Internationalized Domain Names for Applications 2008 (IDNA2008) and Unicode 12.0.0
Extracted elements (19)
IDNA follows a progressive subsetting model: Unicode defines the maximum set of code points, IDNA2008 creates a subset via PVALID/CONTEXT derived property values, and DNS registries create further subsets. SAC-084 and RFC 6912 recommend DNS registries use conservative, inclusion-based subsetting.
No BackwardCompatible exception rule (per RFC 5892, Section 2.7) was added for U+111C9 SHARADA SANDHI MARK when it changed from DISALLOWED to PVALID. Adding an exception would require implementation changes to IDNA2008 deployments; allowing the property value change ensures all sandhi marks are treated equally.
No exception was added for U+08A1 ARABIC LETTER BEH WITH HAMZA ABOVE despite IAB concerns, because the combining-sequence ambiguity issue is not unique to this code point and affects a number of long-standing PVALID code points. A special exception was not warranted given the broader nature of the problem.
RFC 8753 was published to clarify the review process for new Unicode versions, specifically to capture combining-sequence issues like those found with U+08A1. All reviews of Unicode versions after 12.0.0 must follow the process in RFC 8753.
This document adds no exception rules to IDNA2008 for any Unicode changes between 6.0.0 and 12.0.0. The IETF concluded that the derived property value changes identified do not require exceptions as defined in RFC 5892, Section 2.6, given deployment considerations.
Multiple incompatible IDNA strategies are deployed: pure IDNA2003 (tied to Unicode 3.2), various updated IDNA2003 variants, IDNA2003/2008 hybrids for post-3.2 code points, UTS#46 mixes, and pure IDNA2008. Applications implementing different profiles may not interoperate.
Some implementations apply the IDNA2008 algorithm to whatever Unicode version is present in their operating system or libraries, independently of the IANA database. This can cause divergence between what labels are accepted and what the IANA tables reflect.
U+111C9 SHARADA SANDHI MARK changed from DISALLOWED to PVALID in Unicode 11.0.0 and no BackwardCompatible exception was added. Labels containing this code point may be rejected by software based on Unicode versions older than 12.0.0.
UTS#46 specifies multiple profiles, so two applications both claiming UTS#46 conformance may not interoperate well with each other or with conforming IDNA2008 implementations.
Between Unicode 10.0.0 and 11.0.0, one existing code point changed derived property value: U+111C9 SHARADA SANDHI MARK changed from DISALLOWED to PVALID because its General Category changed from Po (Other_Punctuation) to Mn (Nonspacing_Mark) and its Bidi property changed from L to NSM.
Between Unicode 11.0.0 and 12.0.0, no existing code points changed derived property value. PVALID grew from 122734 to 123006 (+272), DISALLOWED from 154260 to 154542 (+282), and CONTEXTJ/CONTEXTO remained at 2 and 25.
Between Unicode 6.0.0 and 7.0.0, PVALID code points increased from 97418 to 99867 (+2449) and DISALLOWED from 151586 to 152709 (+1123); CONTEXTJ and CONTEXTO counts remained unchanged at 2 and 25 respectively. No existing code points changed derived property value.
Between Unicode 7.0.0 and 10.0.0, no existing code points changed derived property value. PVALID grew from 99867 to 122411 (+22544) and DISALLOWED from 152709 to 153899 (+1190), entirely from newly assigned code points transitioning from UNASSIGNED.
Georgian letters in ranges U+10D0..U+10FA and U+10FD..U+10FF had their General Category changed from Lo to Ll in Unicode 11.0.0 to reflect new case pairs, but their IDNA2008 derived property value remained PVALID. Newly encoded Mtavruli uppercase letters (General Category Lu) are DISALLOWED.
IDNA2008 defines four derived property values for Unicode code points: PVALID (allowed in IDNs), CONTEXTUAL RULE REQUIRED (subdivided into CONTEXTJ and CONTEXTO, allowed only in specific contexts), DISALLOWED (not permitted in IDNs), and UNASSIGNED (not yet assigned in Unicode).
U+08A1 ARABIC LETTER BEH WITH HAMZA ABOVE was introduced in Unicode 7.0.0 and assigned PVALID. It can be represented as the combining sequence U+0628 (ARABIC LETTER BEH) + U+0654 (ARABIC HAMZA ABOVE), analogous to U+00F8 which can be represented as U+006F + U+0337.
IANA updated the 'IDNA Rules and Derived Property Values' registry (https://www.iana.org/assignments/idna-tables-12.0.0/) to reflect Unicode 12.0.0 after an expert reviewer validated that derived property values were calculated correctly.
Not following IDNA2008 recommendations can lead to various security issues. Specifically, allowing confusable characters may lead to phishing attacks, as described in the Security Considerations sections of the IDNA2008 document set (RFC 5890–5894).
The combining-sequence ambiguity identified for U+08A1 (representable as both a precomposed character and a combining sequence yielding visually identical output) affects a number of long-standing PVALID code points. The full scope of affected code points is not understood, and affected code points remain PVALID.