Re: [Spasm] Name Constraints on Email Addresses

[Russ Housley <[e-mail]>]

No one has spoken against this direction for constraints on email addresses (both rfc822Name and SmtpUTF8Name).  Authors, please update the document accordingly.

Russ


> On Apr 2, 2017, at 12:25 PM, Russ Housley <[e-mail]> wrote:
> 
> At the LAMPS WG session is Chicago, we discussed the concerns raised during IETF Last Call on draft-ietf-lamps-eai-addresses.  The discussion proposed a different way forward for constraints on email addresses.  The suggestion has two parts.  First, an update to RFC 5280, Section 4.2.1.10.  Second, have the constraints against the rfc822Name apply to the SmtpUTF8Name by mapping any A-Labels that paper in the constraint to U-Labels.  No SmtpUTF8Name constraints are ever needed.
> 
> RFC 5280, Section 4.2.1.10 offers three ways to constrain email addresses, but no one in the room doing the LAMPS session was aware of any use of the constraint applying to a particular mailbox.  The idea is to remove that capability going forward, which allows the rfc822Name constraint to apply to both rfc822Name and SmtpUTF8Name.
> 
> OLD:
> 
>   A name constraint for Internet mail addresses MAY specify a
>   particular mailbox, all addresses at a particular host, or all
>   mailboxes in a domain.  To indicate a particular mailbox, the
>   constraint is the complete mail address.  For example,
>   "[e-mail]" indicates the root mailbox on the host
>   "example.com".  To indicate all Internet mail addresses on a
>   particular host, the constraint is specified as the host name.  For
>   example, the constraint "example.com" is satisfied by any mail
>   address at the host "example.com".  To specify any address within a
>   domain, the constraint is specified with a leading period (as with
>   URIs).  For example, ".example.com" indicates all the Internet mail
>   addresses in the domain "example.com", but not Internet mail
>   addresses on the host "example.com”.
> 
> NEW:
> 
>   A name constraint for Internet mail addresses MAY specify all
>   addresses at a particular host or all mailboxes in a domain.  To
>   indicate all Internet mail addresses on a particular host, the
>   constraint is specified as the host name.  For example, the constraint
>   "example.com" is satisfied by any mail address at the host
>   "example.com".  To specify any address within a domain, the constraint
>   is specified with a leading period (as with URIs).  For example,
>   ".example.com" indicates all the Internet mail addresses in the domain
>   "example.com", but not Internet mail addresses on the host
>   “example.com.
> 
> It was observed that the conversion of an A-Lable to a U-Label and back to an A-Label may not alway give the same string.  Perhaps we could say: Conforming CAs SHOULD only include A-Lables in the rfc822Name constraint that result in the same result when converted to a U-Label and back again to an A-Label.
> 
> The represent a significant change in direction for this document.  Please speak promptly is you disagree with this new direction.
> 
> Russ
>