Re: [lamps] Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT)

Alexey Melnikov <> Sun, 04 March 2018 20:23 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 5A988126C0F for <>; Sun, 4 Mar 2018 12:23:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key) header.b=wrauf96+; dkim=pass (2048-bit key) header.b=Un99fptq
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id aL4XDaxHjvfg for <>; Sun, 4 Mar 2018 12:23:20 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 06E2E126BFD for <>; Sun, 4 Mar 2018 12:23:20 -0800 (PST)
Received: from compute7.internal (compute7.nyi.internal []) by mailout.nyi.internal (Postfix) with ESMTP id 22CB620AF7; Sun, 4 Mar 2018 15:23:19 -0500 (EST)
Received: from web2 ([]) by compute7.internal (MEProxy); Sun, 04 Mar 2018 15:23:19 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=Te7azzr/YvyFK/NTuJ/kC4y1kgaS7 KXr8sIDwi6btcM=; b=wrauf96+VPfQS1U+A8yaFpOoWIl/CLpQNeTcv8DIdSVuv bDxzZZ86csTSu93QlZ7lh0eFUy7FxF8Pr5dnlnScGksVFiRawCxFsFFFNMduN4Nv cRJydiaxXMkeltVGDOlXsjtXM1i8iboqWTMp0z3zM98CyYxXFlyPrmIoqa34/sMb TcxMim6d13o92jPPyWoQ49ThruHRRtfYYrvVf7vQUuTVT+SG+iK0GpypfHy9iU0P EJQ0QE9GvG5Q6CQh4f6R9KD1+lfO9qge3N14QF+WkEE+X0D19NBUjj9gBzXASlat 5CxIJ/G4i00HX8RpjM7xNrH8ZrBOU47yYlF7h5xEg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=Te7azz r/YvyFK/NTuJ/kC4y1kgaS7KXr8sIDwi6btcM=; b=Un99fptqw71CfaccCFIsxS Q6L2eVx+Z4UQXwqVoZ0oolQ4Z26BbW84cZFubRdsB0MDkQ0UKZ7BpEZ1kgu5Hlqb Jqoumhn4WqsZM3djw3ovTbnSCs1tOHM6S/n1WkbcTV1eT975YxKUJRrkPFnJSXfI JdGi89xKBBgZJA/OjMntTyiKh+XWvBO0j9IyO1aNmIq+WL+21R6AhwXgbScMLWak vw+ddqAVUBQxxTRjlMsOYanlvwStCaQHGsRB2fFInA50tUhvtLSg3BKnQjGhUre4 qPZULpB6/OD2w7i08xASamN0aWTi24Z/k9q+jxF0MEd8fcS1ihdLELcKl6iROsuw ==
X-ME-Sender: <xms:t1WcWstktae6q7rTZ8X--adfN3AASXBmyzCqqWkM1L0sE9WUOnPoBw>
Received: by mailuser.nyi.internal (Postfix, from userid 99) id F364F621BF; Sun, 4 Mar 2018 15:23:18 -0500 (EST)
Message-Id: <>
From: Alexey Melnikov <>
To: Eric Rescorla <>, Russ Housley <>
Cc: Suresh Krishnan <>, Wei Chuang <>,
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary="_----------=_152019499826902840"
X-Mailer: Webmail Interface - ajax-b08ff009
Date: Sun, 04 Mar 2018 20:23:18 +0000
In-Reply-To: <>
References: <> <> <> <> <> <> <>
Archived-At: <>
Subject: Re: [lamps] Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT)
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 04 Mar 2018 20:23:25 -0000

Hi Ekr,

On Sat, Feb 24, 2018, at 8:13 PM, Eric Rescorla wrote:
> I tend to agree with Suresh that a reference here would help. Could we
> just have something like> "See [] for more on security issues with Unicode"

I've added the direct reference to [WEBER], as I think it is the most
appropriate here.
Best Regards,

> On Fri, Feb 16, 2018 at 9:24 AM, Russ Housley
> <> wrote:>> 
>>>> The document already covers that:
>>>> 7.  Security Considerations
>>>>   Use of SmtpUTF8Mailbox for certificate subjectAltName (and
>>>>   issuerAltName) will incur many of the same security
>>>>   considerations as in Section 8 in [RFC5280], but introduces a new
>>>>   issue by permitting non-ASCII characters in the email address local-
>>>>   part.  This issue, as mentioned in Section 4.4 of [RFC5890] and
>>>>   in Section 4 of [RFC6532], is that use of Unicode introduces the
>>>>   risk of visually similar and identical characters which can be
>>>>   exploited to deceive the recipient. The former document
>>>>   references some means to mitigate against these attacks.
>>>> I looked at RFC 6943. While it is a good document, I don't see an
>>>> obvious way of referencing it. There is so much material there
>>>> unrelated to Internationalization, so it is difficult to find a
>>>> useful way of referencing it. If you have some specific
>>>> suggestions, please let me know.>>> 
>>> I thought of putting in a reference to Section 4.2. of RFC6943 could
>>> be useful especially since I personally found the reference to
>>> [WEBER] there very useful to understand the potential attacks. That
>>> said, maybe that is only because I am a total outsider to this space
>>> and these could be well understood attacks in the community that is
>>> the target of the draft. I am fine to proceed without adding a
>>> reference. Thanks for checking to see if this is covered.>> 
>> Where are we in resolving this comment.  It seems to be the only
>> thing keeping this document from the RFC Editor Queue.>> 
>> Russ