From: Justin Richer <jricher@mit.edu>
To: RFC Errata System <rfc-editor@rfc-editor.org>
Thread-Topic: [OAUTH-WG] [Editorial Errata Reported] RFC7636 (8458)
Thread-Index: AQHb3EvC7f7Ef+5HzkG9D6nC8BmZRrQCgmyjgAABWUQ=
Date: Sat, 14 Jun 2025 11:21:03 +0000
Message-ID: 
 <LV8PR01MB867787802DDF43BE68B62D94BD76A@LV8PR01MB8677.prod.exchangelabs.com>
References: <20250613101218.4B876265CD6@rfcpa.rfc-editor.org>
 <LV8PR01MB8677D99EDA22900C1B0FF772BD76A@LV8PR01MB8677.prod.exchangelabs.com>
In-Reply-To: 
 <LV8PR01MB8677D99EDA22900C1B0FF772BD76A@LV8PR01MB8677.prod.exchangelabs.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?/+++Q1PKxuKHurZTyOrvNt4BOBbAWEyttk1r6z9gcC/M2QqgabrTqVXkLKn3?=
 =?us-ascii?Q?odTuBNeKPINftaC1x5XAIiGMamslApT65ro3jlBpWXiNj98NEYZfJ0CO/giA?=
 =?us-ascii?Q?hPgun2wWpqY8qD0BB1kHurWNlGiQ7ETHQ+kXIQwoIExpAWUg0vVbpmtmFGO9?=
 =?us-ascii?Q?dsrizDSqipcMQ011O80aQ4n3x2OIkS6sW09BUAzzLTJq3G+4Q8zolOq328+1?=
 =?us-ascii?Q?DE7NgwtfVA9pq6zrrWCX0qEBEwqnnd2YiWUpfJslpu+/QTDvPwxOrorid1C4?=
 =?us-ascii?Q?qqFZq9vVxeYYY6SDUUuURABpDMS3YgyrCdTvJ0TKTvGUXqzq+PG9s5KWQ41H?=
 =?us-ascii?Q?CBwOS0ltU0BpKhS5E+H+KfYpeqgZbkuMp8QC8ywm67ks/PhGwwevVIC2PwNY?=
 =?us-ascii?Q?sJorpK6YKlOt6i/pOb55E1AtXSUlInj5hVyT43nm+QwHkRumzGDWE1q2HOJM?=
 =?us-ascii?Q?lwtF1JC/WNp5BgXjXPe1bFG9xCibaokjicZXYUGrnWPeNg2WBLeBFLKirSRL?=
 =?us-ascii?Q?qNcPrXQtHzYgk2elKUewmn56Yz/s28J6P1kDREpKXgZ/AqFLnWvLkTVsYESU?=
 =?us-ascii?Q?ZXZKPBWH5VVGr2EiDQ1DcQfWTNEgF+Bw2QD28EOC+ZTYcAipnNOfwIcfi9DM?=
 =?us-ascii?Q?P7in+3rEUApqQihzOdanRQg7Xs2s79xAesnqruQlD0QtYD7p3e4Q5Da79Zy6?=
 =?us-ascii?Q?XJC0TzUdRY5DHBWAxl4qfeTam3DJdEWKGvb672SPlp7u+X/QMFo30c9jl8cG?=
 =?us-ascii?Q?XUR6zdGOMh71usHQRIuc90+ggZOrVreXxI7FKOfd5mCcrn4QS7oJTIz80odT?=
 =?us-ascii?Q?slCOndQObtkYCq+kyddXi0ZSW1n/EyF5TgLztXGg51ZobQrmkXwAqpkxrvFW?=
 =?us-ascii?Q?S1IWktdCNoi5vzwp1g9bqYrm+T1G5UrZtNNMU/2y7Po7nURp45Yknb7jCNjm?=
 =?us-ascii?Q?o4z6+S1WW/fHAXA9j1bmHpHwzBbJezNcysaXeGGNXzvBoI3+vMI2DK412Iyg?=
 =?us-ascii?Q?n/6aW74314f/0BdEIpCeT0zTNhhTYP1JXQ6Yafonl6Bpecpn5Exx70+SoMP/?=
 =?us-ascii?Q?kgvHQp3QQHqxvCU/un6CWBkYvRO1v6guGyYkrGnyR2BMrgCZLlnFqiuxMf9A?=
