Bugtraq: Re: Thoughts and a possible solution on homograph attacks

[Riccardo Murri <murri () dmmm uniroma1 it>]

[Paul Smith, Fri, Mar 11, 2005 at 10:42:47AM +0000]
> My proposal would be:
>
> 1) IDNs only allowed on ccTLDs (not gTLDs). After all , the whole point of 
> IDNs is to have a domain name in the locally readable script to target 
> people within your own region/nation/etc. gTLDs are to have domains to 
> target people globally. I see no purpose (other than vanity) to having an 
> IDN in a gTLD .
>
> 2) IDNs should only be allowed to consist of a single character set - be 
> that Latin, Western European, Japanese, Cyrillic etc.
>
> 3) A ccTLD should only allow IDNs in their local character set(s). So, you 
> couldn't have a cyrillic IDN on a .us domain, and you couldn't have a greek 
> IDN on a .ru domain.
>
> (4) A domain registry's DRS system should take into account 
> homograph/pseudograph attacks.
>
> (5) Possibly any domains containing only characters which are graphically 
> equivalent to latin characters should not be allowed, but I'm not sure of 
> this one.
I would rather suggest that the string comparison function used in IDN
takes "homograph caracters"[1] into account: just like the current DNS
considers 'a' == 'A', the IDN DNS should consider "LATIN SMALL LETTER
a" == "CYRILLIC SMALL LETTER a" == "CYRILLIC CAPITAL LETTER A" ==
"GREEK CAPITAL LETTER A"[2], and similarly for the other homograph chars.

A true fix in this way cannot be implemented browser-side, but rather
in the IDN implementation; still, one can make the browser put the IDN
names in a *canonical form* using this equivalence relation: that is,
"CYRILLIC SMALL LETTER a" in a hostname is always sent on the wire as
a "LATIN SMALL LETTER a".

Riccardo


[1] or whatever the correct term for these is...

[2] so, the transitive closure of the (uppercase == lowercase) and the
homograph equivalence relation implies for instance "LATIN CAPITAL
LETTER A" == "GREEK SMAL LETTER \alpha", which are not homograph, but
I see less harm in this than in the current IDN.

-- 
Riccardo Murri
EGRID Project
The Abdus Salam ICTP

Strada Costiera, 11
34016 Trieste
Italy

email: riccardo.murri () ictp it
phone: +39 040-2240-542
fax:   +39 040-224531