|
| 1 | + |
| 2 | + |
| 3 | + |
| 4 | + |
| 5 | + |
| 6 | + |
| 7 | +Internet Engineering Task Force (IETF) R. Gellens |
| 8 | +Request for Comments: 6856 QUALCOMM Incorporated |
| 9 | +Obsoletes: 5721 C. Newman |
| 10 | +Category: Standards Track Oracle |
| 11 | +ISSN: 2070-1721 J. Yao |
| 12 | + CNNIC |
| 13 | + K. Fujiwara |
| 14 | + JPRS |
| 15 | + March 2013 |
| 16 | + |
| 17 | + |
| 18 | + Post Office Protocol Version 3 (POP3) Support for UTF-8 |
| 19 | + |
| 20 | +Abstract |
| 21 | + |
| 22 | + This specification extends the Post Office Protocol version 3 (POP3) |
| 23 | + to support international strings encoded in UTF-8 in usernames, |
| 24 | + passwords, mail addresses, message headers, and protocol-level text |
| 25 | + strings. |
| 26 | + |
| 27 | +Status of This Memo |
| 28 | + |
| 29 | + This is an Internet Standards Track document. |
| 30 | + |
| 31 | + This document is a product of the Internet Engineering Task Force |
| 32 | + (IETF). It represents the consensus of the IETF community. It has |
| 33 | + received public review and has been approved for publication by the |
| 34 | + Internet Engineering Steering Group (IESG). Further information on |
| 35 | + Internet Standards is available in Section 2 of RFC 5741. |
| 36 | + |
| 37 | + Information about the current status of this document, any errata, |
| 38 | + and how to provide feedback on it may be obtained at |
| 39 | + http://www.rfc-editor.org/info/rfc6856. |
| 40 | + |
| 41 | + |
| 42 | + |
| 43 | + |
| 44 | + |
| 45 | + |
| 46 | + |
| 47 | + |
| 48 | + |
| 49 | + |
| 50 | + |
| 51 | + |
| 52 | + |
| 53 | + |
| 54 | + |
| 55 | + |
| 56 | + |
| 57 | + |
| 58 | +Gellens, et al. Standards Track [Page 1] |
| 59 | + |
| 60 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 61 | + |
| 62 | + |
| 63 | +Copyright Notice |
| 64 | + |
| 65 | + Copyright (c) 2013 IETF Trust and the persons identified as the |
| 66 | + document authors. All rights reserved. |
| 67 | + |
| 68 | + This document is subject to BCP 78 and the IETF Trust's Legal |
| 69 | + Provisions Relating to IETF Documents |
| 70 | + (http://trustee.ietf.org/license-info) in effect on the date of |
| 71 | + publication of this document. Please review these documents |
| 72 | + carefully, as they describe your rights and restrictions with respect |
| 73 | + to this document. Code Components extracted from this document must |
| 74 | + include Simplified BSD License text as described in Section 4.e of |
| 75 | + the Trust Legal Provisions and are provided without warranty as |
| 76 | + described in the Simplified BSD License. |
| 77 | + |
| 78 | + This document may contain material from IETF Documents or IETF |
| 79 | + Contributions published or made publicly available before November |
| 80 | + 10, 2008. The person(s) controlling the copyright in some of this |
| 81 | + material may not have granted the IETF Trust the right to allow |
| 82 | + modifications of such material outside the IETF Standards Process. |
| 83 | + Without obtaining an adequate license from the person(s) controlling |
| 84 | + the copyright in such materials, this document may not be modified |
| 85 | + outside the IETF Standards Process, and derivative works of it may |
| 86 | + not be created outside the IETF Standards Process, except to format |
| 87 | + it for publication as an RFC or to translate it into languages other |
| 88 | + than English. |
| 89 | + |
| 90 | +Table of Contents |
| 91 | + |
| 92 | + 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 |
| 93 | + 1.1. Conventions Used in This Document . . . . . . . . . . . . 3 |
| 94 | + 2. "UTF8" Capability . . . . . . . . . . . . . . . . . . . . . . 4 |
| 95 | + 2.1. The "UTF8" Command . . . . . . . . . . . . . . . . . . . . 5 |
| 96 | + 2.2. USER Argument to "UTF8" Capability . . . . . . . . . . . . 6 |
| 97 | + 3. "LANG" Capability . . . . . . . . . . . . . . . . . . . . . . 7 |
| 98 | + 3.1. Definition . . . . . . . . . . . . . . . . . . . . . . . . 7 |
| 99 | + 3.2. Discussion . . . . . . . . . . . . . . . . . . . . . . . . 7 |
