Subject: Vagueness re: case sensitivity of local-part in RFC2822.

From: "Timothy J. Miller" <[email-masked]>
Date: Mon, 10 Sep 2007 21:26:36 -0700

OK, this has been bugging me for a while now.

2822 says that the domain-part of an address is interpreted as a  
domain name, and the DNS RFCs say domain names are case-insensitive.   
But it looks to me like 2822 is silent on *local-part* case sensitivity.

Logic can take us either way; i.e., since RFCs are generally silent  
unless insensitivity is needed, local-part must be sensitive--or,  
alternately, since the RFC is silent in this case it's best to  
interpret for maximum compatibility, so local-part must be insensitive.

And most MTAs and MUAs in my experience treat local-part as case  
insensitive.

Except Apple Mail S/MIME processing.  All other S/MIME MUAs I've  
tested go with case insensitive for S/MIME local-part address  
matching--but Apple Mail is case sensitive.  This is a real pain in  
my neck, especially with the DoD PKI, where email addresses are not  
(yet) centrally provisioned, so case mismatches between the mail  
system and the PKI are common.

I can't get Apple to budge on fixing it because they've staked out  
the strict interpretation, despite the common interpretation  
otherwise and the demonstrable problems this causes.  A fix 2822  
would help, but I figured I'd ask the opinion of this list before I  
took things further:

Should the local-part of an RFC2822 addr-spec be interpreted as case- 
insensitive?

Comments?

-- Tim

---

From: Blake Ramsdell <[email-masked]>
Date: Mon, 10 Sep 2007 23:14:57 -0700

On Mon, Sep 10, 2007 at 09:26:36PM -0700, Timothy J. Miller wrote:
>  2822 says that the domain-part of an address is interpreted as a domain 
>  name, and the DNS RFCs say domain names are case-insensitive.  But it looks 
>  to me like 2822 is silent on *local-part* case sensitivity.

RFC 2822, section 3.4.1:

"The local-part portion is a domain dependent string."

My interpretation of that is "Don't touch it. At all. It's not yours."

>  Logic can take us either way; i.e., since RFCs are generally silent unless 
>  insensitivity is needed, local-part must be sensitive--or, alternately, 
>  since the RFC is silent in this case it's best to interpret for maximum 
>  compatibility, so local-part must be insensitive.
> 

Probably not a good assumption in general, at least for MTAs:

RFC 2821, section 2.4:

"The local-part of a mailbox MUST BE treated as case sensitive. Therefore,
SMTP implementations MUST take care to preserve the case of mailbox
local-parts."

>  Should the local-part of an RFC2822 addr-spec be interpreted as 
>  case-insensitive?

I think "no", based on the citations above. I do empathize with you about the
particular problem you have. I've seen agents change
[email-masked] to [email-masked] on more than one
occasion.

Blake
-- 
Blake Ramsdell | Sendmail, Inc. | http://www.sendmail.com

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 11 Sep 2007 09:04:46 +0200

Blake Ramsdell <[email-masked]> writes:

> I think "no", based on the citations above.

I came the same conclusion when I implemented S/MIME handling some time
ago.  local-part's may be case-sensitive, and implementations cannot and
should not assume otherwise in the general case.

> I do empathize with you about the particular problem you have. I've
> seen agents change [email-masked] to
> [email-masked] on more than one occasion.

I think the safest reaction is to consider those agents buggy and fix
them.

/Simon

---

From: "Timothy J. Miller" <[email-masked]>
Date: Tue, 11 Sep 2007 10:44:39 -0700

On Sep 10, 2007, at 11:14 PM, Blake Ramsdell wrote:

>> domain

I appreciate the reference in 2821; I hadn't thought to look there.   
I can agree with MTAs retaining case sensitivity because they need to  
deliver to the proper mailbox.  However, does the same requirement  
make sense for MUAs when *receiving* mail?

There's a real interoperability problem here.  It doesn't arise in  
most MUAs because the MUAs treat local-part as case insensitive-- 
insofar as address *matching* is concerned (frex, with an address  
book), and this is carried over into S/MIME handing in these  
clients.  However, these same MUAs are also *case-preserving*, so  
they don't interfere with case-sensitive MTA delivery.

So maybe a better question is:  Should 3850, in section 3 (para 5)  
specify case insensitive local-part matching when assuring that the  
 From or Sender address matches an address in the certificate?

-- Tim