Re: [dane] I-D Action: draft-ietf-dane-smime-04.txt

Paul Hoffman <paul.hoffman@vpnc.org> Fri, 10 January 2014 16:23 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E78B1AE0D7 for <dane@ietfa.amsl.com>; Fri, 10 Jan 2014 08:23:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.347
X-Spam-Level:
X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UHBrOqKVSdFO for <dane@ietfa.amsl.com>; Fri, 10 Jan 2014 08:23:31 -0800 (PST)
Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id 1CE471AE0D6 for <dane@ietf.org>; Fri, 10 Jan 2014 08:23:31 -0800 (PST)
Received: from [10.20.30.90] (50-1-51-230.dsl.dynamic.fusionbroadband.com [50.1.51.230]) (authenticated bits=0) by hoffman.proper.com (8.14.7/8.14.7) with ESMTP id s0AG3Li4095701 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Fri, 10 Jan 2014 09:03:23 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
X-Authentication-Warning: hoffman.proper.com: Host 50-1-51-230.dsl.dynamic.fusionbroadband.com [50.1.51.230] claimed to be [10.20.30.90]
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <20140110035933.31003CADEAB@rock.dv.isc.org>
Date: Fri, 10 Jan 2014 08:23:18 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <65157350-8CCE-43D0-B8AC-163A2149F43D@vpnc.org>
References: <89AE05E1-BC6C-46BA-A4CC-A8F29070096D@vpnc.org> <CEF43EFD.F8FB%bdickson@verisign.com> <20140109173943.GL2317@mournblade.imrryr.org> <m37ga9kkfs.fsf@carbon.jhcloos.org> <20140109205604.GM2317@mournblade.imrryr.org> <alpine.LFD.2.10.1401091922410.5593@bofh.nohats.ca> <20140110004954.GQ2317@mournblade.imrryr.org> <m3zjn4k2zu.fsf@carbon.jhcloos.org> <20140110021746.GR2317@mournblade.imrryr.org> <F7F692F4-97A6-4F2B-BD0D-700CB7520E67@vpnc.org> <20140110035933.31003CADEAB@rock.dv.isc.org>
To: Mark Andrews <marka@isc.org>
X-Mailer: Apple Mail (2.1827)
Cc: "dane@ietf.org list" <dane@ietf.org>
Subject: Re: [dane] I-D Action: draft-ietf-dane-smime-04.txt
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Jan 2014 16:23:33 -0000

On Jan 9, 2014, at 7:59 PM, Mark Andrews <marka@isc.org> wrote:

> 
> In message <F7F692F4-97A6-4F2B-BD0D-700CB7520E67@vpnc.org>rg>, Paul Hoffman writes
> :
>> On Jan 9, 2014, at 6:17 PM, Viktor Dukhovni <viktor1dane@dukhovni.org> wrote:
>> 
>>> How does this bear on the encoding lookup key labels? Any encoding
>>> (e.g. base32, or HMAC-SHA-224, but not punycode) that does not map
>>> input strings that differ only in case to output strings that differ
>>> only in case offers no advantage over a 1-way hash function.
>>> 
>>> I am not sure what you're getting at.  Perhaps I'm missing something.
>> 
>> The person looking up someone's S/MIME or PGP cert either knows how the LHS i
>> s spelled (including exact case, and character encoding) or they don't. This 
>> issue is for a layer that is not ours.
> 
> So a user has my address as "MARKA@ISC.ORG" (this is not made up,
> some companies have it saved as that despite the fact that I entered
> it in lowercase).  Is the MUA supposed to lowercase "MARKA" or not
> before looking for a SMIME key?

Again: this is an issue is for a layer that is not ours. The question is identical to whether or not your SMTP server will or will not accept both "marka" and "MARKA".

>> From my perspective there isn't a hard and fast answer to that.
> 
> We could publish rules, in the DNS, for the MUA to use so that it
> doesn't have to guess.

We could. And the SMTP folks could do the same. Or we could finish this work in the next five years.

--Paul Hoffman