| 100 | + 3.3. Examples . . . . . . . . . . . . . . . . . . . . . . . . . 8 |
| 101 | + 4. Non-ASCII Character Maildrops . . . . . . . . . . . . . . . . 9 |
| 102 | + 5. "UTF8" Response Code . . . . . . . . . . . . . . . . . . . . . 10 |
| 103 | + 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 |
| 104 | + 7. Security Considerations . . . . . . . . . . . . . . . . . . . 10 |
| 105 | + 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11 |
| 106 | + 8.1. Normative References . . . . . . . . . . . . . . . . . . . 11 |
| 107 | + 8.2. Informative References . . . . . . . . . . . . . . . . . . 12 |
| 108 | + Appendix A. Design Rationale . . . . . . . . . . . . . . . . . . 13 |
| 109 | + Appendix B. Acknowledgments . . . . . . . . . . . . . . . . . . . 13 |
| 110 | + |
| 111 | + |
| 112 | + |
| 113 | + |
| 114 | +Gellens, et al. Standards Track [Page 2] |
| 115 | + |
| 116 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 117 | + |
| 118 | + |
| 119 | +1. Introduction |
| 120 | + |
| 121 | + This document forms part of the Email Address Internationalization |
| 122 | + protocols described in the Email Address Internationalization |
| 123 | + Framework document [RFC6530]. As part of the overall Email Address |
| 124 | + Internationalization work, email messages can be transmitted and |
| 125 | + delivered containing a Unicode string encoded in UTF-8 in the header |
| 126 | + and/or body, and maildrops that are accessed using POP3 [RFC1939] |
| 127 | + might natively store Unicode characters. |
| 128 | + |
| 129 | + This specification extends POP3 using the POP3 extension mechanism |
| 130 | + [RFC2449] to permit un-encoded UTF-8 [RFC3629] in headers and bodies |
| 131 | + (e.g., transferred using 8-bit content-transfer-encoding) as |
| 132 | + described in "Internationalized Email Headers" [RFC6532]. It also |
| 133 | + adds a mechanism to support login names and passwords containing a |
| 134 | + UTF-8 string (see Section 1.1 below), a mechanism to support UTF-8 |
| 135 | + strings in protocol-level response strings, and the ability to |
| 136 | + negotiate a language for such response strings. |
| 137 | + |
| 138 | + This specification also adds a new response code to indicate that a |
| 139 | + message was not delivered because it required UTF-8 mode (as |
| 140 | + discussed in Section 2) and the server was unable or unwilling to |
| 141 | + create and deliver a surrogate form of the message as discussed in |
| 142 | + Section 7 of "IMAP Support for UTF-8" [RFC6855]. |
| 143 | + |
| 144 | + This specification replaces an earlier, experimental, approach to the |
| 145 | + same problem [RFC5721]. |
| 146 | + |
| 147 | +1.1. Conventions Used in This Document |
| 148 | + |
| 149 | + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", |
| 150 | + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this |
| 151 | + document are to be interpreted as described in "Key words for use in |
| 152 | + RFCs to Indicate Requirement Levels" [RFC2119]. |
| 153 | + |
| 154 | + The terms "UTF-8 string" or "UTF-8 character" are used to refer to |
| 155 | + Unicode characters, which may or may not be members of the ASCII |
| 156 | + repertoire, encoded in UTF-8 [RFC3629], a standard Unicode encoding |
| 157 | + form. All other specialized terms used in this specification are |
| 158 | + defined in the Email Address Internationalization framework document. |
| 159 | + |
| 160 | + In examples, "C:" and "S:" indicate lines sent by the client and |
| 161 | + server, respectively. If a single "C:" or "S:" label applies to |
| 162 | + multiple lines, then the line breaks between those lines are for |
| 163 | + editorial clarity only and are not part of the actual protocol |
| 164 | + exchange. |
| 165 | + |
| 166 | + |
| 167 | + |
| 168 | + |
| 169 | + |
| 170 | +Gellens, et al. Standards Track [Page 3] |
| 171 | + |
| 172 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 173 | + |
| 174 | + |
| 175 | + Note that examples always use ASCII characters due to limitations of |
