Re: [http-auth] [Technical Errata Reported] RFC7804 (5496)

[Benjamin Kaduk <[e-mail]>]

I'd like to hear from Alexey before I do anything to this, but
this seems correct on first look.

-Ben

On Sat, Sep 08, 2018 at 06:51:46AM -0700, RFC Errata System wrote:
> The following errata report has been submitted for RFC7804,
> "Salted Challenge Response HTTP Authentication Mechanism".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5496
> 
> --------------------------------------
> Type: Technical
> Reported by: Peter Occil <[e-mail]>
> 
> Section: 2.2
> 
> Original Text
> -------------
>    o  Normalize(str): Apply the Preparation and Enforcement steps
>       according to the OpaqueString profile (see [RFC7613]) to a UTF-8
>       [RFC3629] encoded "str".  The resulting string is also in UTF-8.
>       Note that implementations MUST either implement OpaqueString
>       profile operations from [RFC7613] or disallow the use of non
>       US-ASCII Unicode codepoints in "str".  The latter is a particular
>       case of compliance with [RFC7613].
> 
> 
> Corrected Text
> --------------
>    o  Normalize(str): Apply the Preparation and Enforcement steps
>       according to the OpaqueString profile (see [RFC7613]) to a UTF-8
>       [RFC3629] encoded "str".  The resulting string is also in UTF-8.
>       Note that implementations MUST either implement OpaqueString
>       profile operations from [RFC7613] or disallow the use of Unicode 
>       codepoints not ranging from U+0020 to U+007E in "str".  The latter
>       is a particular case of compliance with [RFC7613].
> 
> 
> Notes
> -----
> Control code points (including the ASCII controls U+0000 to U+001F as well as U+007F) are disallowed in the PRECIS FreeformClass, which the OpaqueString profile uses.  Thus it's not enough to just disallow non-US-ASCII codepoints (rather than implement the full OpaqueString profile) to comply with a subset of the OpaqueString profile.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC7804 (draft-ietf-httpauth-scram-auth-15)
> --------------------------------------
> Title               : Salted Challenge Response HTTP Authentication Mechanism
> Publication Date    : March 2016
> Author(s)           : A. Melnikov
> Category            : EXPERIMENTAL
> Source              : Hypertext Transfer Protocol Authentication
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG