Subject: [websec] [Technical Errata Reported] RFC7469 (4354)

From: RFC Errata System <[email-masked]>
Date: Mon, 4 May 2015 23:01:01 -0700 (PDT)

The following errata report has been submitted for RFC7469,
"Public Key Pinning Extension for HTTP".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7469&eid=4354

--------------------------------------
Type: Technical
Reported by: Kirit Saelensminde <[email-masked]>

Section: 3

Original Text
-------------
   As in Section 2.4, the token refers to the algorithm name, and the
   quoted-string refers to the base64 encoding of the SPKI Fingerprint.
   When formulating the JSON POST body, the UA MUST either use single-
   quoted JSON strings or use double-quoted JSON strings and backslash-
   escape the embedded double quotes in the quoted-string part of the
   known-pin.

....

      'pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM="',

Corrected Text
--------------
   As in Section 2.4, the token refers to the algorithm name, and the
   quoted-string refers to the base64 encoding of the SPKI Fingerprint.
   When formulating the JSON POST body, the UA MUST use double-quoted
   JSON strings and backslash-escape the embedded double quotes in the
   quoted-string part of the known-pin.

....

      "pin-sha256=\"d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=\"",

Notes
-----
This RFC seems to think that single quotes are permissible in JSON. This is not the case. See http://tools.ietf.org/html/rfc7159#section-7

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7469 (draft-ietf-websec-key-pinning-21)
--------------------------------------
Title               : Public Key Pinning Extension for HTTP
Publication Date    : April 2015
Author(s)           : C. Evans, C. Palmer, R. Sleevi
Category            : PROPOSED STANDARD
Source              : Web Security
Area                : Applications
Stream              : IETF
Verifying Party     : IESG