<div dir="ltr">I haven't really thought through the validation aspects yet, but I mainly support an environment where the certs are issued to those affiliated with an organization and the CA has a direct relationship with that organization. If the DNS portion of the UPN matches the DNS portion of an email that has been validated, I would consider that sufficient if the portion of the UPN in front of the @ was supplied by the organization, which is also responsible for assigning that UPN to the individual. As others have said the UPN value is for authentication not secure email and at this time may not have to be fully validated to the same level as the email address. But should not be prohibited from being included in the certificate as it may break many current implementations unnecessarily.<div><br></div><div>thanks,<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p><span style="font-family:"Segoe Script",sans-serif">Wendy</span></p>
<p><span style="font-size:12.8px">Wendy Brown<br></span><span style="font-size:12.8px">Supporting GSA FPKI<br></span><span style="font-size:12.8px">Protiviti Government
Services</span></p>
<p> 703-965-2990 (cell)</p>
<p><a href="mailto:wendy.brown@gsa.gov" style="font-size:12.8px" target="_blank">wendy.brown@gsa.gov</a><br><a href="mailto:wendy.brown@protiviti.com" style="font-family:Calibri,sans-serif" target="_blank">wendy.brown@protiviti.com</a></p></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 20, 2020 at 9:17 AM Corey Bonnell <<a href="mailto:Corey.Bonnell@digicert.com">Corey.Bonnell@digicert.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US" style="overflow-wrap: break-word;"><div class="gmail-m_1658432506732080999WordSection1"><p class="MsoNormal">Hi Wendy,<u></u><u></u></p><p class="MsoNormal">I realize that we haven’t quite yet discussed the validation processes for SAN entries, but how would you envision such a validation process for UPNs to work if we permit a UPN SAN to not match one of the validated email addresses?<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks,<u></u><u></u></p><p class="MsoNormal">Corey<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in"><p class="MsoNormal"><b>From:</b> Smcwg-public <<a href="mailto:smcwg-public-bounces@cabforum.org" target="_blank">smcwg-public-bounces@cabforum.org</a>> <b>On Behalf Of </b>Wendy Brown - QT3LB-C via Smcwg-public<br><b>Sent:</b> Friday, November 20, 2020 8:07 AM<br><b>To:</b> Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr" target="_blank">dzacharo@harica.gr</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>><br><b>Subject:</b> Re: [Smcwg-public] email addresses in S/MIME certificates<u></u><u></u></p></div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">Also I do not remember a discussion that the UPN, if present, has to be identical to the email address. Although I may have missed at least 1 of the calls. I do not think this is always the case.<u></u><u></u></p><div><p class="MsoNormal">Another question is will we allow more than one email address SAN?<u></u><u></u></p></div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">thanks,<br clear="all"><u></u><u></u></p><div><div><div><div><div><div><div><div><div><div><div><p><span style="font-family:"Segoe Script"">Wendy</span><u></u><u></u></p><p><span style="font-size:9.5pt">Wendy Brown<br>Supporting GSA FPKI<br>Protiviti Government Services</span><u></u><u></u></p><p> 703-965-2990 (cell)<u></u><u></u></p><p><a href="mailto:wendy.brown@gsa.gov" target="_blank"><span style="font-size:9.5pt">wendy.brown@gsa.gov</span></a><br><a href="mailto:wendy.brown@protiviti.com" target="_blank">wendy.brown@protiviti.com</a><u></u><u></u></p></div></div></div></div></div></div></div></div></div></div></div><p class="MsoNormal"><u></u> <u></u></p></div></div><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal">On Fri, Nov 20, 2020 at 6:19 AM Dimitris Zacharopoulos (HARICA) via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>> wrote:<u></u><u></u></p></div><blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in"><div><p class="MsoNormal" style="margin-bottom:12pt"><br>I believe this proposal prohibits <i>directoryName </i>values<i> </i>in the subjectAltName extention. I remember that the intent of the first version of S/MIME requirements was not to prohibit identity information to be included in the Certificate Profile.<br><br>Dimitris.<br><br><u></u><u></u></p><div><p class="MsoNormal">On 20/11/2020 12:11 π.μ., Stephen Davidson via Smcwg-public wrote:<u></u><u></u></p></div><blockquote style="margin-top:5pt;margin-bottom:5pt"><div><p class="MsoNormal">To date our discussion related to email addresses in S/MIME has been a general reference to rfc822Name along the lines of:<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal" style="margin-left:0.5in">Extension ID: subjectAlternateName<u></u><u></u></p><p class="MsoNormal" style="margin-left:0.5in">Required?: Yes<u></u><u></u></p><p class="MsoNormal" style="margin-left:0.5in">Critical: Yes if the subject is an empty sequence; otherwise, SHOULD NOT be critical<u></u><u></u></p><p class="MsoNormal" style="margin-left:0.5in">Permitted Value(s): MUST contain at least one rfc822Name value. MUST NOT contain values of type: dNSName, iPAddress, uniformResourceIdentifier. otherName values (such as Microsoft UPN) MAY be included if the value is identical to an rfc822Name expressed in the SAN extension. Any rfc822Name and otherName value in the Subject DN must be repeated in the SAN extension. Each rfc822Name and otherName value must be verified with publicly documented and audited measures in accordance with Section 3.2.2.<u></u><u></u></p><p class="MsoNormal" style="margin-left:0.5in">References: RFC 5280, Section 4.2.1.6<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">S/MIME and rfc822Name has enjoyed a proliferation of standards which leads to the question:<u></u><u></u></p><ul type="disc"><li class="MsoNormal">Do we wish to summarise those rules relating to rfc822Name in this standard or in an informative appendix?<u></u><u></u></li><li class="MsoNormal">Or do wish simply to provide a listing of the relevant standards?<u></u><u></u></li></ul><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">If the latter, I believe the most relevant would include RFC 5322 (internet message format, sections 3.2.3 and 3.4.1), RFC 3696 (informational, checking of names), and RFC 8398 (internationalized email addresses).<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Missing anything? Comments?<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Best regards, Stephen<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">RFC 5322: <a href="https://tools.ietf.org/html/rfc5322" target="_blank">https://tools.ietf.org/html/rfc5322</a><u></u><u></u></p><p class="MsoNormal">RFC 3696: <a href="https://tools.ietf.org/html/rfc3696" target="_blank">https://tools.ietf.org/html/rfc3696</a><u></u><u></u></p><p class="MsoNormal">RFC 8398: <a href="https://tools.ietf.org/html/rfc8398" target="_blank">https://tools.ietf.org/html/rfc8398</a><u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p></div><p class="MsoNormal"><u></u> <u></u></p><pre>_______________________________________________<u></u><u></u></pre><pre>Smcwg-public mailing list<u></u><u></u></pre><pre><a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><u></u><u></u></pre><pre><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><u></u><u></u></pre></blockquote><p class="MsoNormal"><u></u> <u></u></p></div><p class="MsoNormal">_______________________________________________<br>Smcwg-public mailing list<br><a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><u></u><u></u></p></blockquote></div></div></div></blockquote></div>