RE: [Ltru] [psg.com #967] address homograph issues insecurityconsiderations

["Addison Phillips" <addison.phillips at quest.com>]

Note that confusables cannot appear in the registry: registry entries are always lowercase excepting regions (uppercase) and scripts (titlecase). Scripts and ISO 3166 codes are both alpha-only (no digits!!)

Confusables can only affect language tags. These tags will not be well-formed excepting the use of 0/o and 1/l in primary language tags and variants.

So then... would this text work (in possibilities for registration section??):

<t>Language tags are formed from ASCII letters and digits. Some of these characters may be confused when displayed in certain fonts in certain user interfaces. In well-formed tags (where all of the subtags are actually valid), the only subtags that are affected are registered primary-language subtags (those longer than four characters, none of which exist at the time of adoption of this document) or variant subtags. The character pairs normally considered confusable in these subtags are 0 vs. O (%x30 vs. %x4F) and 1 and l (%x31 vs. %x6c). No subtags will be permitted for registration that differ only by these character pairs. For example, if a subtag 'example' (%x65.78.61.6d.70.6c.65) were registered as a variant, the subtag 'examp1e' (%x65.78.61.6d.70.31.65) would not be valid for registration. In addition, applications for registration that present obviously confusable sequences (such as 'examp1e') will probably be rejected.</t>

Addison

Addison P. Phillips
Globalization Architect, Quest Software
Chair, W3C Internationalization Core Working Group

Internationalization is not a feature.
It is an architecture. 

> -----Original Message-----
> From: ltru-bounces at lists.ietf.org [mailto:ltru-bounces at lists.ietf.org] On
> Behalf Of Peter Constable
> Sent: 2005?5?23? 14:20
> To: ltru at ietf.org
> Subject: RE: [Ltru] [psg.com #967] address homograph issues
> insecurityconsiderations
> 
> > From: ltru-bounces at lists.ietf.org [mailto:ltru-bounces at lists.ietf.org]
> On Behalf Of
> > John Cowan
> 
> 
> > As long as everything is cased consistently, there is no problem, but
> if someone
> > uses anomalous casing, these would become a problem under your
> proposal.
> > I propose therefore that only zero/oh, one/eye, and one/ell be treated
> as
> > confusables; these could arise only in variant subtags.
> 
> As John notes, there isn't an issue for subtags from ISO source
> standards when casing conventions are applied, though there certainly
> could be when they are not -- e.g. "ia" and "la" in ISO 639-1 -- but we
> don't want to prohibit such on the basis of failure to apply casing
> conventions: a security-conscious app *should* apply the casing
> conventions if displaying these tags in a UI.
> 
> As John also notes, zero/Oh, one/Eye and one/el issues can arise for
> variants, and we should ensure that they are prevented. They can also
> arise for the registered-lang subtag, and that should also be prevented.
> 
> The registered-lang subtags is also susceptible to the el / "Eye" issue
> since there are no casing conventions for this subtag. I think we should
> be adding prevention for that as well.
> 
> Since extensions cannot be interpreted without reference to other RFCs,
> I don't think we need to worry about homographs within extensions.
> 
> 
> 
> Peter Constable
> 
> _______________________________________________
> Ltru mailing list
> Ltru at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/ltru


_______________________________________________
Ltru mailing list
Ltru at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/ltru