Subject: [idn] spoofing by combining diacritical marks

From: "Soobok Lee" <[email-masked]>
Date: Wed, 29 Aug 2001 09:15:52 +0900

Hi,
To exemplify what JCK pointed out,
I took two experiments with two labels with <acute>.
Look into the enclosed excerpts.

The second  one  has   <acute><acute>,but look the same with single-<acute> one.

Does this problem come from the rendering engine (of win2k)
or from the definition of <acute> itself ?

Soobok Lee
---------------------------------------------------------------------------------------------------------------

www.k%u0301ol.com

www.ḱol.com

www.k%u0301%u0301ol.com

www.ḱ́ol.com

<html>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<body>
<Script>
str=("www.k%u0301ol.com");
document.write("<br><font size=+1 face='Times New Roman'>");
document.writeln(str);
document.write("<br><p><font size=+3 face='Times New Roman'>");
document.writeln(unescape(str)); document.write("</font><br><p>");
</script>
<Script>
str=("www.k%u0301%u0301ol.com");
document.write("<br><font size=+1 face='Times New Roman'>");
document.writeln(str);
document.write("<br><p><font size=+3 face='Times New Roman'>");
document.writeln(unescape(str)); document.write("</font><br><p>");
</script>

http://www.postel.co.kr/etc/f2.html

---

From: "Soobok Lee" <[email-masked]>
Date: Thu, 30 Aug 2001 09:19:57 +0900

More self-comment:

  Current unicode standard have _no_  normalization rules on
    repeated <acute>s ( and other diacritical marks)  to prevent them from
    looking differently according to their positions in unicode strings.

  The second <Acute> in the <acute><Acute> does not display in some
  cases.

  This problem is somewhat out of IDN WG scope and should be reviewed
  by relevant  standard organizations.

  Zone masters should be aware of this and filter out  spoofing domains..

 Soobok Lee

---

From: "Soobok Lee" <[email-masked]>
Date: Thu, 30 Aug 2001 09:36:50 +0900

I found   all unicode characters with some _COMBINING SEMANTICS_
share the same problem.

To list some of them:
  Hangul fillers, Various signs in Hindi(Devanagari) and other Indian scripts,
  Combining Diacrticial Marks

We need some "registration guidelines" informational RFC to inform
zone-masters of this problem.

Soobok Lee

---

From: "Mark Davis" <[email-masked]>
Date: Wed, 29 Aug 2001 19:34:59 -0700

The standard *does* specify the appropriate display behavior for such
circumstances. See http://www.unicode.org/unicode/uni2book/ch02.pdf, Section
2.6.

However, some implementations may not yet implement that behavior.

Mark

—————

Γνῶθι σαυτόν — Θαλῆς
[http://www.macchiato.com]

---

From: Martin Duerst <[email-masked]>
Date: Thu, 30 Aug 2001 11:43:39 +0900

>     looking differently according to their positions in unicode strings.

Sorry, I don't understand that. Two acute accents after a
character are supposed to be displayed as two acute accents.
There is no need for normalization, because there is only
one way to have a sequence of two acute accents.

>   The second <Acute> in the <acute><Acute> does not display in some

That's a rendering problem. The implementation you use should needs
to be fixed.

Regards,   Martin.

---

From: "Soobok Lee" <[email-masked]>
Date: Thu, 30 Aug 2001 12:24:56 +0900

You are right.

The standard is specifying that double <Acute>s should be displayed with
stacked <acute>s  above the base character. But Win2K/98 doesn't display
them correctly. If <acute> is repeated 10 times, that is beyond most commercial
rendering engine's capability and that can be utilized for spoofing
ONly feasible solution to this problem is  prohibiting them by zone-masters,i believe.

BTW, Unicode Standard Chap2. Section 2.6, Figure 2-10 has an example:

  <latin a><combining dot below><combining dot above>
  <latin a><combining dot above><combining dot below>

 These two sequences are defined to have the same look
 But, I can't find yet any _NORMALIZATION_ rules to unify them.

