917869 - Punycode based certificate not accepted for idn based emails

Status: UNCONFIRMED

(MailNews Core :: Security: S/MIME, defect)

Description

[[e-mail]]

Attachment: idn-cert.gif

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130910160258

Steps to reproduce:

If I change my address from [e-mail] to info@jürgen-winter.de my cert is not accepted for signing mails.


Actual results:

cert is not accepted


Expected results:

valid cert should be accepted

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

Mark, could you triage this one? (Not sure it is s-s?)

Comment 2

[[e-mail]]

The same happens if someone try to send an encrypted mail to this IDN address.

Comment 3

[[e-mail]]

Attachment: send-encrypted.gif

Comment 4

[[e-mail]]

Attachment: inbox folder with signed mail

Comment 5

[[e-mail]]

Sending disposition notification does not work too. Address is truncated to <info@> and cannot be delivered.

Comment 6

[Mark Banner (:standard8)]

I don't know enough about the standards to know how we should treat certificates such as these - if we should do automatic translation or not.

If it is our issue, then its likely to be a problem in the s/mime code somewhere (or what we pass to it).

Comment 7

[Joshua Cranmer [:jcranmer]]

I'm sorry, I don't speak German, so I can't read any of the error message dialog boxes. Could you please translate the error messages into English?

Also, does the certificate use the xn- form of the email address or the Unicode form?

Comment 8

[Kai Engert [:KaiE:]]

Message is signed. However, sender address and signer address (from cert) don't match.

Message not encrypted

...

Sending failed. Couldn't find encryption cert for (garbled address)

Comment 9

[[e-mail]]

(In reply to Mark Banner (:standard8) from comment #6)
> I don't know enough about the standards to know how we should treat
> certificates such as these - if we should do automatic translation or not.
> 
> If it is our issue, then its likely to be a problem in the s/mime code
> somewhere (or what we pass to it).

Envelope-To is coded as punycode, the same as my cert is (see below).

Return-Path: <[e-mail]>
Delivery-Date: Mon, 21 Oct 2013 17:03:36 +0200
Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.186])
	by mx.kundenserver.de (node=mxbap3) with ESMTP (Nemesis)
	id 0MJlO0-1VXB5Y1cYu-001C4o for [e-mail]; Mon, 21 Oct 2013 17:03:36 +0200
Received: from [192.168.168.1] (p579E35C8.dip0.t-ipconnect.de [87.158.53.200])
	by mrelayeu.kundenserver.de (node=mreu1) with ESMTP (Nemesis)
	id 0MbcQr-1VFEh83ZO1-00J1fy; Mon, 21 Oct 2013 17:03:36 +0200
Message-ID: <[e-mail]>
Disposition-Notification-To: =?ISO-8859-15?Q?J=FCrgen_Winter?=
 <[e-mail]>
Date: Mon, 21 Oct 2013 17:03:34 +0200
From: =?ISO-8859-15?Q?J=FCrgen_Winter?= <[e-mail]>
User-Agent: Mozilla Thunderbird
MIME-Version: 1.0
To: info@jürgen-winter.de
Subject: xxx
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms010809000105080707010609"
X-Provags-ID: V02:K0:M5X3XGoHvBJOdhep+XHaNNEPxA2pOw6wyPI4eD7aff5
 ozgnfyEgLtwtNvxAZ2LmKSDYR4wmFxrsEQGO0DzAvdmoFY0BV6
 mBhHQGAHt/gbKSNMC+RFnaoZfswELJhpFk078e9Cf1l3+Op3Jy
 6egegovZT+EElmGLv0lCwFUwN83H3bYa+EXS28l81YBahlbGCk
 pnVDYCMFCAuy/zynFzJROOtUdPogqcRO2xrUzPZ6uZt3/jZoOw
 vTjEkHRGnywmhkC4jf+g3nXka6aCRZ/tNaGtfQg0tc7CgGcdiN
 p3t2YfIgUeocoLskVDlksqQB5UQbYOwz0PaHxAE/GHAoRk5gyB
 ZvhaUV0yq0/SSX5jDRIw=
X-UI-Junk: AutoMaybeJunk -26 (BAY);
  V01:2So8bKd1:uxkQ+gcEIKuzEUjiHew7E4hIMoDfElJRjT0Kcidq5t5ZzKhZeHT
  bKyachaRuVuruQnLN7KfZta07ITRqSyDmEaaKTuQ8Gad1SRBZvOd+BXOy2hb5EhO
  3rGJnZEt0t26WmkCnw5Y0WFEt7SIalcbIwBfbvBU7wRJCqDrKV9yZXujkyJad/N2
  wkTsnffSN28KSgiER2lDsHMwjCFbTZ3akoTOhnLeOH2yKITgeuuyGKH9dcCIuTHH
  j3LpnQPVVwq+LCQmi5ZDWLkTK39DbyDbKU/IxYXwbCm6XtUIUrkF0WhA3tfEhQs/
  cMCPAfOzufAMazFVbm2jnML8/tezL+l1oYw==
Envelope-To: [e-mail]

