<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">In response to incident
</span><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1724458" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">1724458 - Sectigo: Mojibake in certificate Subject fields (mozilla.org)</a><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">,
I created a zlint and tested it against all pre-certificates in the crt.sh that contain at least an organization name (to exclude DV certificates), there is still some room for improvement, but I think that the results are useful.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><span style="background-color:rgb(255, 255, 255);display:inline !important">I attached the initial report so that we can discuss the finding with the validation
subcommittee.</span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Findings include <span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important">
certificates</span>:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<ul>
<li><span><span style="background-color:rgb(255, 255, 255);display:inline !important">who mix scripts, for example the Greek script with the Latin script, often the incorporation suffix ΑΕ</span></span></li><li><span><span style="background-color:rgb(255, 255, 255);display:inline !important">with a U+FEFF or U+200B (Zero Width No-Break Space / Zero Width Space) character</span></span></li><li><span><span style="background-color:rgb(255, 255, 255);display:inline !important">containing a symbol U+FFFD (Replacement Character)</span></span></li><li><span><span style="background-color:rgb(255, 255, 255);display:inline !important"><span style="margin:0px"><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">containing a symbol U+00A4 (Currency Sign)</span></span><br>
</span></span></li><li><span><span style="background-color:rgb(255, 255, 255);display:inline !important"><span style="margin:0px"><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important">...</span></span></span></span></li></ul>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div>To my understanding scripts are normally not mixed to prevent script spoofing (this would for example permit a homograph attack in IDN). In CJK (Chinese, Japanese, and Korean as in the Han, Katakana, Hiragana scripts) it does seem to be common to mix
scripts. I also do see a few cases where scripts are combined with Latin characters, for example in addresses, this might be fine but would be good to discuss.</div>
<div><br>
</div>
<div>The source of the current lint (WIP) can be found at:</div>
<div><a href="https://github.com/zmap/zlint/compare/master...pkic:SubjectDNScript?expand=1">Comparing zmap:master...pkic:SubjectDNScript · zmap/zlint (github.com)</a><br>
</div>
<div><br>
</div>
<div>Paul</div>
</div>
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</body>
</html>