| 176 | + the RFC format; otherwise, some examples for the "LANG" command would |
| 177 | + have appeared incorrectly. |
| 178 | + |
| 179 | +2. "UTF8" Capability |
| 180 | + |
| 181 | + This specification adds a new POP3 Extension [RFC2449] capability |
| 182 | + response tag and command to specify support for header field |
| 183 | + information outside the ASCII repertoire. The capability tag and new |
| 184 | + command and functionality are described below. |
| 185 | + |
| 186 | + CAPA tag: |
| 187 | + UTF8 |
| 188 | + |
| 189 | + Arguments with CAPA tag: |
| 190 | + USER |
| 191 | + |
| 192 | + Added Commands: |
| 193 | + UTF8 |
| 194 | + |
| 195 | + Standard commands affected: |
| 196 | + USER, PASS, APOP, LIST, TOP, RETR |
| 197 | + |
| 198 | + Announced states / possible differences: |
| 199 | + both / no |
| 200 | + |
| 201 | + Commands valid in states: |
| 202 | + AUTHORIZATION |
| 203 | + |
| 204 | + Specification reference: |
| 205 | + this document |
| 206 | + |
| 207 | + Discussion: |
| 208 | + |
| 209 | + This capability adds the "UTF8" command to POP3. The "UTF8" command |
| 210 | + switches the session from the ASCII-only mode of POP3 [RFC1939] to |
| 211 | + UTF-8 mode. The UTF-8 mode means that all messages transmitted |
| 212 | + between servers and clients are UTF-8 strings, and both servers and |
| 213 | + clients can send and accept UTF-8 strings. |
| 214 | + |
| 215 | + |
| 216 | + |
| 217 | + |
| 218 | + |
| 219 | + |
| 220 | + |
| 221 | + |
| 222 | + |
| 223 | + |
| 224 | + |
| 225 | + |
| 226 | +Gellens, et al. Standards Track [Page 4] |
| 227 | + |
| 228 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 229 | + |
| 230 | + |
| 231 | +2.1. The "UTF8" Command |
| 232 | + |
| 233 | + The "UTF8" command enables UTF-8 mode. The "UTF8" command has no |
| 234 | + parameters. |
| 235 | + |
| 236 | + UTF-8 mode has no effect on messages in an ASCII-only maildrop. |
| 237 | + Messages in native Unicode maildrops can be encoded in UTF-8 using |
| 238 | + internationalized headers [RFC6532], in 8bit |
| 239 | + content-transfer-encoding (see Section 2.8 of MIME [RFC2045]), in |
| 240 | + ASCII, or in any combination of these options. In UTF-8 mode, if the |
| 241 | + character encoding format of maildrops is UTF-8 or ASCII, the |
| 242 | + messages are sent to the client as is; if the character encoding |
| 243 | + format of maildrops is a format other than UTF-8 or ASCII, the |
| 244 | + messages' encoding format SHOULD be converted to be UTF-8 before they |
| 245 | + are sent to the client. When UTF-8 mode has not been enabled, |
| 246 | + character strings outside the ASCII repertoire MUST NOT be sent to |
| 247 | + the client as is. If a client requests a UTF-8 message when UTF-8 |
| 248 | + mode is not enabled, the server MUST either send the client a |
| 249 | + surrogate message that complies with unextended POP and Internet Mail |
| 250 | + Format without UTF-8 mode support, or fail the request with an -ERR |
| 251 | + response. See Section 7 of "IMAP Support for UTF-8" [RFC6855] for |
| 252 | + information about creating a surrogate message and for a discussion |
| 253 | + of potential issues. Section 5 of this document discusses "UTF8" |
| 254 | + response codes. The server MAY respond to the "UTF8" command with an |
| 255 | + -ERR response. |
| 256 | + |
| 257 | + Note that even in UTF-8 mode, MIME binary content-transfer-encoding |
| 258 | + as defined in Section 6.2 of MIME [RFC2045] is still not permitted. |
| 259 | + MIME 8bit content-transfer-encoding (8BITMIME) [RFC6152] is obviously |
| 260 | + allowed. |
| 261 | + |
| 262 | + The octet count (size) of a message reported in a response to the |
| 263 | + "LIST" command SHOULD match the actual number of octets sent in a |
| 264 | + "RETR" response (not counting byte-stuffing). Sizes reported |
| 265 | + elsewhere, such as in "STAT" responses and non-standardized, |
| 266 | + free-form text in positive status indicators (following "+OK") need |
| 267 | + not be accurate, but it is preferable if they are. |
| 268 | + |
