Issues in Identifier Comparison for Security Purposes

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 26
Abstract: Identifiers such as hostnames, URIs, IP addresses, and email addresses are often used in security contexts to identify security principals and resources. In such contexts, an identifier presented via some protocol is often compared using some policy to make security decisions such as whether the security principal may access the resource, what level of authentication or encryption is required, etc. If the parties involved in a security decision use different algorithms to compare identifiers, then failure scenarios ranging from denial of service to elevation of privilege can result. This document provides a discussion of these issues that designers should consider when defining identifiers and protocols, and when constructing architectures that use multiple protocols.
Publication Date: 2013-05-01
Status Note: Informational
DOI: 10.17487/RFC6943
Link: https://doi.org/10.17487/RFC6943
Author(s): Dave Thaler
Keyword(s): Canonicalization, Normalization, Hostname, URI, IRI

Latest version of IETF RFC 6943

Document Versions — IETF RFC 6943

▶ IETF RFC 6943 (2013-05-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Bibliographic Reference(s)

IEEE Std 1003.1:2004 [Withdrawn]
ANSI/INCITS X3.4:1986 (R1997) [Active]
Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M., and R. Smith, "Privacy Considerations for Internet Protocols", Work in Progress, April 2013. EXTERNAL
IANA, "Service Name and Transport Protocol Port Number Registry", March 2013, < http://www.iana.org/assignments/service-names-port- numbers/ >. EXTERNAL
Hardt, D., Ed., Tom, A., Eaton, B., and Y. Goland, "OAuth Web Resource Authorization Profiles", Work in Progress, January 2010. EXTERNAL
Oracle, "Class URL", Java(TM) Platform Standard Ed. 7, 2013, < http://docs.oracle.com/javase/7/docs/api/java/net/ URL.html >. EXTERNAL
Cantor, S., Ed., Kemp, J., Ed., Philpott, R., Ed., and E. Maler, Ed., "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Standard saml-core-2.0-os, March 2005, < http://docs.oasis-open.org/security/saml/v2.0/ saml-core-2.0-os.pdf >. EXTERNAL
Weber, C., "Attacking Software Globalization", March 2010, < http://www.lookout.net/files/ Chris_Weber_Character%20Transformations%20v1.7_IUC33.pdf >. EXTERNAL
Internet Architecture Board, "IAB Statement: 'The interpretation of rules in the ICANN gTLD Applicant Guidebook'", February 2012, < http://www.iab.org/documents/ correspondence-reports-documents/2012-2/iab-statement-the- interpretation-of-rules-in-the-icann-gtld-applicant- guidebook>. EXTERNAL
IETF RFC 1034 [Active*]
IETF RFC 1123 [Active*]
IETF RFC 2277 [Active*]
IETF RFC 3490 [Superseded*]
IETF RFC 3492 [Active*]
IETF RFC 3493 [Active*]
IETF RFC 3696 [Active*]
IETF RFC 3986 [Active, Amended*]
IETF RFC 4007 [Active*]
IETF RFC 4291 [Active*]
IETF RFC 4790 [Active*]
IETF RFC 4949 [Active*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 5321 [Active*]
IETF RFC 5322 [Active, Amended*]
IETF RFC 5952 [Active*]
IETF RFC 6055 [Active*]
IETF RFC 6066 [Active*]
IETF RFC 6125 [Superseded*]
IETF RFC 6335 [Active*]
IETF RFC 6530 [Active*]
IETF RFC 6532 [Active*]
IETF RFC 6818 [Active*]
IETF RFC 6874 [Superseded*]
IETF RFC 6885 [Active*]
UNICODE.STD.TR36-11 — TR36 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6943.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6943, Issues in Identifier Comparison for Security Purposes. Available at https://doi.org/10.17487/RFC6943

Snippet:

IETF RFC 6943, Issues in Identifier Comparison for Security Purposes. Available at https://doi.org/10.17487/RFC6943

HTML (ISO 690 compliant)

Preview:

IETF RFC 6943, Issues in Identifier Comparison for Security Purposes. Available at https://doi.org/10.17487/RFC6943

Snippet:

<span class="citation"><cite>IETF RFC 6943</cite>, Issues in Identifier Comparison for Security Purposes. Available at <a href="https://doi.org/10.17487/RFC6943" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6943</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6943, Issues in Identifier Comparison for Security Purposes
doi: 10.17487/RFC6943
url: https://doi.org/10.17487/RFC6943

Snippet:

<li>
<cite id="bib-rfc6943">IETF RFC 6943</cite>, Issues in Identifier Comparison for Security Purposes
<span class="doi">10.17487/RFC6943</span>
</li>

Referenced By

IETF draft-thaler-appsawg-multi-transport-uris-01 [Active*]
IETF RFC 7320 [Superseded*]
IETF RFC 7564 [Superseded*]
IETF RFC 7613 [Superseded*]
IETF RFC 7925 [Active*]
IETF RFC 8141 [Active*]
IETF RFC 8820 [Active*]