <4E6682A9.5030002@stpeter.im> In-Reply-To: <4E6682A9.5030002@stpeter.im> X-Enigmail-Version: 1.3.1 OpenPGP: url=https://stpeter.im/stpeter.asc X-Forwarded-Message-Id: <4E6682A9.5030002@stpeter.im> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [precis] Fwd: [saag] internationalized passwords X-BeenThere: precis@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Preparation and Comparison of Internationalized Strings List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Sep 2011 20:28:52 -0000 FYI. Please join the saag@ietf.org list if you'd like to follow the discussion. I'll report back to the PRECIS WG regarding any conclusions that emerge from the SAAG discussion. -------- Original Message -------- Subject: [saag] internationalized passwords Date: Tue, 06 Sep 2011 14:29:29 -0600 From: Peter Saint-Andre To: IETF Security Area Advisory Group During a discussion related to SASLprep (RFC 4013) on the KITTEN WG list, Nico Williams pointed out that during standardization of the SCRAM SASL mechanism there would not have been consensus to say that passwords must be ASCII (and therefore must not contain Unicode code points outside the traditional ASCII-7 range): http://www.ietf.org/mail-archive/web/kitten/current/msg02741.html This issue has also come up in the PRECIS WG, which is working on a generic replacement for stringprep and therefore will (we hope) provide a framework that can be used to replace SASLprep as the recommended way to prepare and compare Unicode code points in passwords. In particular, see Sections 3.2 and 10.4 of draft-ietf-precis-framework-00, which define and provide some security considerations regarding a string class we're calling the "SecretClass": http://tools.ietf.org/html/draft-ietf-precis-framework-00#section-3.2 http://tools.ietf.org/html/draft-ietf-precis-framework-00#section-10.4 As document editor of draft-ietf-precis-framework, I would appreciate feedback from folks in the Security Area about the proposed "SecretClass". I will forward this message to the PRECIS WG and ask participants in that WG to pay attention on the SAAG list if they're interested in the discussion. Peter -- Peter Saint-Andre https://stpeter.im/ _______________________________________________ saag mailing list saag@ietf.org https://www.ietf.org/mailman/listinfo/saag From jmabdp@gmail.com Sun Sep 25 07:04:04 2011 Return-Path: X-Original-To: precis@ietfa.amsl.com Delivered-To: precis@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A42A221F8BA9; Sun, 25 Sep 2011 07:04:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.298 X-Spam-Level: X-Spam-Status: No, score=-2.298 tagged_above=-999 required=5 tests=[AWL=-1.300, BAYES_50=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y4hEtkOqurHf; Sun, 25 Sep 2011 07:04:04 -0700 (PDT) Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id 3C03C21F8B42; Sun, 25 Sep 2011 07:04:03 -0700 (PDT) Received: by wwf22 with SMTP id 22so3721545wwf.13 for ; Sun, 25 Sep 2011 07:06:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; bh=5thSj8tf/HOje9lMKvGcUKrU5u0vLnUEpKpsAAIAssk=; b=QwRvqbY69hXbFh+aTmKUuyYClL8Hwcoz2kh/CmKzceHnPIGKM17KfgrEkEFHTMXEFA x3DU7NP/+RGwdqgURcm20Lk48qvlMMCn0uK2x4ZNfRvjsTqOsKmEvCpqsjahjIvoogx+ EXtESCp3uGDGmApSmy7JWaOSlXZWcxzXULZNg= MIME-Version: 1.0 Received: by 10.227.7.27 with SMTP id b27mr4410175wbb.51.1316959602615; Sun, 25 Sep 2011 07:06:42 -0700 (PDT) Received: by 10.227.143.12 with HTTP; Sun, 25 Sep 2011 07:06:42 -0700 (PDT) Date: Sun, 25 Sep 2011 16:06:42 +0200 Message-ID: From: jean-michel bernier de portzamparc To: IETF Content-Type: multipart/alternative; boundary=002215b03ec64c277f04adc48df5 Cc: vip@icann.org, internet users contributing group , precis@ietf.org Subject: [precis] linguistic and cultural support X-BeenThere: precis@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Preparation and Comparison of Internationalized Strings List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Sep 2011 14:04:04 -0000 --002215b03ec64c277f04adc48df5 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Dear all, We, nicknamed "JEDI"s (Jefsey disciples), have often tried to make the IETF understand and respect the implications of linguistic, cultural, political, economical diversities on protocol definition. Jefsey obtained the RFC 4645= , 4646, 4647 consensus he wanted. We also obtained the IDNA2008 consensus which was necessary to warranty the internet stability, its capacity to support any diversity by subsidiarity, and the emergence of the IUI. We still have a problem with the IETF/Unicode relations, the WG/PRECIS, the IDNA IAB work, the ICANN/VIP work on variants, extension of the punycode algorithm to support French and and the orthotypography (scripting syntax) of most of the other languages, etc. May be this quote will help some of our colleagues to understand better why the IETF is to "influence those who design, use and manage the internet" fo= r it to offer users with a better multilinguistic support. =93We live in a global world,=94... =93We have to understand that world if we =85 are going to be able to not o= nly defend this country, but to extend our relationships to others so that we can work together to defend the world that we live in.=94 =93The reality is that we have to reflect the nation we live in and we have= to reflect the world we are a part of." =93Languages are the key to understanding that world.=94... "It=92s also cr= itical to the effectiveness of current U.S. military operations." ... "If we are going to advance stability in some of the countries we are fighting in today, we have to be able to understand what motivates those countries, what motivates their people, and to understand their culture, beliefs, faiths, ideologies, hatreds and loves". =93So it is crucial to our national security to be able to have a strong language ability=94. - Leon E. Panetta (8/23/2011). US Defense Secretary. Mr. Panetta speaks on behalf of the USA, but I believe that if his understanding may be late, it is also true for every other nation. Multilinguistics, as Jefsey defined it from our IETF experience, is the cybernetics of the linguistic diversity. How languages and cultures can be adequately be supported and result in positive synergetic feed backs. Its key recipe seems to be first based upon a true network linguistic neutrality. One does not need to have more than one language to be a multilingist, one just need to understand and/or research how to better support linguistic and cultural diversity. As Mr. Panetta stated, it is critical to stability and effectiveness in our global world. Portzamparc. --002215b03ec64c277f04adc48df5 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Dear all,
We, nicknamed "JEDI"s (Jefsey disciples), have often= tried to make the IETF understand and respect the implications of linguist= ic, cultural, political, economical diversities on protocol definition. Jef= sey obtained the RFC 4645, 4646, 4647 consensus he wanted.=A0 We also obtai= ned the IDNA2008 consensus which was necessary to warranty the internet sta= bility, its capacity to support any diversity by subsidiarity, and the emer= gence of the IUI. We still have a problem with the IETF/Unicode relations, = the WG/PRECIS, the IDNA IAB work, the ICANN/VIP work on variants, extension= of the punycode algorithm to support French and and the orthotypography (s= cripting syntax) of most of the other languages, etc.

