Subject: Re: [idn] IDN security and ACE leakage

From: "Soobok Lee" <[email-masked]>
Date: Sun, 15 Jul 2001 15:02:43 +0900

some corrections.
AMC-ACE-Z  uses "base36" encoding which includes '0' '1' 'l' 'o'.
It is the DUDE and AMC-ACE-W that avoid  using the four.

----- Original Message ----- 
From: "Soobok Lee" <[email-masked]>
To: <[email-masked]>; "Martin Duerst" <[email-masked]>
Sent: Sunday, July 15, 2001 1:11 PM
Subject: Re: [idn] IDN security and ACE leakage

> DUDE and AMC-ACE-Z (not RACE,ACE37) already  avoid 
> using '0', 'o', '1', 'l'  in its base 32 encoding 
> for security reasons. It is a nice feature. 
>  
> ----- Original Message ----- 
> From: "Martin Duerst" <[email-masked]>
> To: "Soobok Lee" <[email-masked]>; <[email-masked]>
> Sent: Sunday, July 15, 2001 12:54 PM
> Subject: Re: [idn] IDN security and ACE leakage
> 
> 
> > 'l' and '1' and 'I' ('ell' and 'one' and 'upper-case i') are
> > almost indistinguishable. For security reasons, DNS-capable email
> > programs (i.e. every email program) may display an email
> > address using hexadecimal (ACE won't work).
> > 
> > How many programs actually do this?
> > 
> > Regards,   Martin.
> > 
> > At 12:16 01/07/15 +0900, Soobok Lee wrote:
> > >Latin 'o' and Greek 'o'  are almost indistinguishable ,
> > >(and I can list up hundreds of such examples.)
> > >but their ACE labels  often look very different.
> > >
> > >For security reasons, IDN-capable email programs
> > >may display an IDN email address
> > >  both in its original scripts and in its ACEed form
> > >  to encourage  instant verification  like this:
> > >"FullName <[email-masked]>" [[email-masked]]
> > >
> > >It's more secure but looks ugly. shorter ACE labels may help.
> > >ACE labels are better than appended hexadecimal dump of utf8 lables
> > >for this purpose.
> > >
> > >Soobok Lee
> > 
>

---

From: "Adam M. Costello" <[email-masked]>
Date: Sun, 15 Jul 2001 06:35:04 +0000

> It is the DUDE and AMC-ACE-W that avoid using the four.

Right.  DUDE and AMC-ACE-W use bitwise operations, and can therefore use
only 32 characters.  Since 4 characters had to be left out anyway, it
made sense to leave out the visually confusing ones.

AMC-ACE-Z, on the other hand, does not use bitwise operations, and can
therefore utilize all the characters.

AMC