Re: UTF8

[Sam Hartman <hartmans-ietf%mit.edu@localhost>]

>>>>> "der" == der Mouse <mouse%Rodents.Montreal.QC.CA@localhost> writes:

    >>> All the same UTF-8 issues I've raised repeatedly,
    >> My requirement as an IESG member is that it be possible to have
    >> a properly internationalized ssh.  Among other things that
    >> means the characters in usernames and passwords need to belong
    >> to some character set.

    der> Why?  Perhaps this is the fundamental part I'm missing.  What
    der> does "properly internationalized" mean - or perhaps more
    der> precisely, what is there about being "properly
    der> internationalized" that demands that usernames, passwords,
    der> and filenames consist of character sequences rather than
    der> octet sequences?

I'd appreciate replies off-list as I believe we are outside of the
scope of this working group.

Humans use our software.  They typically enter characters using an
input method  for items such as usernames, passwords and
filenames.

One input method that is relatively common is a keyboard that maps
keycodes to characters.  This method tends to be mostly OK even if you
assume it produces octets not charactares.

Other input methods produce different octet sequences for semantically
similar content.  I gave an example of combining accents vs single
characters in the message introducing this thread.  So, the set of
octets produced depends not so much on what the user does, what keys
they press, or even what is displayed on their screen; it depends on
implementation details of the input method the user's OS happens to
use.  The user does not typically have enough control (and almost
certainly has insufficient knowledge) to end up with the other octet
sequences that are the same semantic content.

So, if we treat passwords as octet-strings then whether the user can
type their username or password will depend on what input method they
are using.  They may not even have control over this.

We, the IETF, e have decided for the most part that interoperability
requires that things work independent of what input method is used.