Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\))
From: Paul Hoffman <paul.hoffman@vpnc.org>
In-Reply-To: <alpine.LFD.2.10.1309101607020.4683@bofh.nohats.ca>
Date: Tue, 10 Sep 2013 17:16:51 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <01FC2C8C-984C-48A9-B7C3-1A1C1469E084@vpnc.org>
References: <alpine.LFD.2.10.1309091040120.14065@bofh.nohats.ca>
 <8A7BC0FC-62F8-4883-8FDD-948AAF9DAB78@vpnc.org>
 <alpine.LFD.2.10.1309101607020.4683@bofh.nohats.ca>
To: Paul Wouters <paul@cypherpunks.ca>
Cc: dane WG list <dane@ietf.org>
Subject: Re: [dane] case sensitivity and draft-ietf-dane-smime /
 draft-wouters-dane-openpgp
Precedence: list

On Sep 10, 2013, at 4:09 PM, Paul Wouters <paul@cypherpunks.ca> wrote:

> On Tue, 10 Sep 2013, Paul Hoffman wrote:
>=20
>> On Sep 9, 2013, at 10:52 AM, Paul Wouters <paul@cypherpunks.ca> =
wrote:
>>=20
>>> It was brought to my attention by Matthias Wimmer that we overlooked
>>> an important issue with respect to the base32 generation of the =
base32
>>> encoded left hand side of the email address.
>>=20
>> "We" did not overlook that: as author, I made that decision =
completely purposefully.
>=20
> Perhaps documentation of that decision belonged in the Security =
Section
> of that document? :)

I'm not clear what the security consideration of this is for DANE =
outside of what it is for all RFC 821(+bis)(+bis)(+bis) email has been.

>>> Mail servers and mail clients do not treat email addresses as
>>> case-insensitive.
>>=20
>> That is sometimes-true statement.
>>=20
>>> When encoding an LHS with base32, the case matters.
>>=20
>> Yes, exactly. And so does internationalization.
>>=20
>>> Using the wrong case will cause you to not find the SMIMEA / =
OPENPGPKEY
>>> record.
>>=20
>> Yep. And will cause you to sometimes send mail to the wrong =
recipient.
>=20
> I'm really not okay with a protocol where I encrypt to the wrong key
> based on the case of the email address.

Errr, then maybe you should not send mail with PGP or S/MIME? Seriously: =
this issue precedes DANE by well over a decade.

>>> We should probably add a section explaining this, and perhaps =
suggest to
>>> lowercase before base32'ing the LHS for the lookup.
>>=20
>> Yes; no.
>    [citation needed]

We should add a note that case is preserved and that might be =
surprising; we should not suggest breaking RFC 821(+bis)(+bis)(+bis) in =
this protocol.

--Paul Hoffman=