 =?us-ascii?Q?dC5EOkwepe4Pa297mG1dEjB22FvYKAu7H6RZ2nQOty/XDyRn+kxMiySmqXAL?=
 =?us-ascii?Q?9SDMe6dkGooWBrBS2+HSl0mTNQjn3HZ8F/ix+vVgP1F8gDOCStPxYZM76OfM?=
 =?us-ascii?Q?QgrXBnZc9bZjAMElE4WZWBevJIlEaVN42al8JtD6wFEnl4tj9Tr4qxCufzR1?=
 =?us-ascii?Q?VT9llfmNQ2WDQgw8cQH62CruyBNEORVAuWgcLuWEFFLe9LL1HOU9+MumXBN3?=
 =?us-ascii?Q?tSLU3+RazoE5AZFmZksDWvht26w96aQJl/OEwNlWxH37Qs+kv/wvmssMLVtH?=
 =?us-ascii?Q?VfRKCiGVxuYEDcAj1SX6wzBai5KbmdLudn6OUGMcfVtnamAi8ZgRBRt+DZ7r?=
 =?us-ascii?Q?bDzvmN3pKo2pVyQsuUab2/JmPswQ4HxWtEgmgxLmU3/4WRMdk7PhOntz7rkW?=
 =?us-ascii?Q?pVLxFWn01nRS6/7L7J4=3D?=
Content-Type: multipart/alternative;
	boundary="_000_LV8PR01MB867787802DDF43BE68B62D94BD76ALV8PR01MB8677prod_"
MIME-Version: 1.0
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LV8PR01MB8677.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 3d488244-2205-43c4-ec82-08ddab358cc6
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2025 11:21:03.9816
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 x1m2pY+yHHdWFSmA+yLtUiqV4EBzJqNS/JiDqalFNdUNs5Ig68pk1eZTkjnZ6K3p
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA3PR01MB8695
Message-ID-Hash: KXSA3NSRS3TN4367ZKFO54FUD2TQT7JE
X-Message-ID-Hash: KXSA3NSRS3TN4367ZKFO54FUD2TQT7JE
X-MailFrom: jricher@mit.edu
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-oauth.ietf.org-0;
 nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size;
 news-moderation; no-subject; digests; suspicious-header
CC: Jeffrey S Walden <jwalden@mit.edu>,
 "n-sakimura@nri.co.jp" <n-sakimura@nri.co.jp>,
 "naa@google.com" <naa@google.com>, "oauth@ietf.org" <oauth@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BOAUTH-WG=5D_Re=3A_=5BEditorial_Errata_Reported=5D_RFC7636_=2884?=
	=?utf-8?q?58=29?=
List-Id: OAUTH WG <oauth.ietf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/oauth/e6SFmzY39TTdmj1goBpRkDWiSHs>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Owner: <mailto:oauth-owner@ietf.org>
List-Post: <mailto:oauth@ietf.org>
List-Subscribe: <mailto:oauth-join@ietf.org>
List-Unsubscribe: <mailto:oauth-leave@ietf.org>