 Does unicode standards have any rules to unify them  ?

 Soobok

---

From: "James Seng/Personal" <[email-masked]>
Date: Thu, 30 Aug 2001 13:14:49 +0800

What I am hearing is you are asking *standard* to avoid a problem
created by a *broken* implementation. This is too far fetched for me to
understand.

The right thing to do, engineering speaking, is to fix the broken
implementation.

-James Seng

----- Original Message -----
From: "Soobok Lee" <[email-masked]>
To: "Mark Davis" <[email-masked]>; <[email-masked]>
Sent: Thursday, August 30, 2001 11:24 AM
Subject: Re: [idn] spoofing by combining diacritical marks

> ----------------------------------------------------------------------
----
> > -------------------------------------
> > > >
> > > > www.k%u0301ol.com
> > > >
> > > > www.ḱol.com
> > > >
> > > >
> > > >
> > > > www.k%u0301%u0301ol.com
> > > >
> > > >
> > > > www.ḱ́ol.com
> > > >
> > > >
> > > >
> > > > <html>

---

From: "Soobok Lee" <[email-masked]>
Date: Thu, 30 Aug 2001 14:47:58 +0900

Yes, if it is wrong, MS should fix it. But  I guess MS and other implementors would
 like to make a threshold on the max length
of  a sequence of  combining marks  for  single  base character. that is, there may be
some ignored marks in rendering time and that breaks the "unique look" constraint.

Anyway,  now, most people are using  Win2k/9x . aren't they?
Until MS finishes  fixing the rendering engine and  most people use the patched one,
allowing <acute><acute> in IDN label  should be postponed for security reasons.

"Postpone" cannot be put into nameprep, mechanical filtering.   clear.
"Guidelines for zone-masters", optional human filtering in registration phase,
 is the only feasible choice in this case.

That was my point   not clearly  described in my previous email.

Soobok

---

From: "James Seng/Personal" <[email-masked]>
Date: Thu, 30 Aug 2001 14:34:12 +0800

> Yes, if it is wrong, MS should fix it. But  I guess MS and other
> implementors would like to make a threshold on the max length

There is no "I guess" in a standard. It is either it is compilence to a
standard or it is not.

> Until MS finishes  fixing the rendering engine and  most people use
the
> patched one, allowing <acute><acute> in IDN label  should be postponed
> for security reasons.

And the problem is? IETF has never been bias on any platform and I dont
expect we started to change our protocol just to accomodate any platform
in particular.

>  is the only feasible choice in this case.

I disagree. What makes you sure that there wouldn't be a valid reason to
use a double or triple accute?

-James Seng

---

From: "James Seng/Personal" <[email-masked]>
Date: Thu, 30 Aug 2001 14:52:33 +0800

If that is your intention, then it should not be in Nameprep. The
intention of Nameprep is for prepation for name matching. People who
reads Nameprep are implementors of IDN, not administrator.

What you are looking for is a Best Current Practice draft for operation
of IDN. Currently there is none so my best suggestion is to write a new
I-D on this.

-James Seng

> We seem to have different ideas  about  what "registration guideline"
should be like !
>
> THe "Guidelines"  _won't_ force every zone-master to follow it.
> I _will_ register double or triple <acute>s in my private zone even
with the guidelines!
>
> The guidelines only suggest, not enforce.
>
> It will advice " there are  some dangers
> in allowing various i18n characters in a label, be careful! "
>
> Do you have a different idea ?  enforcing one like nameprep ?
>
> Soobok
>
> > -James Seng
> >
>

---

From: "Soobok Lee" <[email-masked]>
Date: Thu, 30 Aug 2001 15:47:02 +0900

----- Original Message ----- 
> use a double or triple accute?
 
We seem to have different ideas  about  what "registration guideline" should be like !

