Re: [idn] stringprep comment 6: casefold and then noramlization is not enough

[David Hopwood <david.hopwood@zetnet.co.uk>]

-----BEGIN PGP SIGNED MESSAGE-----

Soobok Lee wrote:
> As I and David Hopwood suggested in the list,
> 
>   NFC(casefold(x)) or NFKC(casefold(x)) are not correct for <I dot above>
> and <I><dot above>.

I suggest that the detail of this should be discussed on the
unicode@unicode.org list.

Suffice it to say that it would be irresponsible to proceed with publication
of the stringprep or nameprep draft just yet. I intend to propose a
replacement for stringprep/nameprep that is simpler, more efficient, and
that takes account of all the comments that have been made (including
Hangul normalisation, BiDi, and spoofing, but excluding TC/SC).

> The steps for preparing strings are:
> 
> 1) Map -- For each character in the input, check if it has a mapping
> and, if so, replace it with its mapping. This is described in Section 4.
> 
> 2) Normalize -- Possibly normalize the result of step 1 using Unicode
> normalization. This is described in Section 5.
> 
> 3) Look for prohibited output -- Check for any characters that are not
> allowed in the output. If any are found, return an error. This is
> described in Section 6.
> 
> The above steps MUST be performed in the order given to comply with this
> specification."
> 
> Please suggest a proof that this last enforcement is necessary and sufficient.
> 
> I suggest the last "MUST" be changed to "MAY".

That would make the problem worse.

- -- 
David Hopwood <david.hopwood@zetnet.co.uk>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBPGjdHTkCAxeYt5gVAQGZYAgAgqrqFmiuTM2USjJjXftsZp0OaaZcQ9u3
/zhL726xNoOCdBrdt416WRt9tpLlvbVHQfHWceSdC7fukmaA+fHJZYxSzD5ZE3B7
Aw/fZwjoMAfjVCmTJXwq/++4HNdfr6sNgNJTM/ekJj+jDhIMmFqQ/bTqgts1d5Z0
XrkMco+yxqN0sJbol+goRZDknZNvE2xF0KUl6IAACHxnYwKttdXTWRf2KCEU4p4n
Gb/pZDBjUWdrYs7U77YhivpmJgQVMjYHHJGCmnM8DNfYah8Kab1wy2y94hwM/yo7
pwAwZIqQWj08v2odJK64tibO6ilzv7YcQ9qEcfgr474qUY/VEguH1w==
=qUyj
-----END PGP SIGNATURE-----