1735762 - Thunderbird should accept a signature certificate matching the email sender address as valid (rfc5750)

Status: NEW

(MailNews Core :: Security: S/MIME, enhancement)

Description

[steffen.renker]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0

Steps to reproduce:

sign a mail with a gateway certificate "[e-mail]"
from: "My Name" <[e-mail]>
sender: "My Name" <[e-mail]>

similarly discussed in https://bugzilla.mozilla.org/show_bug.cgi?id=332639

According to RFC 7508 (page 4) the mailer MUST check certificates against From od Sender:

Receiving agents MUST check that the address in the From or Sender
header of a mail message matches an Internet mail address, if
present, in the signer's certificate, if mail addresses are
present in the certificate.

Actual results:

S/MIME Warning/Error "Signature is invalid"

Expected results:

S/MIME valid: signer <[e-mail]>

In order to avoid forgeries and misunderstandings, the email address of the signature certificate should be displayed in the header (next to the S/MIME symbol)

Comment 1

[Magnus Melin [:mkmelin]]

As far as I know the fix in bug 332639 is still in use, so not sure what you're reporting. Can you attach a sample as .eml?

Comment 2

[steffen.renker]

Attachment: Testmail signiert.eml

gateway signed testmail

Comment 3

[Magnus Melin [:mkmelin]]

What does the security popup say? For me it says it's invalid because it's signed by a certificate authority you (I) do not trust.
We don't show sender for that (the notok) case - https://searchfox.org/comm-central/rev/89632cecb2845b88ff87b9f09c8cfd47a1fe886a/mail/extensions/smime/content/msgHdrViewSMIMEOverlay.js#186

Comment 4

[Alfred Peters [:infofrommozilla]]

(In reply to Magnus Melin [:mkmelin] from comment #3)

What does the security popup say? For me it says it's invalid because it's signed by a certificate authority you (I) do not trust.

The CA certificate is not installed in TB. Tested with TB 91.2.1.

It's available at:
http://secure.globalsign.com/cacert/gsgccr3personalsign2ca2020.crt

Comment 5

[Alfred Peters [:infofrommozilla]]

Attachment: b1735762.png

After installing and trusting the certificate, I get this message

Comment 6

[Kai Engert [:KaiE:]]

(In reply to Magnus Melin [:mkmelin] from comment #1)

As far as I know the fix in bug 332639 is still in use, so not sure what you're reporting. Can you attach a sample as .eml?

I don't get a sender header for the attached sample message, so Magnus assumption seems incorrect.

Comment 7

[Kai Engert [:KaiE:]]

(In reply to steffen.renker from comment #0)

According to RFC 7508 (page 4) the mailer MUST check certificates against From od Sender:

Receiving agents MUST check that the address in the From or Sender
header of a mail message matches an Internet mail address, if
present, in the signer's certificate, if mail addresses are
present in the certificate.

Note that RFC 7508 simply quotes that statement.
(7508 is about secure header fields for S/MIME, which thunderbird currently doesn't support.)

It looks like the origin of the statement is RFC 5750.

Our S/MIME implementation and decision logic is older than 5750. We haven't yet caught up with all the recent RFCs.