Re: [http-auth] [Technical Errata Reported] RFC7804 (5496)

[Benjamin Kaduk <[e-mail]>]

Though now that I go to actually verify it...

On Sat, Sep 08, 2018 at 09:51:15PM +0100, Alexey Melnikov wrote:
> This looks correct to me.
> 
> On 08/09/2018 14:51, RFC Errata System wrote:
> > The following errata report has been submitted for RFC7804,
> > "Salted Challenge Response HTTP Authentication Mechanism".
> > 
> > --------------------------------------
> > You may review the report below and at:
> > http://www.rfc-editor.org/errata/eid5496
> > 
> > --------------------------------------
> > Type: Technical
> > Reported by: Peter Occil <[e-mail]>
> > 
> > Section: 2.2
> > 
> > Original Text
> > -------------
> >    o  Normalize(str): Apply the Preparation and Enforcement steps
> >       according to the OpaqueString profile (see [RFC7613]) to a UTF-8
> >       [RFC3629] encoded "str".  The resulting string is also in UTF-8.
> >       Note that implementations MUST either implement OpaqueString
> >       profile operations from [RFC7613] or disallow the use of non
> >       US-ASCII Unicode codepoints in "str".  The latter is a particular
> >       case of compliance with [RFC7613].
> > 
> > 
> > Corrected Text
> > --------------
> >    o  Normalize(str): Apply the Preparation and Enforcement steps
> >       according to the OpaqueString profile (see [RFC7613]) to a UTF-8
> >       [RFC3629] encoded "str".  The resulting string is also in UTF-8.
> >       Note that implementations MUST either implement OpaqueString
> >       profile operations from [RFC7613] or disallow the use of Unicode 
> >       codepoints not ranging from U+0020 to U+007E in "str".  The latter
> >       is a particular case of compliance with [RFC7613].

... perhaps it would be better to avoid the double-negative and fencepost
questions by saying """or only allow the use of Unicode codepoints ranging
from U+0020 to U+007E (inclusive) in "str"."""

-Benjamin

> > 
> > 
> > Notes
> > -----
> > Control code points (including the ASCII controls U+0000 to U+001F as well as U+007F) are disallowed in the PRECIS FreeformClass, which the OpaqueString profile uses.  Thus it's not enough to just disallow non-US-ASCII codepoints (rather than implement the full OpaqueString profile) to comply with a subset of the OpaqueString profile.
> > 
> > Instructions:
> > -------------
> > This erratum is currently posted as "Reported". If necessary, please
> > use "Reply All" to discuss whether it should be verified or
> > rejected. When a decision is reached, the verifying party  
> > can log in to change the status and edit the report, if necessary. 
> > 
> > --------------------------------------
> > RFC7804 (draft-ietf-httpauth-scram-auth-15)
> > --------------------------------------
> > Title               : Salted Challenge Response HTTP Authentication Mechanism
> > Publication Date    : March 2016
> > Author(s)           : A. Melnikov
> > Category            : EXPERIMENTAL
> > Source              : Hypertext Transfer Protocol Authentication
> > Area                : Security
> > Stream              : IETF
> > Verifying Party     : IESG
> > 
>