505990 - Not case sensitive depicted in certificate signature email

Status: NEW

(Thunderbird :: Security, defect)

Description

[Jarda324]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; cs; rv:1.9.0.11) Gecko/2009060215 Firefox/3.0.11
Build Identifier: Thunderbird 2.0.0.22 (20090605)

[e-mail] is certified signature (in all places -email server, Thunderbird account and by certificate autority as well), but [e-mail] is displayed in short describe security Thunderbird window.
The name of account is correct (Mr. Pepa Novak). Only main email address is depicted not case sensitive. In received and sended emails as well.
Sended email by Thunderbird and received in Outlook the certified signature email addresse is displayed case sensitive. Thunderbird not change it, only displayed it not case sensitive.

Reproducible: Always

Steps to Reproduce:
1.Do an email account like [e-mail], do Thunderbird account for [e-mail] and do certified signature by any certified autority for [e-mail] and key in certified signature to Thunderbird
2.Send or receive any email by addresse like certified [e-mail]
3.View to this email to certified signature click to certified envelope and you can see [e-mail]
Actual Results:  
I can see [e-mail]

Expected Results:  
I like see [e-mail]

Important only for official contact, like offices. Not function defect.

Comment 1

[Jan Peter Stotz]

I agree with Jarda324 - this is a problem as there are several other S/MIME implementations around that perform a correct S/MIME verification (e.g. Apple Mail) and therefore fail if the mailbox-name is written in different case than in the S/MIME certificate.

Please note that Thunderbird's behavior violates the way verification is stated in the RFC5750:

"The right side of the email address SHOULD be treated as ASCII-case-insensitive."

An RFC2821 states: "The local-part of a mailbox MUST BE treated as case sensitive."

BTW: Thunderbird does also not check the sender mail address on sending - as it is described in the RFC:

"Sending agents SHOULD make the address in the From or Sender header in a mail message match an Internet mail address in the signer's certificate"

You can use any sender mail address...