[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [Ltru] [psg.com #967] address homograph issues in securityconsiderations



> From: ltru-bounces at lists.ietf.org [mailto:ltru-bounces at lists.ietf.org]
On Behalf Of
> John Cowan


> As long as everything is cased consistently, there is no problem, but
if someone
> uses anomalous casing, these would become a problem under your
proposal.
> I propose therefore that only zero/oh, one/eye, and one/ell be treated
as
> confusables; these could arise only in variant subtags.

As John notes, there isn't an issue for subtags from ISO source
standards when casing conventions are applied, though there certainly
could be when they are not -- e.g. "ia" and "la" in ISO 639-1 -- but we
don't want to prohibit such on the basis of failure to apply casing
conventions: a security-conscious app *should* apply the casing
conventions if displaying these tags in a UI. 

As John also notes, zero/Oh, one/Eye and one/el issues can arise for
variants, and we should ensure that they are prevented. They can also
arise for the registered-lang subtag, and that should also be prevented.

The registered-lang subtags is also susceptible to the el / "Eye" issue
since there are no casing conventions for this subtag. I think we should
be adding prevention for that as well.

Since extensions cannot be interpreted without reference to other RFCs,
I don't think we need to worry about homographs within extensions.



Peter Constable

_______________________________________________
Ltru mailing list
Ltru at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/ltru




Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.