UTF8String Deployment Status and Migration Plan Akira KANAOKA Challenge PKI Project Japan Network Security Association Sponsored by IT Promotion Agency, Japan

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 2 Agenda Problem statement Project : Survey of UTF8String Problem in PKI Certificates UTF8String Deployment Status in Asia Ongoing Works –Migration plan for UTF8String –Test case design for UTF8String implementation

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 3 Problem statement Deadline for migration in RFC 3280 –31 st Dec –Canceled in 3280bis Lack of description to migrate in –Detailed string matching –Migration Plan –Certificate and CRL/ARL issuance during migration Gap between CA and client implementation

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 4 The sequence of events IETF : 58 th meeting (Nov. 2003) –Addressed to solve UTF8String issue at PKIX. Attention from IPA (Dec. 2003) –“On UTF8String problem of RFC 3280” 60 th,61 st meeting (Jul., Nov. 2004) –stringmatch I-D IPA* Project (Sep. 2004) –Survey of UTF8String Problem in PKI Certificates *IPA : IT Promotion Agency, Japan –Report submit to IPA (Feb. 2005) 3280bis (Feb. 2005)

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 5 Survey of UTF8String Problem in PKI Certificates Explanation of the problem Proposal for UTF8String migration Survey –Product implementation –UTF8String deployment status in Asia –IETF activity around UTF8String –Test case design for UTF8String implementation Migration Plan for UTF8String

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 6 UTF8String Deployment Status in Asia Examined whether they use UTF8String for directoryName in certificates Examined whether they use local characters in UTF8String –Local character : e.g. CJK (Chinese, Japanese, Korean) Asked by the prepared questionnaire Asked to “the Asia PKI Forum (APKI-F)” members. –9 Countries and Regions

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 7 Countries and Regions Replies to the Questionnaire Sent to 9 countries and regions Replies from 3 countries and regions (11 CAs) CA Type

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 8 CA Type Description “Government CA” –CA built by the Government for public service “Accredited CA” –CA built by the private sector, and accredited or licensed by legal proceeding “Commercial CA” –CA built by the private sector, and used for a public/closed PKI (Non-governmental).

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 9 Encoding Used in Each Field CA1CA2CA3CA4CA5CA6CA7CA8CA9CA10CA11 issuer UPUUUUUUUUP subject UUUUUUUUUUP issuerAltName U-UU subjectAltName IU-IIIIU-UU subjectDirectoryAttribute ---PUU, PP---- nameConstraints --U cRLDistributionPoints U,IIIIIIIUUUI authorityInfoAccess --IIIII---- other standard extensions U-UI, B other private extensions issuingDistributionPoint U,II-----UP-- CertificateIssuer other CRL extensions CCS JIS X 0208 CNS CNS CNS CNS CNS JIS X 0208 JIS X 0208 Unkn own *U:UTF8String (except country. P:PrintableString, I:IA5String, B:BMPString -:not used *CRLDP/iDP: use directoryName with U or P and URI with I to describe distributionPoint :local character used )

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 10 Encoding Use in Each Field (cont.) Most CAs already use UTF8String. Most CAs use local character. *U:UTF8String (except country. P:PrintableString, I:IA5String, B:BMPString -:not used *CRLDP/iDP: use directoryName with U or P and URI with I to describe distributionPoint :local character used ) CA1CA2CA3CA4CA5CA6CA7CA8CA9CA10CA11 issuerUPUUUUUUUUP subjectUUUUUUUUUUP issuerAltName U-UU subjectAltNameIU-IIIIU-UU

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 11 Compliance with RFC 3280 and its Migration Plan

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 12 Additional Survey UTF8String use in MS Windows Root Certificate Store –OS:Windows XP (Japanese) –as of January 2005 No certificate use UTF8String. –107 certificates in the certificate store –No certificate issued after 31 st Dec Date of Issue# After 31 st Dec

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 13 Conclusion : UTF8String Deployment Status in Asia Contrast between Government CAs and Commercial CAs Most Government CAs use UTF8String (by Questionnaire) No Commercial CA use UTF8String (by MS Windows Certificate Stores) –Asian Government CAs hope to use local character. Most governments use local character for register information.

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 14 Conclusion (cont.) : UTF8String Deployment Status in Asia Few CA has a Migration Plan to UTF8String –Most Government CAs use UTF8String from the beginning. –There is only one case having a migration plan. Deadline of the case : November, 2005 Best Practice for using/migration to UTF8String is needed. –We don’t have any guideline.

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 15 Ongoing Project Migration Plan –CA certificate Re-issue or re-build –CRL encoding after migration of CA certs ‘Keeping legacy encoding’ or ‘Using UTF8String’ –Need to publish this as informational RFC? Test Case Designing –Typical case of: path building (‘different encoding’ and ‘comparison rules’) Revocation checking –Providing the Test data of: Sample Certificate and CRL –Available by the end of this month on our web site

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 16 Reference JNSA Challenge PKI Project – RFC Preparation of Internationalized Strings ("stringprep") – 3280bis – pkix-rfc3280bis-00.txthttp://csrc.nist.gov/pki/documents/PKIX/draft-ietf- pkix-rfc3280bis-00.txt

6-11 March 2005 UTF8String Deployment Statement and Migration Plan 17 Appendix : Questionnaire outline Certificate and CRL/ARL –Kind of local character (e.g. CJK) –Kind of encoding for directoryName –Kind of CCS –Difference between CA self-signed certificate and EE certificate Migration Plan to UTF8String –Plan existence –Migration deadline, reason –Migration reference existence