May be this quote will help some of our colleagues to understand better= why the IETF is to "influence those who design, use and manage the in= ternet" for it to offer users with a better multilinguistic support.
=93We live in a global world,=94...
=93We have to understand that w= orld if we =85 are going to be able to not only defend this country, but to= extend our relationships to others so that we can work together to defend = the world that we live in.=94
=93The reality is that we have to reflect the nation we live in and we have= to reflect the world we are a part of."
=93Languages are the key = to understanding that world.=94... "It=92s also critical to the effect= iveness of current U.S. military operations." ...
"If we are going to advance stability in some of the countries we are = fighting in today, we have to be able to understand what motivates those co= untries, what motivates their people, and to understand their culture, beli= efs, faiths, ideologies, hatreds and loves".
=93So it is crucial to our national security to be able to have a strong la= nguage ability=94.

-=A0 Leon E. Panetta (8/23/2011). US Defense Secr= etary.

Mr. Panetta speaks on behalf of the USA, but I believe that i= f his understanding may be late, it is also true for every other nation.
Multilinguistics, as Jefsey defined it from our IETF experience, is the= cybernetics of the linguistic diversity. How languages and cultures can be= adequately be supported and result in positive synergetic feed backs. Its = key recipe seems to be first based upon a true network linguistic neutralit= y. One does not need to have more than one language to be a multilingist, o= ne just need to understand and/or research how to better support linguistic= and cultural diversity.

As Mr. Panetta stated, it is critical to stability and effectiveness in= our global world.
Portzamparc.
--002215b03ec64c277f04adc48df5--