--_000_LV8PR01MB867787802DDF43BE68B62D94BD76ALV8PR01MB8677prod_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

A minor correction to my email: on this report, the parameter in question i=
s "code challenge" and not "code_verifier" but the rest of the reply stands=
. Copy-paste error on my part, as both errata reports have the same problem=
.

- Justin
________________________________
From: Justin Richer <jricher@mit.edu>
Sent: Saturday, June 14, 2025 7:18 AM
To: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: Jeffrey S Walden <jwalden@mit.edu>; n-sakimura@nri.co.jp <n-sakimura@nr=
i.co.jp>; naa@google.com <naa@google.com>; oauth@ietf.org <oauth@ietf.org>
Subject: Re: [OAUTH-WG] [Editorial Errata Reported] RFC7636 (8458)

This is not an error and the errata should be rejected. As per the ABNF def=
inition in https://www.rfc-editor.org/rfc/rfc5234.html#section-21<https://w=
ww.rfc-editor.org/rfc/rfc5234.html#section-2.1> the name contains "alphabet=
ics, digits, and hyphens (dashes)", and not underscores. I believe the comm=
enter is expecting the ABNF rule name of code-verifier to match the paramet=
er name of code_verifier, but they do not need to be the same. While this i=
s confusing, the text is correct as it stands.

- Justin
________________________________
From: RFC Errata System <rfc-editor@rfc-editor.org>
Sent: Friday, June 13, 2025 6:12 AM
To: rfc-editor@rfc-editor.org <rfc-editor@rfc-editor.org>
Cc: Jeffrey S Walden <jwalden@mit.edu>; n-sakimura@nri.co.jp <n-sakimura@nr=
i.co.jp>; naa@google.com <naa@google.com>; oauth@ietf.org <oauth@ietf.org>
Subject: [OAUTH-WG] [Editorial Errata Reported] RFC7636 (8458)

The following errata report has been submitted for RFC7636,
"Proof Key for Code Exchange by OAuth Public Clients".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8458

--------------------------------------
Type: Editorial
Reported by: Jeff Walden <jwalden@mit.edu>

Section: 4.2

Original Text
-------------
code-challenge =3D 43*128unreserved

Corrected Text
--------------
code_challenge =3D 43*128unreserved

Notes
-----
The ABNF accidentally uses a hyphen/dash rather than an underscore in the c=
ode_challenge name in its rule.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC7636 (draft-ietf-oauth-spop-15)
--------------------------------------
Title               : Proof Key for Code Exchange by OAuth Public Clients
Publication Date    : September 2015
Author(s)           : N. Sakimura, Ed., J. Bradley, N. Agarwal
Category            : PROPOSED STANDARD
Source              : Web Authorization Protocol
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
OAuth mailing list -- oauth@ietf.org
To unsubscribe send an email to oauth-leave@ietf.org

