Re: [Spasm] comments on draft-ietf-pkix-eai-addresses-01

> -----Original Message-----
> From: Spasm [mailto:spasm-bounces@ietf.org] On Behalf Of Sean Leonard
> Sent: Thursday, June 16, 2016 6:32 AM
> To: spasm@ietf.org
> Subject: Re: [Spasm] comments on draft-ietf-pkix-eai-addresses-01
> 
> A few additional points popped out at me:
> 
> Currently, draft-melnikov-spasm-eai-addresses-01 does not restrict out
plain
> (ASCII-only) e-mail addresses. This means that ASCII-only e-mail addresses
can
> be "hidden" from implementations that don't support this new eai method. I
am
> not in favor of this. The text is not really clear about whether non-
> internationalized email addresses are allowed in eaiName. It should be
clear in
> saying that eaiName is restricted to internationalized email addresses,
i.e.,
> where there is at least one character beyond the ASCII range in the
local-part.
> Email addresses that are limited to ASCII in the local-part MUST be
encoded in
> rfc822Name only.
> 
> Can the ASN.1 reflect this with an appropriate string restriction?

Almost nobody implements it but it would be

eaiName ::= UTF8String (SIZE(1..MAX)) (PATTERN [^!-}]*)

The pattern can probably be improved if one has a better sense of what
characters are permitted in an email address.  This one just says don't
allow for any string which consists of just these characters.

This is probably a case where you do not care if the pattern matches too
many items as one would not care if you matched things which were not email
addresses.

Jim

> 
> The comparison algorithm is convoluted. There will be implementations that
> don't bother with the convoluted algorithm, and running the convoluted
> algorithm over thousands or hundreds of millions of certificates is going
to have
> a meaningful impact on performance. It's better to put the address in a
form
> that is amenable to octet-by-octet comparison. This argues in favor of
requiring
> the domain name to be in U-labels instead of A-labels, and to normalize
case (to
> lowercase) for characters in the ASCII range.
> 
> Sean
> 
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm