<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On May 3, 2021, at 1:21 PM, Corey Bonnell via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" class="">smcwg-public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hello,<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">As discussed on last week’s call, we indicated a desire to require validation of email addresses that are contained in a subset of SAN types. I think we all agreed that rfc822Names must be validated, but there was a discussion on otherNames. The IANA registry for otherNames is located here:<span class="Apple-converted-space"> </span><a href="https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.8" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.8</a><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">From this registry, the only entry that I can see as requiring validation in an S/MIME context is id-on-SmtpUTF8Mailbox (which I brought up on the call); all the other ones appear to be unrelated. Given this, I believe for the legacy profile, we can safely state that all rfc822Names and otherNames of type id-on-SmtpUTF8Mailbox must be validated and otherNames of any other type do not need to be validated (such as UPN, etc).<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thoughts?<o:p class=""></o:p></div></div></div></blockquote><br class=""></div><div>I agree that id-on-SmtpUTF8Mailbox needs to be validated, if it is present. You can learn more about it in RFC 8398.</div><div><br class=""></div><div>Russ</div><br class=""></body></html>