| 269 | + Normal operation for maildrops that natively support non-ASCII |
| 270 | + characters will be for both servers and clients to support the |
| 271 | + extension discussed in this specification. Upgrading both clients |
| 272 | + and servers is the only fully satisfactory way to support the |
| 273 | + capabilities offered by the "UTF8" extension and SMTPUTF8 mail more |
| 274 | + generally. Servers must, however, anticipate the possibility of a |
| 275 | + client attempting to access a message that requires this extension |
| 276 | + without having issued the "UTF8" command. There are no completely |
| 277 | + satisfactory responses for this case other than upgrading the client |
| 278 | + to support this specification. One solution, unsatisfactory because |
| 279 | + |
| 280 | + |
| 281 | + |
| 282 | +Gellens, et al. Standards Track [Page 5] |
| 283 | + |
| 284 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 285 | + |
| 286 | + |
| 287 | + the user may be confused by being able to access the message through |
| 288 | + some means and not others, is that a server MAY choose to reject the |
| 289 | + command to retrieve the message as discussed in Section 5. Other |
| 290 | + alternatives, including the possibility of creating and delivering a |
| 291 | + surrogate form of the message, are discussed in Section 7 of "IMAP |
| 292 | + Support for UTF-8" [RFC6855]. |
| 293 | + |
| 294 | + Clients MUST NOT issue the "STLS" command [RFC2595] after issuing |
| 295 | + UTF8; servers MAY (but are not required to) enforce this by rejecting |
| 296 | + with an -ERR response an "STLS" command issued subsequent to a |
| 297 | + successful "UTF8" command. (Because this is a protocol error as |
| 298 | + opposed to a failure based on conditions, an extended response code |
| 299 | + [RFC2449] is not specified.) |
| 300 | + |
| 301 | +2.2. USER Argument to "UTF8" Capability |
| 302 | + |
| 303 | + If the USER argument is included with this capability, it indicates |
| 304 | + that the server accepts UTF-8 usernames and passwords. |
| 305 | + |
| 306 | + Servers that include the USER argument in the "UTF8" capability |
| 307 | + response SHOULD apply SASLprep [RFC4013] or one of its Standards |
| 308 | + Track successors to the arguments of the "USER" and "PASS" commands. |
| 309 | + |
| 310 | + A client or server that supports APOP and permits UTF-8 in usernames |
| 311 | + or passwords MUST apply SASLprep or one of its Standards Track |
| 312 | + successors to the username and password used to compute the APOP |
| 313 | + digest. |
| 314 | + |
| 315 | + When applying SASLprep, servers MUST reject UTF-8 usernames or |
| 316 | + passwords that contain a UTF-8 character listed in Section 2.3 of |
| 317 | + SASLprep. When applying SASLprep to the USER argument, the PASS |
| 318 | + argument, or the APOP username argument, a compliant server or client |
| 319 | + MUST treat them as a query string [RFC3454]. When applying SASLprep |
| 320 | + to the APOP password argument, a compliant server or client MUST |
| 321 | + treat them as a stored string [RFC3454]. |
| 322 | + |
| 323 | + If the server includes the USER argument in the UTF8 capability |
| 324 | + response, the client MAY use UTF-8 characters with a "USER", "PASS", |
| 325 | + or "APOP" command; the client MAY do so before issuing the "UTF8" |
| 326 | + command. Clients MUST NOT use UTF-8 characters when authenticating |
| 327 | + if the server did not include the USER argument in the UTF8 |
| 328 | + capability response. |
| 329 | + |
| 330 | + The server MUST reject UTF-8 usernames or passwords that fail to |
| 331 | + comply with the formal syntax in UTF-8 [RFC3629]. |
| 332 | + |
| 333 | + Use of UTF-8 strings in the "AUTH" command is governed by the POP3 |
| 334 | + SASL [RFC5034] mechanism. |
| 335 | + |
| 336 | + |
| 337 | + |
| 338 | +Gellens, et al. Standards Track [Page 6] |
| 339 | + |
| 340 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 341 | + |
| 342 | + |
| 343 | +3. "LANG" Capability |
| 344 | + |
