search

cabforum / smime

Repository for the S/MIME Certificate Working Group
30 stars 22 forks source link

Update reference for SmtpUTF8Mailbox from RFC 8398 to RFC 9598 #248

Open CBonnell opened 3 months ago

CBonnell commented 3 months ago

RFC 9598 was recently published to resolve an issue in the encoding of the domain-part of internationalized email addresses.

Specifically, the domain-part must always contain LDH labels (IDNA labels must be expressed in their A-label representation and must not use U-labels). This simplifies the previously complex logic specified in RFC 8398 that was difficult to implement and resulted in several CVEs for a very popular library (CVE-2022-3786, CVE-2022-3602, CVE-2022-4203).

SMBR should be amended to reference RFC 9598 so that domain-parts in SmtpUTF8Mailbox align with the new specification.

TaaviE commented 3 months ago

Side note: This is also very likely the reason why S/MIME certificates with IDNA are (more or less) broken in Thunderbird and Apple Mail. Even if you use the A-label.

srdavidson commented 1 month ago

See draft at https://github.com/srdavidson/smime/compare/9e03bb9ac14b26d0a881df3c857ebd60fe4b224a...1dc5800ded379023601f2eaa810c9b2f5d5a7057