<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 20 juil. 2017 à 23:13, Peter Bowen <<a href="mailto:pzb@amzn.com" class="">pzb@amzn.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br class="Apple-interchange-newline">
On Jul 20, 2017, at 11:02 AM, Erwann Abalea <<a href="mailto:Erwann.Abalea@docusign.com" class="">Erwann.Abalea@docusign.com</a>> wrote:<br class="">
<br class="">
<br class="">
<blockquote type="cite" class="">Le 20 juil. 2017 à 16:52, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> a écrit :<br class="">
<br class="">
On Thu, Jul 20, 2017 at 10:16 AM, Erwann Abalea<br class="">
<<a href="mailto:Erwann.Abalea@docusign.com" class="">Erwann.Abalea@docusign.com</a>> wrote:<br class="">
<blockquote type="cite" class="">Bonjour,<br class="">
<br class="">
Looking back in time on the list for a reason to allow for underscore in<br class="">
SAN:dNSName, I found basically 2 potential reasons:<br class="">
- allow things such as « _sip._<a href="http://tls.xxxxxxx.com" class="">tls.xxxxxxx.com</a> »<br class="">
- provide certificates for names that are not internet routable, such as «<br class="">
m_staging9.<a href="http://xxxxxxx.com" class="">xxxxxxx.com</a> »<br class="">
<br class="">
The first option is avoided here (and it’s fine), because this should go<br class="">
into an SRV-type entry (or in the SAN:URI for this example).<br class="">
The text of the proposed ballot opens the path to having underscores into<br class="">
the the « xxxxxx » portion. This path is closed later by the validation of<br class="">
domain authorization or control (except if method 3.2.2.4.11 is used).<br class="">
<br class="">
<br class="">
Text in 7.1.4.2.1 disallows FQDNs that contain a label within the class of<br class="">
R-LDH labels than don’t start with « xn-- ». IIUC, such domains are still<br class="">
allowed under some TLDs that don’t support IDNA (such as « in--valid.am », «<br class="">
in--<a href="http://valid.gov" class="">valid.gov</a> », or « in--<a href="http://valid.co.uk" class="">valid.co.uk</a> »). I just validated that Safari,<br class="">
Firefox, and Chrome (on MacOSX) are happy to connect to<br class="">
<a href="http://in--valid.mydomain.com" class="">http://in--valid.mydomain.com</a> (for a properly owned my
<a href="http://domain.com" class="">domain.com</a>).<br class="">
Is that the intention of the ballot to disallow CAs to provide certificates<br class="">
for such domains?<br class="">
</blockquote>
<br class="">
Yes.<br class="">
<br class="">
See the terminology discussion in<br class="">
<a href="https://tools.ietf.org/html/rfc5890#section-2.3.1" class="">https://tools.ietf.org/html/rfc5890#section-2.3.1</a> (as well as<br class="">
Figure-1) . In effect, this prohibits CAs from issuing for Reserved<br class="">
LDH Labels - except for those explicitly noted (IDNA).<br class="">
</blockquote>
<br class="">
I was just reading it.<br class="">
<br class="">
So valid names will be composed only of:<br class="">
- LDH labels that are correct A-labels (the (2) box)<br class="">
- NR-LDH labels (the box on top right)<br class="">
- a subset of NON-LDH labels: only the underscore will be authorized and only where an hyphen can be present; will « xn__something » be authorized?<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">I
read it as xn__something is allowed as it does not contain hyphens at all, so it is clearly not a Reserved LDH Label.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
Using censys.io and the following expression returns some currently valid certificates that contain a fake A-label while being valid names:<br class="">
parsed.extensions.subject_alt_name.dns_names:/(.*\.)?[^xX][^nN]--.*/ and tags: “trusted"<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Using
the 5890 terminology, I believe this search finds Reserved LDH Labels that are not XN-labels. A “fake A-label” is one starting with xn-- but not containing a punycode string.</span><span class="Apple-tab-span" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
</span><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Detecting
fake A-label via regex is super hard, as it looks correct. The numbers found by this censys query are very close to what I found in CT logs. You can see the CA totals on the right; Censys is showing 20 while I found 13 in CT. Either number is a super small
portion of the millions of trusted certificates.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>You’re right, they’re not fake A-labels, but R-LDH labels.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
With the following expression, there’s a list of registered domains that contain a double hyphen at 3rd and 4th position while not starting with xn:<br class="">
parsed.extensions.subject_alt_name.dns_names:/(.*\.)?[^xX][^nN]--[a-zA-Z0-9-]*\.[a-zA-Z]+/<br class="">
<br class="">
Such certificates would then be considered as misissued.<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">This
is basically the same query as before but without “trusted”, right?</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>It returns only names where the R-LDH labels is right below the TLD. Previous query returned all names containing an R-LDH label.</div>
<div>So this query returns domain names that have been registered.</div>
</div>
<br class="">
<div class=""><br class="">
</div>
</body>
</html>