Re: [Spasm] comments on draft-ietf-pkix-eai-addresses-01

[Sean Leonard <[e-mail]>]

A few additional points popped out at me:

Currently, draft-melnikov-spasm-eai-addresses-01 does not restrict out 
plain (ASCII-only) e-mail addresses. This means that ASCII-only e-mail 
addresses can be "hidden" from implementations that don't support this 
new eai method. I am not in favor of this. The text is not really clear 
about whether non-internationalized email addresses are allowed in 
eaiName. It should be clear in saying that eaiName is restricted to 
internationalized email addresses, i.e., where there is at least one 
character beyond the ASCII range in the local-part. Email addresses that 
are limited to ASCII in the local-part MUST be encoded in rfc822Name only.

Can the ASN.1 reflect this with an appropriate string restriction?

The comparison algorithm is convoluted. There will be implementations 
that don't bother with the convoluted algorithm, and running the 
convoluted algorithm over thousands or hundreds of millions of 
certificates is going to have a meaningful impact on performance. It's 
better to put the address in a form that is amenable to octet-by-octet 
comparison. This argues in favor of requiring the domain name to be in 
U-labels instead of A-labels, and to normalize case (to lowercase) for 
characters in the ASCII range.

Sean