Subject: [sipcore] RFC 3261: Authorization UTF8-NONASCII and escaping

From: Brett Tate <[email-masked]>
Date: Thu, 8 Dec 2011 07:43:49 -0800

Howdy,

Since unable to obtain much response on sip-implementors...

The following are some questions concerning SIP Digest MD5 Authorization.

1) Are UTF8-NONASCII allowed within username and realm?  Based upon the ABNF, it appears to be yes.  However since SIP authentication is based upon the HTTP specs (such as rfc2617 and rfc2616), I'm not sure if the SIP ABNF changes to include UTF8-NONASCII was intentional concerning the topic.  More specifically, I'm not sure if the rfc2616 TEXT snippet (or something else) somehow prevents UTF8-NONASCII.

2) Can the password used within Digest MD5 authentication calculation include UTF8-NONASCII?

3) If quoted-string username contains useless and required escaping of characters, is the escaped or un-escaped username supposed to be used within the calculation?  I assume the un-escaped username; however I thought I'd ask anyway. 

In case it helps, the following link mentions that RFC 2831 (similarly based upon RFC 2617) attempted to address/resolve these types of questions (introduced charset); however RFC 6331 cited these type of issues as part of the justification for deprecating RFC 2831.

https://lists.cs.columbia.edu/pipermail/sip-implementors/2011-December/028014.html 

Thanks,
Brett

-----------

RFC 2617:

username         = "username" "=" username-value
username-value   = quoted-string
realm       = "realm" "=" realm-value
realm-value = quoted-string

----

RFC 2616:

quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
qdtext         = <any TEXT except <">>

The backslash character ("\") MAY be used as a single-character
quoting mechanism only within quoted-string and comment constructs.

quoted-pair    = "\" CHAR

Words of *TEXT MAY contain characters from character sets other 
than ISO-8859-1 [22] only when encoded according to the rules 
of RFC 2047 [14].

TEXT           = <any OCTET except CTLs, but including LWS>

----

RFC 3261:
Authorization     =  "Authorization" HCOLON credentials
credentials       =  ("Digest" LWS digest-response)
                     / other-response
digest-response   =  dig-resp *(COMMA dig-resp)
dig-resp          =  username / realm / nonce / digest-uri
                      / dresponse / algorithm / cnonce
                      / opaque / message-qop
                      / nonce-count / auth-param
username          =  "username" EQUAL username-value
username-value    =  quoted-string
realm               =  "realm" EQUAL realm-value
realm-value         =  quoted-string

A string of text is parsed as a single word if it is quoted using
double-quote marks.  In quoted strings, quotation marks (") and
backslashes (\) need to be escaped.

   quoted-string  =  SWS DQUOTE *(qdtext / quoted-pair ) DQUOTE
   qdtext         =  LWS / %x21 / %x23-5B / %x5D-7E / UTF8-NONASCII

The backslash character ("\") MAY be used as a single-character
quoting mechanism only within quoted-string and comment constructs.
Unlike HTTP/1.1, the characters CR and LF cannot be escaped by this
mechanism to avoid conflict with line folding and header separation.

quoted-pair  =  "\" (%x00-09 / %x0B-0C / %x0E-7F)

---

From: Adam Roach <[email-masked]>
Date: Thu, 8 Dec 2011 21:55:20 -0600

[as an individual]

These are really good questions, and ones that don't really have an answer yet. There have been some hallway conversations around SIP and internationalization at recent IETF meetings. Most of what I've heard has centered on URIs (and domains in particular), and authentication is an important topic that I haven't heard come up yet.

I suspect that this is the next big thing SIPCORE will take on (unless we decide to spin up a new SIP internationalization WG). Stay tuned -- and if you're interested in doing work in this area, speak up. I expect that we'll be looking for draft authors in the coming months. 

/a

On Dec 8, 2011, at 9:43, Brett Tate <[email-masked]> wrote:

> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Fri, 9 Dec 2011 14:25:20 +0100

> I suspect that this is the next big thing SIPCORE will take on (unless we decide to spin up a new SIP internationalization WG). Stay tuned -- and if you're interested in doing work in this area, sp…

It would be needed that some specification defines how to read a
"username" and "realm" from an (WWW-)Authorization header. Should the
parser perform hexadecimal unescaping on those fields? or should those
fields contain UTF8-NONASCII symbols (since their BNF grammar allow
it)? This must be defined.

Regards.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Brett Tate <[email-masked]>
Date: Fri, 9 Dec 2011 06:39:31 -0800

Thanks for the response.  In case not captured yet...

One of the international limitations is the inability to compliantly embed headers containing UTF8-NONASCII within a sip-uri.  RFC 3986 provides an escaping mechanism for newer URIs.

Concerning domains, RFC 3986 mention the use of RFC 3490; however RFC 3490 was made obsolete by RFC 5890 and RFC 5891.

> -----Original Message-----
> From: Adam Roach [mailto:[email-masked]]
> Sent: Thursday, December 08, 2011 10:55 PM
> To: Brett Tate
> Cc: [email-masked]
> Subject: Re: [sipcore] RFC 3261: Authorization UTF8-NONASCII and
> escaping
> 
> [as an individual]
> 
> These are really good questions, and ones that don't really have an
> answer yet. There have been some hallway conversations around SIP and
> internationalization at recent IETF meetings. Most of what I've heard
> has centered on URIs (and domains in particular), and authentication is
> an important topic that I haven't heard come up yet.
> 
> I suspect that this is the next big thing SIPCORE will take on (unless
> we decide to spin up a new SIP internationalization WG). Stay tuned --
> and if you're interested in doing work in this area, speak up. I expect
> that we'll be looking for draft authors in the coming months.
> 
> /a
> 
> > 1) Are UTF8-NONASCII allowed within username and realm?  Based upon
> the ABNF, it appears to be yes.  However since SIP authentication is
> based upon the HTTP specs (such as rfc2617 and rfc2616), I'm not sure
> if the SIP ABNF changes to include UTF8-NONASCII was intentional
> concerning the topic.  More specifically, I'm not sure if the rfc2616
> TEXT snippet (or something else) somehow prevents UTF8-NONASCII.
> >
> > 3) If quoted-string username contains useless and required escaping
> of characters, is the escaped or un-escaped username supposed to be
> used within the calculation?  I assume the un-escaped username; however
> I thought I'd ask anyway.
> >
> > In case it helps, the following link mentions that RFC 2831
> (similarly based upon RFC 2617) attempted to address/resolve these
> types of questions (introduced charset); however RFC 6331 cited these
> type of issues as part of the justification for deprecating RFC 2831.
> >