| 345 | + This document adds a new POP3 extension [RFC2449] capability response |
| 346 | + tag to indicate support for a new command: "LANG". |
| 347 | + |
| 348 | +3.1. Definition |
| 349 | + |
| 350 | + The capability tag and new command are described below. |
| 351 | + |
| 352 | + CAPA tag: |
| 353 | + LANG |
| 354 | + |
| 355 | + Arguments with CAPA tag: |
| 356 | + none |
| 357 | + |
| 358 | + Added Commands: |
| 359 | + LANG |
| 360 | + |
| 361 | + Standard commands affected: |
| 362 | + All |
| 363 | + |
| 364 | + Announced states / possible differences: |
| 365 | + both / no |
| 366 | + |
| 367 | + Commands valid in states: |
| 368 | + AUTHORIZATION, TRANSACTION |
| 369 | + |
| 370 | + Specification reference: |
| 371 | + this document |
| 372 | + |
| 373 | +3.2. Discussion |
| 374 | + |
| 375 | + POP3 allows most +OK and -ERR server responses to include human- |
| 376 | + readable text that, in some cases, might be presented to the user. |
| 377 | + But that text is limited to ASCII by the POP3 specification |
| 378 | + [RFC1939]. The "LANG" capability and command permit a POP3 client to |
| 379 | + negotiate which language the server uses when sending human-readable |
| 380 | + text. |
| 381 | + |
| 382 | + The "LANG" command requests that human-readable text included in all |
| 383 | + subsequent +OK and -ERR responses be localized to a language matching |
| 384 | + the language range argument (the "basic language range" as described |
| 385 | + by the "Matching of Language Tags" [RFC4647]). If the command |
| 386 | + succeeds, the server returns a +OK response followed by a single |
| 387 | + space, the exact language tag selected, and another space. Human- |
| 388 | + readable text in the appropriate language then appears in the rest of |
| 389 | + the line. This, and subsequent protocol-level human-readable text, |
| 390 | + is encoded in the UTF-8 charset. |
| 391 | + |
| 392 | + |
| 393 | + |
| 394 | +Gellens, et al. Standards Track [Page 7] |
| 395 | + |
| 396 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 397 | + |
| 398 | + |
| 399 | + If the command fails, the server returns an -ERR response and |
| 400 | + subsequent human-readable response text continues to use the language |
| 401 | + that was previously used. |
| 402 | + |
| 403 | + If the client issues a "LANG" command with the special "*" language |
| 404 | + range argument, it indicates a request to use a language designated |
| 405 | + as preferred by the server administrator. The preferred language MAY |
| 406 | + vary based on the currently active user. |
| 407 | + |
| 408 | + If no argument is given and the POP3 server issues a positive |
| 409 | + response, that response will usually consist of multiple lines. |
| 410 | + After the initial +OK, for each language tag the server supports, the |
| 411 | + POP3 server responds with a line for that language. This line is |
| 412 | + called a "language listing". |
| 413 | + |
| 414 | + In order to simplify parsing, all POP3 servers are required to use a |
| 415 | + certain format for language listings. A language listing consists of |
| 416 | + the language tag [RFC5646] of the message, optionally followed by a |
| 417 | + single space and a human-readable description of the language in the |
| 418 | + language itself, using the UTF-8 charset. There is no specific order |
| 419 | + to the listing of languages; the order may depend on configuration or |
| 420 | + implementation. |
| 421 | + |
| 422 | +3.3. Examples |
| 423 | + |
| 424 | + Examples for "LANG" capability usage are shown below. |
| 425 | + |
| 426 | + Note that some examples do not include the correct character |
| 427 | + accents due to limitations of the RFC format. |
| 428 | + |
| 429 | + C: USER karen |
| 430 | + S: +OK Hello, karen |
| 431 | + C: PASS password |
| 432 | + S: +OK karen's maildrop contains 2 messages (320 octets) |
| 433 | + |
| 434 | + Client requests deprecated MUL language [ISO639-2]. Server |
| 435 | + replies with -ERR response. |
| 436 | + |
| 437 | + C: LANG MUL |
