IETF Logo Mail Archive

Re: [lamps] Éric Vyncke's No Objection on draft-ietf-lamps-samples-07: (with COMMENT)

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Wed, 02 February 2022 22:29 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E9413A2328 for <spasm@ietfa.amsl.com>; Wed, 2 Feb 2022 14:29:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b=mYPum9Ga; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b=u0qQs6Dq
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2_uqfAKDH4uO for <spasm@ietfa.amsl.com>; Wed, 2 Feb 2022 14:29:01 -0800 (PST)
Received: from che.mayfirst.org (che.mayfirst.org [IPv6:2001:470:1:116::7]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E878A3A233A for <spasm@ietf.org>; Wed, 2 Feb 2022 14:29:00 -0800 (PST)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1643840938; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : content-transfer-encoding : from; bh=eHdHf6IRZNt/To6E0lXPETNHlLDFkDgF8pw4bWHdaq0=; b=mYPum9GaVk6JFRtR8IXhGB6bNg15GvJI1QFR4OsxvGTL+MGEbuz+gx81VGlFkTgL7ref8 gti4l2hMyLks2LoDA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1643840938; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : content-transfer-encoding : from; bh=eHdHf6IRZNt/To6E0lXPETNHlLDFkDgF8pw4bWHdaq0=; b=u0qQs6Dqr7z1FoS+t6ScRfwM5htnZ0IHip2hzGSTYvEPQjQukT6AmuqEqesalwcb9N2Jr SvVbvqPP0dTl5KFDQrMfM9zXMkXvMXAjC/mDuIP6Ca3y/eVkUvBOqxCMhOo1ccXP/HxX1YJ gN1YtQ5RGosjpIFbON4Zf+ewy8AmL/d/EGsn+gjzfdCVKCjOYppQOURYqNHWy+CHByrc3qh k8O6aU2hSALiTjwOkDmLOAE9A1ryjYWPOt9jTNUeQYPaDb12Gie16VXCw098McEAuhqL6R2 49PLMBnfQSF6Z0x04JeqxWLvtfd/hXxYr5dW467fDFO5/5bAsMf3uie1Ynww==
Received: from fifthhorseman.net (lair.fifthhorseman.net [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 0EA9CF9AA; Wed, 2 Feb 2022 17:28:57 -0500 (EST)
Received: by fifthhorseman.net (Postfix, from userid 1000) id C46C7203AB; Wed, 2 Feb 2022 17:28:55 -0500 (EST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Russ Housley <housley@vigilsec.com>, Uri Blumenthal <uri@ll.mit.edu>
Cc: LAMPS <spasm@ietf.org>, Eric Vyncke <evyncke@cisco.com>
In-Reply-To: <FFC0F164-E951-4FA8-B0D4-D5FDE68D7522@vigilsec.com>
References: <164121362047.8756.3046187711723091521@ietfa.amsl.com> <87iltxm232.fsf@fifthhorseman.net> <BN0P110MB141942ABD162C393D21FAC2990279@BN0P110MB1419.NAMP110.PROD.OUTLOOK.COM> <84DFE375-B0F5-400E-A9B5-B262575288F4@vigilsec.com> <BN0P110MB14193C8DDC7CA647B315580190279@BN0P110MB1419.NAMP110.PROD.OUTLOOK.COM> <FFC0F164-E951-4FA8-B0D4-D5FDE68D7522@vigilsec.com>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEX+i03xYJKwYBBAHaRw8BAQdACA4xvL/xI5dHedcnkfViyq84doe8zFRid9jW7CC9XBiI0QQf FgoAgwWCX+i03wWJBZ+mAAMLCQcJEOCS6zpcoQ26RxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl cXVvaWEtcGdwLm9yZ/tr8E9NA10HvcAVlSxnox6z62KXCInWjZaiBIlgX6O5AxUKCAKbAQIeARYh BMKfigwB81402BaqXOCS6zpcoQ26AADZHQD/Zx9nc3N2kj13AUsKMr/7zekBtgfSIGB3hRCU74Su G44A/34Yp6IAkndewLxb1WdRSokycnaCVyrk0nb4imeAYyoPtBc8ZGtnQGZpZnRoaG9yc2VtYW4u