Subject: RE: [Ltru] [psg.com #967] address homograph issues in securityconsiderations

From: "Peter Constable" <[email-masked]>
Date: Thu, 12 May 2005 08:30:18 -0700

> From: [email-masked] [mailto:[email-masked]]
On
> Behalf Of Randy Presuhn

> > Comment
> > http://www.ietf.org/mail-archive/web/ltru/current/msg00540.html
> > reads:
> > "39. 4. An important security consideration is homographs. It is
> > certainly possible to include part of text in a foreign language
which
> > look printed as in another language or having a different meaning or
> > printing (phishing). Concerns are also the double "-" which is
> > specifically used by the IANA code "xn"."

> Perhaps this one might be accomodated by including an explicit
statement
> about how the repertoire for creating language tags makes homographs a
> non-issue (at least in a well-designed font) for the tags themselves.

Because the character repertoire permitted in our protocol elements is
limited to a-z, A-Z, 0-9 and "-" (with no two consecutive "-"s allowed),
I believe the only homograph issue is between LATIN SMALL LETTER L and
DIGIT ONE.

Since the ISO source standards we use all use alpha-only IDs, and the
M.49 numeric IDs are numeric only, the only potential for confusion
exists in registered variants. We might consider imposing a requirement
on subtag registrations that no subtag may be registered if it differs
from an existing subtag only by substitution of confusables (l and 1).
If we want to do that, we might also want to make this a requirement on
extension RFCs.

Peter Constable

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 12 May 2005 09:30:41 -0700

Hi -

> From: "Peter Constable" <[email-masked]>
> To: "LTRU Working Group" <[email-masked]>
> Sent: Thursday, May 12, 2005 8:30 AM
> Subject: RE: [Ltru] [psg.com #967] address homograph issues insecurityconsiderations

...
> I believe the only homograph issue is between LATIN SMALL LETTER L and
...

as a contributor...

That's why I wrote "well-designed font".  If O/0 and I/l/1 (z/3 g/8, f/h/s,
m/nn, u/v in extreme cases) are not visually distinct, then, in my opinion,
it's not a well-designed font.

Randy