Re: [lamps] Suresh Krishnan's No Objection on draft-ietf-lamps-eai-addresses-15: (with COMMENT)

[Alexey Melnikov <[e-mail]>]

Hi Suresh,

On Mon, Feb 12, 2018, at 7:17 AM, Suresh Krishnan wrote:
> Hi Alexey,
> 
> > On Jan 11, 2018, at 11:11 AM, Alexey Melnikov <[e-mail]> wrote:
> > 
> > Hi Suresh,
> > 
> > On Thu, Jan 11, 2018, at 3:11 AM, Suresh Krishnan wrote:
> >> Suresh Krishnan has entered the following ballot position for
> >> draft-ietf-lamps-eai-addresses-15: No Objection
> >> 
> >> I think some of the comparison issues brought up in RFC6943 might be relevant
> >> in the Security Considerations here.
> > 
> > Can you be more specific? Are you thinking about confusable characters or about something else?
> 
> Yep. Exactly about visually confusable characters.

The document already covers that:

7.  Security Considerations

   Use of SmtpUTF8Mailbox for certificate subjectAltName (and
   issuerAltName) will incur many of the same security considerations as
   in Section 8 in [RFC5280], but introduces a new issue by permitting
   non-ASCII characters in the email address local-part.  This issue, as
   mentioned in Section 4.4 of [RFC5890] and in Section 4 of [RFC6532],
   is that use of Unicode introduces the risk of visually similar and
   identical characters which can be exploited to deceive the recipient.
   The former document references some means to mitigate against these
   attacks.

I looked at RFC 6943. While it is a good document, I don't see an obvious way of referencing it. There is so much material there unrelated to Internationalization, so it is difficult to find a useful way of referencing it. If you have some specific suggestions, please let me know.

Thank you,
Alexey