Subject: Re: [Spasm] Spasm Digest, Vol 13, Issue 4

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 4 Apr 2017 20:31:26 -0400

> On Apr 4, 2017, at 2:45 PM, [email-masked] wrote:
> 
> Currently the document says to use IDNA2008 only to insure that U-label
> and A-label convert 1-1, and to explicitly forbids UTF-8 case folding
> to eliminate ambiguity that it may cause.

Yes.

> If we were to specify UTS#46 that would bring in (at least) two different
> processing modes: 1) re-introduce case folding and 2) transitional
> processing for IDNA2003 to IDNA2008 that is supposed to go away at some point.

That point has already come and gone.  MTAs that support SMTPUTF8 (e.g. both
Postfix and Exim) have in recent releases disabled transitional processing.
So if UTS#46 is to be discussed, it would be appropriate to state that
transitional processing is historical and no longer applicable.

> Both introduce uncertainty to the specification.

Well it is just the case folding, and it matches reality, MTAs would
then behave just like users learn to expect with browsers, ...

> Also in practice I understand that UTS#46 may be used in the application
> (e.g. display of email address), but does it have to be part of the
> normative specification?

Well, I don't get to say what has to be there, but I am suggesting
that it may be wise to ensure that SMTPUtf8Name elements in the
certificate are case folded per UTS#46 and perhaps also the reference
identifiers that applications compare (byte-for-byte) against the
certificate, after UTS#46 non-transitional mapping.

In OpenSSL, the documentation will explain to users that they are
responsible for any UTS#46 mapping of the domain part of the
reference identifier and should probably do so.  OpenSSL will then
decode any A-labels in the rfc822Name constraints for comparison with
SMTPUTF8Name SANs, and will finally do the byte-for-byte comparison of
the reference identifier with the SMTPUtf8Name.

For this to work reliably, it would be prudent for both the CA and the
application to consistently apply non-transitional UTS#46 mappings.

-- 
-- 
	Viktor.