[idn] IDN character repertoire, nameprep

["Adam M. Costello" <amc@cs.berkeley.edu>]

It has occurred to me that nameprep is currently moving two distinct
tasks from the DNS servers to the applications, when perhaps only one of
those tasks should move.  The two tasks are:

 1) Finding equivalences, for example, ABC.com == abc.com.
 2) Prohibiting some names, like a+b.com.

Currently, most applications do neither.  For example, ping is happy
to send all three of those names, exactly as shown, to the DNS server.
The DNS server performs canonicalization on each lookup, and performs
prohibition when it loads the zone file.

Both tasks become more expensive for IDNs.  Since canonicalization must
be done on each query, it makes sense to move it to the application.
But since prohibition is done rarely, I think it should remain the
job of the DNS server.  That way, if more characters are added to the
allowed set, it is not necessary to upgrade applications, but only to
upgrade the DNS servers, and it's only the servers for domains that
wish to register names containing the new characters that need to be
upgraded.

With this model, a conservative set of allowed characters could
initially be specified, because it would not be costly to allow more
characters later.

AMC