This is a cryptographically signed message in MIME format.

...

Comment 10

[[e-mail]]

I have testet this. The webmailer on WEB.DE uses my cert without any problems, I can send encrypted mails to this IDN address.

Comment 11

[[e-mail]]

Mailboxes are addressed using punycode. But punycode based certs are not accepted for this addresses. Why can ths bug not be confirmed?

Comment 12

[[e-mail]]

Another year is gone and nothing did happen.

Comment 13

[bugzilla]

On 45.8 it is still defect.
Yo can send an mail to foo@müller.foo, but you are unable to encrypt it.

Comment 14

[leszek.zablocki]

The CABForum SMIME BRs specification mentions a field in the SAN where you can put the email address in utf-8. Th. doesn't display that field.

subjectAltName (OID 2.5.29.17) ::
    othername:SmtpUTF8Mailbox (OID 1.3.6.1.5.5.7.8.9)

Here's what the ASN.1 dump looks like:

SEQUENCE {
  OBJECT IDENTIFIER subjectAltName (2 5 29 17)
  BOOLEAN TRUE
  OCTET STRING, encapsulates {
    SEQUENCE {
      [1] '[e-mail]'
      [0] {
        OBJECT IDENTIFIER '1 3 6 1 5 5 7 8 9'
        [0] {
          UTF8String '[e-mail]'
          }
        }
      }
    }
  }

How about abandoning "Punycode" and switching to encoding the entire address (local part and domain) in SmtpUTF8Mailbox?

Links:
https://github.com/cabforum/smime/blob/main/SBR.md#71421-subject-alternative-name-extension
https://datatracker.ietf.org/doc/html/rfc8398

---

User-Agent:
Thunderbird 102.11.0 (64-bit), Windows 10

Reproducible: Always

Steps to Reproduce:

1. make a self-signed cert (root+user) for yourself
2. import self-signed cert (root+user) with "SmtpUTF8Mailbox" as SAN othername from sb:
   2a. "Authorities" tab → "Import..." → root.crt → "Trust this..."
   2b. "People" tab → "Import..." → user.crt → "View..." → Other Name <unsupported> → [not ok]
3. try to send smime encrypted mail to address: "peter.löwenbrä[e-mail]" :
   "Sending of the message failed.
   You specified encryption for this message, but the application failed to find an encryption certificate for ..." → [not ok]

Actual results:
Th. doesn't recognize "SmtpUTF8Mailbox" and encrypted emails cannot be sent to the utf8 address included in the recipient's certificate.

Expected Results:
Th. displays and honors "SmtpUTF8Mailbox" field in smime certificate.

I'm attaching a test package.

related bugs: bug#344817

Comment 15

[leszek.zablocki]

Attachment: make_utf8_cert.tar.gz