--_000_LV8PR01MB867787802DDF43BE68B62D94BD76ALV8PR01MB8677prod_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
</head>
<body>
<div style=3D"font-family: inherit; font-size: inherit; color: rgb(0, 0, 0)=
; background-color: transparent;">
</div>
A minor correction to my email: on this report, the parameter in question i=
s &quot;<span style=3D"font-family: Roboto, Helvetica, Arial, sans-serif; f=
ont-size: 14.6667px; display: inline !important;">code challenge&quot; and =
not &quot;code_verifier&quot; but the rest of the reply
 stands. Copy-paste error on my part, as both errata reports have the same =
problem.&nbsp;</span>
<div><span style=3D"font-family: Roboto, Helvetica, Arial, sans-serif; font=
-size: 14.6667px; display: inline !important;"><br>
</span></div>
<div><span style=3D"font-family: Roboto, Helvetica, Arial, sans-serif; font=
-size: 14.6667px; display: inline !important;">- Justin&nbsp;</span></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Justin Richer &lt;jri=
cher@mit.edu&gt;<br>
<b>Sent:</b> Saturday, June 14, 2025 7:18 AM<br>
<b>To:</b> RFC Errata System &lt;rfc-editor@rfc-editor.org&gt;<br>
<b>Cc:</b> Jeffrey S Walden &lt;jwalden@mit.edu&gt;; n-sakimura@nri.co.jp &=
lt;n-sakimura@nri.co.jp&gt;; naa@google.com &lt;naa@google.com&gt;; oauth@i=
etf.org &lt;oauth@ietf.org&gt;<br>
<b>Subject:</b> Re: [OAUTH-WG] [Editorial Errata Reported] RFC7636 (8458)</=
font>
<div>&nbsp;</div>
</div>
<div>
<div style=3D"font-family:inherit; font-size:inherit; color:rgb(0,0,0)"></d=
iv>
<div>This is not an error and the errata should be rejected. As per the ABN=
F definition in&nbsp;<a href=3D"https://www.rfc-editor.org/rfc/rfc5234.html=
#section-2.1" data-auth=3D"NotApplicable">https://www.rfc-editor.org/rfc/rf=
c5234.html#section-21</a>&nbsp;the name contains
 &quot;alphabetics, digits, and hyphens (dashes)&quot;, and not underscores=
. I believe the commenter is expecting the ABNF rule name of code-verifier =
to match the parameter name of code_verifier, but they do not need to be th=
e same. While this is confusing, the text
 is correct as it stands.&nbsp;</div>
<div><br>
</div>
<div>- Justin&nbsp;</div>
<hr tabindex=3D"-1" style=3D"display:inline-block; width:98%">
<div id=3D"x_divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" =
color=3D"#000000" data-ogsc=3D"" style=3D"font-size:11pt"><b>From:</b> RFC =
Errata System &lt;rfc-editor@rfc-editor.org&gt;<br>
<b>Sent:</b> Friday, June 13, 2025 6:12 AM<br>
<b>To:</b> rfc-editor@rfc-editor.org &lt;rfc-editor@rfc-editor.org&gt;<br>
<b>Cc:</b> Jeffrey S Walden &lt;jwalden@mit.edu&gt;; n-sakimura@nri.co.jp &=
lt;n-sakimura@nri.co.jp&gt;; naa@google.com &lt;naa@google.com&gt;; oauth@i=
etf.org &lt;oauth@ietf.org&gt;<br>
<b>Subject:</b> [OAUTH-WG] [Editorial Errata Reported] RFC7636 (8458)</font=
>
<div>&nbsp;</div>
</div>
<div class=3D"x_BodyFragment"><font size=3D"2"><span style=3D"font-size:11p=
t">
<div class=3D"x_PlainText">The following errata report has been submitted f=
or RFC7636,<br>
&quot;Proof Key for Code Exchange by OAuth Public Clients&quot;.<br>
<br>
--------------------------------------<br>
You may review the report below and at:<br>
<a href=3D"https://www.rfc-editor.org/errata/eid8458" data-auth=3D"NotAppli=
cable">https://www.rfc-editor.org/errata/eid8458</a><br>
<br>
--------------------------------------<br>
Type: Editorial<br>
Reported by: Jeff Walden &lt;jwalden@mit.edu&gt;<br>
<br>
Section: 4.2<br>
<br>
Original Text<br>
-------------<br>
code-challenge =3D 43*128unreserved<br>
<br>
Corrected Text<br>
--------------<br>
code_challenge =3D 43*128unreserved<br>
<br>
Notes<br>
-----<br>
The ABNF accidentally uses a hyphen/dash rather than an underscore in the c=
ode_challenge name in its rule.<br>
<br>
Instructions:<br>
-------------<br>
This erratum is currently posted as &quot;Reported&quot;. (If it is spam, i=
t <br>
will be removed shortly by the RFC Production Center.) Please<br>
use &quot;Reply All&quot; to discuss whether it should be verified or<br>
rejected. When a decision is reached, the verifying party&nbsp; <br>
will log in to change the status and edit the report, if necessary.<br>
<br>
--------------------------------------<br>
RFC7636 (draft-ietf-oauth-spop-15)<br>
--------------------------------------<br>
Title&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp; : Proof Key for Code Exchange by OAuth Public Clients<br>
Publication Date&nbsp;&nbsp;&nbsp; : September 2015<br>
Author(s)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : N. =
Sakimura, Ed., J. Bradley, N. Agarwal<br>
Category&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
: PROPOSED STANDARD<br>
Source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp; : Web Authorization Protocol<br>
Stream&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp; : IETF<br>
Verifying Party&nbsp;&nbsp;&nbsp;&nbsp; : IESG<br>
<br>
_______________________________________________<br>
OAuth mailing list -- oauth@ietf.org<br>
To unsubscribe send an email to oauth-leave@ietf.org<br>
</div>
</span></font></div>
</div>
</body>
</html>

--_000_LV8PR01MB867787802DDF43BE68B62D94BD76ALV8PR01MB8677prod_--