Subject: DIGEST-MD5: missing versus empty authzid

From: John Gardiner Myers <[email-masked]>
Date: Mon, 26 Mar 2001 16:42:41 -0800

A reported DIGEST-MD5 implementation incompatibility is the ambiguity in
the specification for how to calculate A1 when the authzid-value is
explicitly specified as being the empty string.  When the
digest-response contains an explicit:

	authzid=""

does one include a trailing ":" in the computation of A1 or not?

I propose not.  I suggest changing the text in 2.1.2.1 to:

	If authzid is specified as a nonempty string, then A1 is

	If authzid is not specified or is the empty string, then A1 is

Additionally, we should disallow explicitly specifying the authiz-value
as the empty string.  To do that, we would change the ABNF as follows:

        authzid-value = 1*( qdtext | quoted-pair )