Re: [dane] case sensitivity and draft-ietf-dane-smime / draft-wouters-dane-openpgp

["Dickson, Brian" <[e-mail]>]

Jumping in a bit late, but hopefully without having missed any of the fun.

The smime draft is silent on the whole MTA thing, probably because it
presumes that both processing received signed messages, and
sending/signing messages, is being done by the MUA.

As such, (finding the key and encrypting on its basis) is not a "protocol"
issue (case mismatch on input by the user), but an application thing.
Selecting the recipient through any UI interaction, rather than explicit
entry of the RFC 822-style address, is not a protocol issue.
If the UI and/or the user makes an error, that is not a protocol thing.

BTW - in case it isn't clear, my opinion of the inclusion of the letters
"M", "T", and "A" together in the PGP draft, is that it does not belong.
Encrypting contents falls clearly in the MUA space, and does NOT belong in
the MTA space.

DANE has excellent use cases in the MTA space, but only on use of TLS for
transport, not for message content.

That's my opinion, at least, and I'd be surprised if that doesn't reflect
consensus.

Brian

On 9/9/13 10:52 AM, "Paul Wouters" <[e-mail]> wrote:

>
>It was brought to my attention by Matthias Wimmer that we overlooked
>an important issue with respect to the base32 generation of the base32
>encoded left hand side of the email address.
>
>Mail servers and mail clients do not treat email addresses as
>case-insensitive. When encoding an LHS with base32, the case matters.
>Using the wrong case will cause you to not find the SMIMEA / OPENPGPKEY
>record.
>
>paul@bofh:$ python
>Python 2.7.3 (default, Aug  9 2012, 17:23:57)
>[GCC 4.7.1 20120720 (Red Hat 4.7.1-5)] on linux2
>Type "help", "copyright", "credits" or "license" for more information.
>>>> import base64
>>>> base64.b32encode("paul")
>'OBQXK3A='
>>>> base64.b32encode("Paul")
>'KBQXK3A='
>>>>
>
>We should probably add a section explaining this, and perhaps suggest to
>lowercase before base32'ing the LHS for the lookup.
>
>Paul
>_______________________________________________
>dane mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/dane