THe "Guidelines"  _won't_ force every zone-master to follow it.
I _will_ register double or triple <acute>s in my private zone even with the guidelines!

Soobok

---

From: Martin Duerst <[email-masked]>
Date: Thu, 30 Aug 2001 13:58:53 +0900

>  Does unicode standards have any rules to unify them  ?

This is one of the main jobs of NFC (and by extension, of NFKC).

I suggest that ask such questions on a different list, e.g.
[email-masked].

Regards,   Martin.

---

From: "Mark Davis" <[email-masked]>
Date: Wed, 29 Aug 2001 19:34:59 -0700

Mark

—————

Γνῶθι σαυτόν — Θαλῆς

---

From: "Mark Davis" <[email-masked]>
Date: Thu, 30 Aug 2001 07:21:03 -0700

A display engine should differentiate between one acute and two acutes.
However, if it doesn't distinguish between 9 acutes and 10 acutes, the
likelyhood of that being used for spoofing is, shall we say, extremely
remote. Someone would have to have a legitimate URL with a singe character
having 9 acutes on it, for someone else to spoof it with 10.

BTW, the recommended fallback, when an accent cannot be properly stacked or
applied to the previous character, is to display it over a dotted circle
after the original base. There is information on this in chapter 5.

The newer versions of systems, using technology such as OpenType, do allow
the proper display of multiple accents.

Mark
—————

Γνῶθι σαυτόν — Θαλῆς

---

From: Mike Astle <[email-masked]>
Date: Thu, 30 Aug 2001 16:38:24 +0000 (GMT)

Is anyone working on such a document?

---

From: "Soobok Lee" <[email-masked]>
Date: Fri, 31 Aug 2001 01:43:19 +0900

IMO,  BCP for IDN is the right place to put  these things:

   :   unassigned code points ( also in nameprep already)
   :   defective combining sequences
          -  umcombined diacritical mark and signs ( <acute>.com)
          -  invalid hangul jamo sequences   
   :   defective-rendering-engine-oriented  "equivalence"
         -  <acute><acute> vs <acute>
   :   similarly-looking characters that can be used for spoofing
         -  <latin 8> and  <bengali 4>
         -  <latin B> and  <cyrillic b>
         -  katakana ka and chinses 'power' letter
   :   special characters (mathematical,dingbets,music signs ...)
   :   other equivalences  relevant to  IPR issues
  
If  and only if TC/SC/Kanji/Hanja equivalences  can't be in nameprep,
  it may be put into here.

May BCP(as informational RFC) be revised and evolved 
even after it is finalized with the minimal set of guidelines for 
idn identifier security ?  
 
I have found some BCPs in the IETF homepage.

  3. http URL:draft-bouwen-megaco-isdn-bcp-01.txt
    Summary
    Title: Best Current Practice for Megaco-Sigtran Interaction in ISDN Acces...

  9. http URL:draft-nickless-ipv4-mcast-bcp-01.txt
    Summary
    Title: IPv4 Multicast Best Current Practice

I am not  a fulltime IETF participants like most of you.
I think  several co-authors with diverse expertise 
should work together to finish this BCP in timely manner.

Soobok

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 30 Aug 2001 09:55:38 -0700

>I am not  a fulltime IETF participants like most of you.

Most of us are not "fulltime IETF participants". We have real jobs 
and participate in the IETF either as a small part of those jobs, or 
in our spare time because we feel that it is important. To the best 
of my knowledge, *none* of the people who you see posting regularly 
on this mailing list have the IETF as a full-time job.

>should work together to finish this BCP in timely manner.

The first step is to start it. You have already posted a wide variety 
of different ideas as messages on this mailing list, and others have 
posted ideas as well. This is an excellent time for someone (maybe 
you?) to start collecting them into a cohesive Internet Draft that 
the Working Group could look at. Doing so would certainly help gain 
support for the whole concept, and would help focus the Working Group 
as well.

--Paul Hoffman, Director
--Internet Mail Consortium