Subject: [Emu] RFC 2716bis Issue: Use of rfc822Name

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 01 May 2007 14:41:13 -0700

The following question has come up in the WiMAX Forum with respect to 
EAP-TLS peer certificate usage:

>From RFC 3280:
   When the subjectAltName extension contains an Internet mail address,
   the address MUST be included as an rfc822Name.  The format of an
   rfc822Name is an "addr-spec" as defined in RFC 822 [RFC 822].  An
   addr-spec has the form "local-part@domain".  Note that an addr-spec
   has no phrase (such as a common name) before it, has no comment (text
   surrounded in parentheses) after it, and is not surrounded by "<" and
   ">".  Note that while upper and lower case letters are allowed in an
   RFC 822 addr-spec, no significance is attached to the case.

The question is whether any NAI as defined in RFC 4282 meets these 
requirements for inclusion in subjectAltName using the rfc822Name format.

For example, what if an NAI does not contain a realm portion?

My personal take is that as long as the NAI is legal within RFC 4282, it 
should be legal for inclusion in the subjectAltName field using the 
rfc822Name format.  This seems preferrable to registering a new type-id.

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 2 May 2007 15:33:51 -0700

RFC4383 is a superset of RFC822.  If a name does not conform to RFC822
then it will not be compliant with RFC3280.  Within a specific community
where everyone has a common understanding of how the extension will be
used then this is probably OK.  If you plan on using the certificates
more generically then it is possible that you will run into problems.  

Joe

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Tuesday, May 01, 2007 2:41 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Emu] RFC 2716bis Issue: Use of rfc822Name
> 
> The following question has come up in the WiMAX Forum with 
> respect to EAP-TLS peer certificate usage:
> 
> >From RFC 3280:
> The question is whether any NAI as defined in RFC 4282 meets 
> these requirements for inclusion in subjectAltName using the 
> rfc822Name format.
> 
> My personal take is that as long as the NAI is legal within 
> RFC 4282, it should be legal for inclusion in the 
> subjectAltName field using the rfc822Name format.  This seems 
> preferrable to registering a new type-id.
> 
> 
>

---

From: <[email-masked]>
Date: Thu, 3 May 2007 10:51:49 +0300

Joseph Salowey wrote:

> RFC4383 is a superset of RFC822.  If a name does not conform to
> RFC822 then it will not be compliant with RFC3280.  Within a
> specific community where everyone has a common understanding of how
> the extension will be used then this is probably OK.  If you plan on
> using the certificates more generically then it is possible that you
> will run into problems.

Actually, RFC 4282 is not a superset of RFC822 addr-spec.  There 
are some weird corner cases that are valid RFC822 addr-spec's but 
not valid NAIs.

For example, RFC822 allows quoting a space with double quotes
("john doe"@example.org), but RFC4282 has only backslash-quoting.
I'm sure other similar cases exist, but probably they don't really
have any impact on real-world deployments.

Best regards,
Pasi