Re: [lamps] WG Last Call for draft-ietf-lamps-eai-addresses-10

[Sean Leonard <[e-mail]>]

> On Jun 30, 2017, at 12:18 PM, Viktor Dukhovni <[e-mail]> wrote:
> 
> On Fri, Jun 30, 2017 at 12:28:48PM -0400, Russ Housley wrote:
> 
>> With the posting of draft-ietf-lamps-eai-addresses-12, I believe that all
>> WG Last Call comments have bee resolved.  I will notify our Area Director
>> that the document is ready.
> 
> Indeed, grammar issues aside, which I expect will be addressed by
> the RFC editor, looks largely done to me.  It'll soon be time to
> resume work to support the new name type in OpenSSL.  This time
> with rfc822Name name constraints applied to both rfc822Name and
> SMTPUtf8Name subjectAltNames.
> 
> My only technical quibble is that I'd have preferred to also see
> deprecation of support for email addresses in the subject DN,
> subject altnames have been broadly supported for a long time.  This
> is a non-critical issue.  If there's not broad support for doing
> that at this time, I have no substantial issues with the -12 draft.

Hi Viktor,

EAI addresses need an LDAP attribute, since the current LDAP attributes (mail and emailAddress (RFC 5280)) don’t support UTF-8. I expressed interest in fixing this, but the LDAP maintainers have mostly evaporated. :( Still interested in a draft for that, however.

I agree with the direction of draft-ietf-lamps-eai-addresses that the subject DN should not be checked and should not be used for address matching.

There is some risk that a UTF-8 e-mail address attribute that is not checked, could pose a phishing risk if presented to the user. However, that is no different from a CN or other displayed attribute that happens to contain an e-mail address. I do not consider that risk to be significant (in light of the alternatives).

Sean