Re: [idn] impacted systems investigation

[tale@nominum.com (David C Lawrence)]

Mark Andrews said:
> UTF8 does not require a server upgrade

D. J. Bernstein answered:
> Right. But Patrik and Paul claim the opposite. This claim is, in fact,
> the centerpiece of the IDNA ``design philosophy.''

Not so.  We all know the servers can handle 8 bit domain names.  What
the servers can't tell, however, is whether some 8 bit string is UTF-8
or some local encoding, and that presents a security problem.  To use
UTF-8 at the server, the protocol would need to be updated so that a
client could affirmatively declare, "I'm IDN-aware, and thus my
request is using UTF-8, not some other local encoding."