Subject: DIGEST-MD5: fix ABNF to account for UTF-8/ISO-8859-1

From: John Gardiner Myers <[email-masked]>
Date: Mon, 26 Mar 2001 16:52:06 -0800

The document prose allows UTF-8 in the authzid-value and either UTF-8 or
ISO-8859-1 in the username-value, depending on the value of the charset
directive.  The ABNF incorrectly restricts these values to US-ASCII. 
The ABNF needs to be corrected.

---

From: Chris Newman <[email-masked]>
Date: Mon, 26 Mar 2001 19:44:39 -0800

> The ABNF needs to be corrected.

Actually, the ABNF does not restrict those values to US-ASCII:

       username-value   = qdstr-val
...
       authzid-value    = qdstr-val
...
       TEXT           = <any OCTET except CTLs,
                        but including LWS>
...
      qdstr-val      = *( qdtext | quoted-pair )
      qdtext         = <any TEXT except <">>

But the prose above "TEXT" is severely broken:

   The TEXT rule is only used for descriptive field contents and values
   that are not intended to be interpreted by the message parser. Words
   of *TEXT MAY contain characters from character sets other than
   ISO-8859-1 [ISO 8859] only when encoded according to the rules of RFC
   2047 [RFC 2047].

Ironically, when TEXT is used in double-quotes, RFC 2047 encoding isn't 
permitted, so this prose restricts it to 8859-1 which contradicts previous 
statements.  I recall raising this problem before 2831 was published, but I 
guess it got lost in the noise.  The HTTP baggage in DIGEST-MD5 is 
sometimes quite unpleasant.

BTW, is the primary document editor for the digest revision reading this 
list?
Or should I volunteer to be the primary editor for the revision?

		- Chris

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 26 Mar 2001 21:40:04 -0800

At 07:44 PM 3/26/01 -0800, Chris Newman wrote:
>BTW, is the primary document editor for the digest revision reading this list? Or should I volunteer to be the primary editor for the revision?

Paul has volunteered to serve as document editor and I
believe he's on the list.

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 27 Mar 2001 13:29:59 -0800

>       qdtext         = <any TEXT except <">>

Strangely:

       quoted-pair    = "\" CHAR

which is restricted to ASCII.  I would prefer to restrict it to CTLs,
<"> and "\".  Restricting to ASCII may be justifiable as \-quoted UTF-8
could be troublesome to parsers.

The grammar for qdstr-val is ambiguous as qdtext permits "\".

---

From: Chris Newman <[email-masked]>
Date: Mon, 26 Mar 2001 19:44:39 -0800

- Chris

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 26 Mar 2001 21:40:04 -0800

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 27 Mar 2001 13:29:59 -0800

Strangely:

       quoted-pair    = "\" CHAR