Subject: [http-auth] [Technical Errata Reported] RFC7804 (5496)

From: RFC Errata System <[email-masked]>
Date: Sat, 8 Sep 2018 06:51:46 -0700 (PDT)

The following errata report has been submitted for RFC7804,
"Salted Challenge Response HTTP Authentication Mechanism".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5496

--------------------------------------
Type: Technical
Reported by: Peter Occil <[email-masked]>

Section: 2.2

Original Text
-------------
   o  Normalize(str): Apply the Preparation and Enforcement steps
      according to the OpaqueString profile (see [RFC7613]) to a UTF-8
      [RFC3629] encoded "str".  The resulting string is also in UTF-8.
      Note that implementations MUST either implement OpaqueString
      profile operations from [RFC7613] or disallow the use of non
      US-ASCII Unicode codepoints in "str".  The latter is a particular
      case of compliance with [RFC7613].

Corrected Text
--------------
   o  Normalize(str): Apply the Preparation and Enforcement steps
      according to the OpaqueString profile (see [RFC7613]) to a UTF-8
      [RFC3629] encoded "str".  The resulting string is also in UTF-8.
      Note that implementations MUST either implement OpaqueString
      profile operations from [RFC7613] or disallow the use of Unicode 
      codepoints not ranging from U+0020 to U+007E in "str".  The latter
      is a particular case of compliance with [RFC7613].

Notes
-----
Control code points (including the ASCII controls U+0000 to U+001F as well as U+007F) are disallowed in the PRECIS FreeformClass, which the OpaqueString profile uses.  Thus it's not enough to just disallow non-US-ASCII codepoints (rather than implement the full OpaqueString profile) to comply with a subset of the OpaqueString profile.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7804 (draft-ietf-httpauth-scram-auth-15)
--------------------------------------
Title               : Salted Challenge Response HTTP Authentication Mechanism
Publication Date    : March 2016
Author(s)           : A. Melnikov
Category            : EXPERIMENTAL
Source              : Hypertext Transfer Protocol Authentication
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Benjamin Kaduk <[email-masked]>
Date: Sat, 8 Sep 2018 13:29:10 -0500

I'd like to hear from Alexey before I do anything to this, but
this seems correct on first look.

-Ben

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 8 Sep 2018 21:51:15 +0100

This looks correct to me.

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 9 Sep 2018 09:23:43 -0500

Though now that I go to actually verify it...

> > "Salted Challenge Response HTTP Authentication Mechanism".

... perhaps it would be better to avoid the double-negative and fencepost
questions by saying """or only allow the use of Unicode codepoints ranging
from U+0020 to U+007E (inclusive) in "str"."""

-Benjamin