Re: Last Call: <draft-ietf-lamps-eai-addresses-05.txt> (Internationalized Email Addresses in X.509 certificates) to Proposed Standard

"Patrik Fältström " <paf@frobbit.se> Mon, 23 January 2017 21:50 UTC

Return-Path: <paf@frobbit.se>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 976F31298C5; Mon, 23 Jan 2017 13:50:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.8
X-Spam-Level:
X-Spam-Status: No, score=-5.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ORyWhC9Go3Yg; Mon, 23 Jan 2017 13:50:17 -0800 (PST)
Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A1AF1298C3; Mon, 23 Jan 2017 13:50:17 -0800 (PST)
Received: from [192.168.220.238] (unknown [31.15.50.66]) by mail.frobbit.se (Postfix) with ESMTPSA id 07A6420599; Mon, 23 Jan 2017 22:50:13 +0100 (CET)
From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" <paf@frobbit.se>
To: "Alexey Melnikov" <alexey.melnikov@isode.com>
Subject: Re: Last Call: <draft-ietf-lamps-eai-addresses-05.txt> (Internationalized Email Addresses in X.509 certificates) to Proposed Standard
Date: Mon, 23 Jan 2017 22:50:14 +0100
Message-ID: <14A8995E-D7BF-4994-98F8-875CCED02085@frobbit.se>
In-Reply-To: <61a0a970-cab2-3f21-7f05-691b6d6ab53f@isode.com>
References: <148460673104.22580.543094070599448665.idtracker@ietfa.amsl.com> <E61E7383DDD7A81671C398EC@JcK-HP5.jck.com> <61a0a970-cab2-3f21-7f05-691b6d6ab53f@isode.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=_MailMate_61FB970E-5EAF-4189-9CA5-B0175CDCDC81_="; micalg=pgp-sha1; protocol="application/pgp-signature"
X-Mailer: MailMate (2.0BETAr6072)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/WQUr26SFOZK_-kGsgH-xjN38pwQ>
Cc: spasm@ietf.org, lamps-chairs@ietf.org, draft-ietf-lamps-eai-addresses@ietf.org, John C Klensin <klensin@jck.com>, ietf@ietf.org
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Jan 2017 21:50:19 -0000

On 23 Jan 2017, at 14:40, Alexey Melnikov wrote:

> Thank you for your thorough review! My comments/answers below:

I have a few comments as well. Basically I agree with what John writes, but let me add some additional spice.

>> (3) A MUST NOT requirement on the use of A-labels has often
>> been problematic because, as far as a protocol that does not
>> support IDNA is concerned, they are ordinary labels conforming
>> to the "preferred syntax" of RFC 1034/1035 (commonly known as
>> "LDH syntax").  As important, it is easily possible to construct
>> strings that look (lexically) like A-labels but are actually not
>> A-labels.   If the desire is to prevent the use of anything but
>> normal (i.e., not IDNA) LDH labels and U-labels, the restriction
>> that is probably needed is either "no label starting in 'xn--'"
>> or "no label starting in two letters followed by two
>> hyphen-minus characters".
>>
>> Requiring NR-LDH restrictions
>> probably solves the problem (although I'm not sure what "solely
>> ASCII character labels" means -- see (2) above) but requires
>> much more specific knowledge of the IDNA2008 protocol set
>> (particularly RFC 5890 in this case) than I predict readers of
>> this document will have.  See RFC 5890 and 5894 for more
>> discussion on this issue and other recent correspondence about
>> confusing and contradictory usage of "IDN" and "IDNA" and the
>> associated risks for additional details and risk descriptions.
>
> I think this needs to be discussed a bit more in the LAMPS WG, but you have a good point here.

I would extend to 'starting in "XX--" where X can be any ascii character" because who knows whether we need a completely different prefix one day.

Or you should explicitly note that ascii-only mailboxes do imply the litteral value and those strings MUST NOT be interpreted as A-Labels.

>> (5) It may be worth being explicit that there is no
>> normalization or case-folding permitted with the local-part.
>> The current text does say that but it may not be obvious to
>> someone not thoroughly familiar with other specs.
>
> Do you have a suggestion where this should be clarified?

What about here in section 4 (which I presume is referenced implicitly, or similar places where it is noted some transformation is done (between A-Labels and U-Labels):

OLD:

In setup for SmtpUtf8Mailbox, the email address local-part MUST be converted to UTF-8 if it is not already.

NEW:

In setup for SmtpUtf8Mailbox, the email address local-part MUST be converted to UTF-8 if it is not already. The local-part MUST NOT be transformed in any way, for example by doing case folding or normalization of any kind.

   Patrik