bmV0PojRBBMWCgCDBYJf6LTfBYkFn6YAAwsJBwkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3Rh dGlvbnMuc2VxdW9pYS1wZ3Aub3JnL0Gwxvypz2tu1IPG+yu1zPjkiZwpscsitwrVvzN3bbADFQoI ApsBAh4BFiEEwp+KDAHzXjTYFqpc4JLrOlyhDboAAPkXAP0Z29z7jW+YzLzPTQML4EQLMbkHOfU4 +s+ki81Czt0WqgD/SJ8RyrqDCtEP8+E4ZSR01ysKqh+MUAsTaJlzZjehiQ24MwRf6LTfFgkrBgEE AdpHDwEBB0DkKHOW2kmqfAK461+acQ49gc2Z6VoXMChRqobGP0ubb4kBiAQYFgoBOgWCX+i03wWJ BZ+mAAkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jnfvo+ nHoxDwaLaJD8XZuXiaqBNZtIGXIypF1udBBRoc0CmwICHgG+oAQZFgoAbwWCX+i03wkQPp1xc3He VlxHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnaheiqE7Pfi3Atb3GGTw+ jFcBGOaobgzEJrhEuFpXREEWIQQttUkcnfDcj0MoY88+nXFzcd5WXAAAvrsBAIJ5sBg8Udocv25N stN/zWOiYpnjjvOjVMLH4fV3pWE1AP9T6hzHz7hRnAA8d01vqoxOlQ3O6cb/kFYAjqx3oMXSBhYh BMKfigwB81402BaqXOCS6zpcoQ26AADX7gD/b83VObe14xrNP8xcltRrBZF5OE1rQSPkMNy+eWpk eCwA/1hxiS8ZxL5/elNjXiWuHXEvUGnRoVj745Vl48sZPVYMuDgEX+i03xIKKwYBBAGXVQEFAQEH QIGex1WZbH6xhUBve5mblScGYU+Y8QJOomXH+rr5tMsMAwEICYjJBBgWCgB7BYJf6LTfBYkFn6YA CRDgkus6XKENukcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEAx9vTD3b J0SXkhvcRcCr6uIDJwic3KFKxkH1m4QW0QKbDAIeARYhBMKfigwB81402BaqXOCS6zpcoQ26AAAX mwD8CWmukxwskU82RZLMk5fm1wCgMB5z8dA50KLw3rgsCykBAKg1w/Y7XpBS3SlXEegIg1K1e6dR fRxL7Z37WZXoH8AH
Date: Wed, 02 Feb 2022 17:28:55 -0500
Message-ID: <87a6f8nbrs.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/XTC3g86Z0M3jK_20QQ55M-JEbyk>
Subject: Re: [lamps] Éric Vyncke's No Objection on draft-ietf-lamps-samples-07: (with COMMENT)
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Feb 2022 22:29:06 -0000

On Wed 2022-02-02 17:24:34 -0500, Russ Housley wrote:
> Uri:
>
>> RFC 5280 encourages the rfc822name to be carried in the subjectAltName extension.  It does accommodate "legacy" implementations, as did RFC 2459 in 1999.
>> 
>> The problem with RFC 5280 is that in practice it facilitates “one cert <-> one email address”.
>> Originally, S/MIME was conceived to allow me to send email from an account/address, and prove that I’m the originator of it (I as the owner of the given certificate, not (necessarily) of the given email address.
>
> I do not understand this view.
>
> RFC 5280 says: "If the subjectAltName extension is present, the sequence MUST contain at least one entry."  This structure allows many GeneralName entries, and there is no requirement that a name form only be used only once.  So, several email addresses could be included, but of course, the CA needs to validate all of them.
>
> From a user interface perspective, and email client would need to confirm that the sender's email address is present in one of the subjectAltName extension entries.

Thank you both for the informative discussion, as well as for confirming
that figuring out *which* malformed certificates to include in
draft-ietf-lamps-samples would have been an adventure down the rabbit
hole. ☺

      --dkg

v2.23.0 | Report a Bug | By Email