| 438 | + S: -ERR invalid language MUL |
| 439 | + |
| 440 | + |
| 441 | + |
| 442 | + |
| 443 | + |
| 444 | + |
| 445 | + |
| 446 | + |
| 447 | + |
| 448 | + |
| 449 | + |
| 450 | +Gellens, et al. Standards Track [Page 8] |
| 451 | + |
| 452 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 453 | + |
| 454 | + |
| 455 | + A LANG command with no parameters is a request for |
| 456 | + a language listing. |
| 457 | + |
| 458 | + C: LANG |
| 459 | + S: +OK Language listing follows: |
| 460 | + S: en English |
| 461 | + S: en-boont English Boontling dialect |
| 462 | + S: de Deutsch |
| 463 | + S: it Italiano |
| 464 | + S: es Espanol |
| 465 | + S: sv Svenska |
| 466 | + S: . |
| 467 | + |
| 468 | + A request for a language listing might fail. |
| 469 | + |
| 470 | + C: LANG |
| 471 | + S: -ERR Server is unable to list languages |
| 472 | + |
| 473 | + Once the client selects the language, all responses will be in |
| 474 | + that language, starting with the response to the "LANG" command. |
| 475 | + |
| 476 | + C: LANG es |
| 477 | + S: +OK es Idioma cambiado |
| 478 | + |
| 479 | + If a server returns an -ERR response to a "LANG" command |
| 480 | + that specifies a primary language, the current language |
| 481 | + for responses remains in effect. |
| 482 | + |
| 483 | + C: LANG uga |
| 484 | + S: -ERR es Idioma <<UGA>> no es conocido |
| 485 | + |
| 486 | + C: LANG sv |
| 487 | + S: +OK sv Kommandot "LANG" lyckades |
| 488 | + |
| 489 | + C: LANG * |
| 490 | + S: +OK es Idioma cambiado |
| 491 | + |
| 492 | +4. Non-ASCII Character Maildrops |
| 493 | + |
| 494 | + When a POP3 server uses a native non-ASCII character maildrop, it is |
| 495 | + the responsibility of the server to comply with the POP3 base |
| 496 | + specification [RFC1939] and Internet Message Format [RFC5322] when |
| 497 | + not in UTF-8 mode. When the server is not in UTF-8 mode and the |
| 498 | + message requires that mode, requests to download the message MAY be |
| 499 | + rejected (as specified in the next section) or the various |
| 500 | + alternatives outlined in Section 2.1 above, including creation and |
| 501 | + delivery of surrogates for the original message, MAY be considered. |
| 502 | + |
| 503 | + |
| 504 | + |
| 505 | + |
| 506 | +Gellens, et al. Standards Track [Page 9] |
| 507 | + |
| 508 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 509 | + |
| 510 | + |
| 511 | +5. "UTF8" Response Code |
| 512 | + |
| 513 | + Per "POP3 Extension Mechanism" [RFC2449], this document adds a new |
| 514 | + response code: UTF8, described below. |
| 515 | + |
| 516 | + Complete response code: |
| 517 | + UTF8 |
| 518 | + |
| 519 | + Valid for responses: |
| 520 | + -ERR |
| 521 | + |
| 522 | + Valid for commands: |
| 523 | + LIST, TOP, RETR |
| 524 | + |
| 525 | + Response code meaning and expected client behavior: |
| 526 | + The "UTF8" response code indicates that a failure is due to a |
| 527 | + request for message content that contains a UTF-8 string when the |
| 528 | + client is not in UTF-8 mode. |
| 529 | + |
| 530 | + The client MAY reissue the command after entering UTF-8 mode. |
| 531 | + |
| 532 | +6. IANA Considerations |
| 533 | + |
| 534 | + Sections 2 and 3 of this specification update two capabilities |
| 535 | + ("UTF8" and "LANG") in the POP3 capability registry [RFC2449]. |
| 536 | + |
| 537 | + Section 5 of this specification adds one new response code ("UTF8") |
| 538 | + to the POP3 response codes registry [RFC2449]. |
| 539 | + |
| 540 | +7. Security Considerations |
| 541 | + |
| 542 | + The security considerations of UTF-8 [RFC3629], SASLprep [RFC4013], |
| 543 | + and the Unicode Format for Network Interchange [RFC5198] apply to |
| 544 | + this specification, particularly with respect to use of UTF-8 strings |
| 545 | + in usernames and passwords. |
| 546 | + |
| 547 | + The "LANG *" command might reveal the existence and preferred |
| 548 | + language of a user to an active attacker probing the system if the |
| 549 | + active language changes in response to the "USER", "PASS", or "APOP" |
