lightninglabs / lightninglabs/taproot-assets
[enhancement]: Mitigate homograph attacks from human-interpreted strings
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 525
- Forks
- 150
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
### Background
As a `taproot-assets user` I want to `only need to visually inspect an asset name` in order to `confirm that a bootstrapped asset has the name I believe it should have`
As a `taproot-assets asset issuer` I want to `ensure that my asset name cannot be confused with visually indistinguishable asset names` in order to `preserve my asset's name recognition and deny fraud`
----
Given that many unicode glyphs appear visually indistinguishable from each other but map to different code points, there is a potential attack vector against humans visually comparing asset names in which an attacker could attempt to defraud a user by using two homoglyphs. Domain names call this the [IDN homograph attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)
### Mitigation options
- [ ] Enforce ASCII-only names. Upside: simple Downside: Excludes non-English language asset names
- [ ] Use [Punycode](https://en.wikipedia.org/wiki/Punycode) or equivalent to excluding homographs and enforce those in tapd
- [ ] Allow Homographs but add a visual fingerprint (for the homograph attackable fields) for users to easily detect naming mismatches
### Strings sensitive homograph attacks:
- Asset names
- Universe servers
- TODO: enumerate more areas
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are identified. Start by choosing and specifying a mitigation for asset names and Universe servers, enumerate other affected strings, and define tests that demonstrate homograph attacks are prevented or made visibly detectable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100