[pkix] Support for email address internationalization in RFC5280 certificates

[Wei Chuang <[e-mail]>]

PKIX community,

We've observed a limitation for specifying internationalized email
addresses as the local part which is restricted to essentially ASCII.  That
is subject or issuer email addresses which should be stored as
subject-alt-name or issuer-alt-name rfc822Name and are encoded as
IA5String.  This is despite the internationalization in email usage as
specified by internationalization of email headers in RFC6532 allowing
Unicode in To, From, etc fields and becoming fairly commonplace.  RFC5280
already specifies internationalization of the domain but lacks any
specification for the local-part.  We propose a brief draft to specify an
encoding of email UTF-8 local part to base64.  This described in:
http://www.ietf.org/id/draft-lbaudoin-iemax-02.txt
One goal of that draft is to be compatible with existing PKI practices such
as path constraints with email address as this draft refines the existing
rfc822Name rather than specifies a new location for email addresses.

There are some other alternatives that probably should be mentioned for
discussion.  Instead of base64, another possibility is percent encoding as
done in RFC3987.  Our proposal is likely to be more compact and easier to
identify, but would welcome feedback.  Another direction is to specify a
SAN/IAN otherName compatible with Unicode for internationalized email.  A.
Melnikov specified this in an earlier draft
<https://www.ietf.org/archive/id/draft-ietf-pkix-eai-addresses-00.txt>.

Another thing to consider is whether there are other RFC5280 types that
need updating for internationalization.  Please consider looking into
uniformResourceIdentifier
as well.

-Wei