| 550 | + commands prior to validating the user's credentials. Servers are |
| 551 | + strongly advised to implement a configuration to prevent this |
| 552 | + exposure. |
| 553 | + |
| 554 | + It is possible for a man-in-the-middle attacker to insert a "LANG" |
| 555 | + command in the command stream, thus, making protocol-level diagnostic |
| 556 | + responses unintelligible to the user. A mechanism to protect the |
| 557 | + |
| 558 | + |
| 559 | + |
| 560 | + |
| 561 | + |
| 562 | +Gellens, et al. Standards Track [Page 10] |
| 563 | + |
| 564 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 565 | + |
| 566 | + |
| 567 | + integrity of the session can be used to defeat such attacks. For |
| 568 | + example, a client can issue the "STLS" command [RFC2595] before |
| 569 | + issuing the "LANG" command. |
| 570 | + |
| 571 | + As with other internationalization upgrades, modifications to server |
| 572 | + authentication code (in this case, to support non-ASCII strings) need |
| 573 | + to be done with care to avoid introducing vulnerabilities (for |
| 574 | + example, in string parsing or matching). This is particularly |
| 575 | + important if the native databases or mailstore of the operating |
| 576 | + system use some character set or encoding other than Unicode in |
| 577 | + UTF-8. |
| 578 | + |
| 579 | +8. References |
| 580 | + |
| 581 | +8.1. Normative References |
| 582 | + |
| 583 | + [RFC1939] Myers, J. and M. Rose, "Post Office Protocol - Version |
| 584 | + 3", STD 53, RFC 1939, May 1996. |
| 585 | + |
| 586 | + [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail |
| 587 | + Extensions (MIME) Part One: Format of Internet Message |
| 588 | + Bodies", RFC 2045, November 1996. |
| 589 | + |
| 590 | + [RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions) |
| 591 | + Part Three: Message Header Extensions for Non-ASCII |
| 592 | + Text", RFC 2047, November 1996. |
| 593 | + |
| 594 | + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate |
| 595 | + Requirement Levels", BCP 14, RFC 2119, March 1997. |
| 596 | + |
| 597 | + [RFC2449] Gellens, R., Newman, C., and L. Lundblade, "POP3 |
| 598 | + Extension Mechanism", RFC 2449, November 1998. |
| 599 | + |
| 600 | + [RFC3454] Hoffman, P. and M. Blanchet, "Preparation of |
| 601 | + Internationalized Strings ("stringprep")", RFC 3454, |
| 602 | + December 2002. |
| 603 | + |
| 604 | + [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO |
| 605 | + 10646", STD 63, RFC 3629, November 2003. |
| 606 | + |
| 607 | + [RFC4013] Zeilenga, K., "SASLprep: Stringprep Profile for User |
| 608 | + Names and Passwords", RFC 4013, February 2005. |
| 609 | + |
| 610 | + [RFC4647] Phillips, A. and M. Davis, "Matching of Language Tags", |
| 611 | + BCP 47, RFC 4647, September 2006. |
| 612 | + |
| 613 | + [RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network |
| 614 | + Interchange", RFC 5198, March 2008. |
| 615 | + |
| 616 | + |
| 617 | + |
| 618 | +Gellens, et al. Standards Track [Page 11] |
| 619 | + |
| 620 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 621 | + |
| 622 | + |
| 623 | + [RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322, |
| 624 | + October 2008. |
| 625 | + |
| 626 | + [RFC5646] Phillips, A. and M. Davis, "Tags for Identifying |
| 627 | + Languages", BCP 47, RFC 5646, September 2009. |
| 628 | + |
| 629 | + [RFC6152] Klensin, J., Freed, N., Rose, M., and D. Crocker, "SMTP |
| 630 | + Service Extension for 8-bit MIME Transport", STD 71, |
| 631 | + RFC 6152, March 2011. |
| 632 | + |
| 633 | + [RFC6530] Klensin, J. and Y. Ko, "Overview and Framework for |
| 634 | + Internationalized Email", RFC 6530, February 2012. |
| 635 | + |
| 636 | + [RFC6532] Yang, A., Steele, S., and N. Freed, "Internationalized |
| 637 | + Email Headers", RFC 6532, February 2012. |
| 638 | + |
| 639 | + [RFC6855] Resnick, P., Newman, C., and S. Shen, "IMAP Support for |
| 640 | + UTF-8", RFC 6855, March 2013. |
| 641 | + |
| 642 | +8.2. Informative References |
| 643 | + |
| 644 | + [ISO639-2] International Organization for Standardization, "ISO |
| 645 | + 639-2:1998. Codes for the representation of names of |
| 646 | + languages -- Part 2: Alpha-3 code", October 1998. |
| 647 | + |
| 648 | + [RFC2231] Freed, N. and K. Moore, "MIME Parameter Value and Encoded |
| 649 | + Word Extensions: |
| 650 | + Character Sets, Languages, and Continuations", RFC 2231, |
| 651 | + November 1997. |
| 652 | + |
| 653 | + [RFC2595] Newman, C., "Using TLS with IMAP, POP3 and ACAP", |
| 654 | + RFC 2595, June 1999. |
| 655 | + |
| 656 | + [RFC5034] Siemborski, R. and A. Menon-Sen, "The Post Office |
| 657 | + Protocol (POP3) Simple Authentication and Security Layer |
| 658 | + (SASL) Authentication Mechanism", RFC 5034, July 2007. |
| 659 | + |
| 660 | + [RFC5721] Gellens, R. and C. Newman, "POP3 Support for UTF-8", |
| 661 | + RFC 5721, February 2010. |
| 662 | + |
| 663 | + |
| 664 | + |
| 665 | + |
| 666 | + |
| 667 | + |
| 668 | + |
| 669 | + |
| 670 | + |
| 671 | + |
| 672 | + |
| 673 | + |
| 674 | +Gellens, et al. Standards Track [Page 12] |
| 675 | + |
| 676 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 677 | + |
| 678 | + |
| 679 | +Appendix A. Design Rationale |
| 680 | + |
| 681 | + This non-normative section discusses the reasons behind some of the |
| 682 | + design choices in this specification. |
| 683 | + |
| 684 | + Due to interoperability problems with the MIME Message Header |
| 685 | + Extensions [RFC2047] and limited deployment of the extended MIME |
| 686 | + parameter encodings [RFC2231], it is hoped these 7-bit encoding |
| 687 | + mechanisms can be deprecated in the future when UTF-8 header support |
| 688 | + becomes prevalent. |
| 689 | + |
| 690 | + The USER capability (Section 2.2) and hence the upgraded "USER" |
| 691 | + command and additional support for non-ASCII credentials, are |
| 692 | + optional because the implementation burden of SASLprep [RFC4013] is |
| 693 | + not well understood, and mandating such support in all cases could |
| 694 | + negatively impact deployment. |
| 695 | + |
| 696 | +Appendix B. Acknowledgments |
| 697 | + |
| 698 | + Thanks to John Klensin, Joseph Yee, Tony Hansen, Alexey Melnikov, and |
| 699 | + other Email Address Internationalization working group participants |
| 700 | + who provided helpful suggestions and interesting debate that improved |
| 701 | + this specification. |
| 702 | + |
| 703 | + |
| 704 | + |
| 705 | + |
| 706 | + |
| 707 | + |
| 708 | + |
| 709 | + |
| 710 | + |
| 711 | + |
| 712 | + |
| 713 | + |
| 714 | + |
| 715 | + |
| 716 | + |
| 717 | + |
| 718 | + |
| 719 | + |
| 720 | + |
| 721 | + |
| 722 | + |
| 723 | + |
| 724 | + |
| 725 | + |
| 726 | + |
| 727 | + |
| 728 | + |
| 729 | + |
| 730 | +Gellens, et al. Standards Track [Page 13] |
| 731 | + |
| 732 | +RFC 6856 POP3 Support for UTF-8 March 2013 |
| 733 | + |
| 734 | + |
| 735 | +Authors' Addresses |
| 736 | + |
| 737 | + Randall Gellens |
| 738 | + QUALCOMM Incorporated |
| 739 | + 5775 Morehouse Drive |
| 740 | + San Diego, CA 92651 |
| 741 | + USA |
| 742 | + |
| 743 | + EMail: rg+ietf@qualcomm.com |
| 744 | + |
| 745 | + |
| 746 | + Chris Newman |
| 747 | + Oracle |
| 748 | + 800 Royal Oaks |
| 749 | + Monrovia, CA 91016-6347 |
| 750 | + USA |
| 751 | + |
| 752 | + EMail: chris.newman@oracle.com |
| 753 | + |
| 754 | + |
| 755 | + Jiankang YAO |
| 756 | + CNNIC |
| 757 | + No.4 South 4th Street, Zhongguancun |
| 758 | + Beijing |
| 759 | + China |
| 760 | + |
| 761 | + Phone: +86 10 58813007 |
| 762 | + EMail: yaojk@cnnic.cn |
| 763 | + |
| 764 | + |
| 765 | + Kazunori Fujiwara |
| 766 | + Japan Registry Services Co., Ltd. |
| 767 | + Chiyoda First Bldg. East 13F, 3-8-1 Nishi-Kanda |
| 768 | + Tokyo |
| 769 | + Japan |
| 770 | + |
| 771 | + Phone: +81 3 5215 8451 |
| 772 | + EMail: fujiwara@jprs.co.jp |
| 773 | + |
| 774 | + |
| 775 | + |
| 776 | + |
| 777 | + |
| 778 | + |
| 779 | + |
| 780 | + |
| 781 | + |
| 782 | + |
| 783 | + |
| 784 | + |
| 785 | + |
| 786 | +Gellens, et al. Standards Track [Page 14] |
| 787 | + |
0 commit comments