jiebi/CodeConvo huggingface dataset:
not the "representation metadata". Besides, it allows to protect "representation data" from buggy <del> manipulation, buggy compression, etc. </del> <ins> manipulation, undesired "transforming proxies" (see Section 6.5 of SEMANTICS), etc. </ins> Moreover, identity digest-algorithms (eg. "id-sha-256" and "id-sha- 512") allow piecing together a resource from different sources (e.g.
2.2. <ins> An individual member in the value of a Dictionary Structured Field is identified by the lowercased field name, followed by a semicolon "":"", followed by the member name.  An individual member in the value of a Dictionary Structured Field is canonicalized by applying the serialization algorithm described in Section 4.1.2 of StructuredFields on a Dictionary containing only that member. 2.2.1. This section contains non-normative examples of canonicalized values for Dictionary Structured Field Members given the following example header field, whose value is assumed to be a Dictionary: The following table shows example canonicalized values for different content identifiers, given that field: 2.3. A prefix of a List Structured Field consisting of the first N members in the field's value (where N is an integer greater than 0 and less than or equal to the number of members in the List) is identified by the lowercased field name, followed by a semicolon "":"", followed by N expressed as an Integer String.  A list prefix is canonicalized by applying the serialization algorithm described in Section 4.1.1 of StructuredFields on a List containing only the first N members as specified in the list prefix, in the order they appear in the original List. 2.3.1. This section contains non-normative examples of canonicalized values for list prefixes given the following example header fields, whose values are assumed to be Dictionaries: The following table shows example canonicalized values for different content identifiers, given those fields: 2.4. </ins> The signature's Creation Time (signature-metadata) is identified by <del> the "(created)" identifier. </del> <ins> the "*created" identifier. </ins> Its canonicalized value is an Integer String containing the signature's Creation Time expressed as the number of seconds since
simplifies processing and avoids timezone management required by specifications such as RFC3339. <del> 2.3. </del> <ins> 2.5. </ins> The signature's Expiration Time (signature-metadata) is identified by <del> the "(expired)" identifier. </del> <ins> the "*expires" identifier. </ins> Its canonicalized value is a Decimal String containing the signature's Expiration Time expressed as the number of seconds since the Epoch, as defined in Section 4.16 [4] of POSIX.1. <del> 2.4. </del> <ins> 2.6. </ins> The request target endpoint, consisting of the request method and the path and query of the effective request URI, is identified by the <del> "(request-target)" identifier. </del> <ins> "*request-target" identifier. </ins> Its value is canonicalized as follows:
header in HTTP2, Section 8.1.2.3.  The resulting string is the canonicalized value. <del> 2.4.1. </del> <ins> 2.6.1. </ins> The following table contains non-normative example HTTP messages and <del> their canonicalized "(request-target)" values. </del> <ins> their canonicalized "*request-target" values. </ins> 3.
signature over the empty string. If the signature's Algorithm name does not start with rsa, <del> hmac, or ecdsa, signers SHOULD include (created) and (request- target) in the list. </del> <ins> hmac, or ecdsa, signers SHOULD include "*created" and "*request-target" in the list. </ins> If the signature's Algorithm starts with rsa, hmac, or ecdsa, <del> signers SHOULD include date and (request-target) in the list. </del> <ins> signers SHOULD include "date" and "*request-target" in the list. </ins> Further guidance on what to include in this list and in what order is out of scope for this document.  However, the list
lowercased identifier followed with a colon "":"", a space "" "", and the identifier's canonicalized value (described below). <del> If Covered Content contains "(created)" and the signature's Creation </del> <ins> If Covered Content contains "*created" and the signature's Creation </ins> Time is undefined or the signature's Algorithm name starts with "rsa", "hmac", or "ecdsa" an implementation MUST produce an error. <del> If Covered Content contains "(expires)" and the signature does not </del> <ins> If Covered Content contains "*expires" and the signature does not </ins> have an Expiration Time or the signature's Algorithm name starts with "rsa", "hmac", or "ecdsa" an implementation MUST produce an error.
not present or malformed in the message, the implementation MUST produce an error. <ins> If Covered Content contains an identifier for a Dictionary member that references a header field that is not present, is malformed in the message, or is not a Dictionary Structured Field, the implementation MUST produce an error.  If the header field value does not contain the specified member, the implementation MUST produce an error. If Covered Content contains an identifier for a List Prefix that references a header field that is not present, is malformed in the message, or is not a List Structured Field, the implementation MUST produce an error.  If the header field value contains fewer than the specified number of members, the implementation MUST produce an error. </ins> For the non-normative example Signature metadata in example-metadata, the corresponding Signature Input is:
5.2. <del> This document defines the Signature header field, whose value contains a list of named parameters.  IANA is asked to create and maintain a new registry titled "HTTP Signature Parameters" to record and maintain the set of named parameters defined for use within the Signature header field.  Initial values for this registry are given in iana-param-contents.  Future assignments and modifications to existing assignment are to be made through the Expert Review registration policy RFC8126 and shall follow the template presented in iana-param-template. </del> <ins> This document defines the "Signature-Input" Structured Header, whose member values may have parameters containing metadata about a message signature.  IANA is asked to create and maintain a new registry titled "HTTP Signature Metadata Parameters" to record and maintain the set of parameters defined for use with member values in the "Signature-Input" Structured Header.  Initial values for this registry are given in iana-param-contents.  Future assignments and modifications to existing assignments are to be made through the Expert Review registration policy RFC8126 and shall follow the template presented in iana-param-template. </ins> 5.2.1. 5.2.2. The table below contains the initial contents of the HTTP Signature <del> Parameters Registry.  Each row in the table represents a distinct entry in the registry. </del> <ins> Metadata Parameters Registry.  Each row in the table represents a distinct entry in the registry. </ins> 6.
context: Re-ordering of header fields with different header field names <del> (HTTP, Section 3.2.2). </del> <ins> (MESSAGING, Section 3.2.2). </ins> <del> Combination of header fields with the same field name (HTTP, </del> <ins> Combination of header fields with the same field name (MESSAGING, </ins> Section 3.2.2). Removal of header fields listed in the "Connection" header field <del> (HTTP, Section 6.1). </del> <ins> (MESSAGING, Section 6.1). </ins> <del> Addition of header fields that indicate control options (HTTP, Section 6.1). </del> <ins> Addition of header fields that indicate control options (MESSAGING, Section 6.1). </ins> <del> Addition or removal of a transfer coding (HTTP, Section 5.7.2). </del> <ins> Addition or removal of a transfer coding (MESSAGING, Section 5.7.2). </ins> <del> Addition of header fields such as "Via" (HTTP, Section 5.7.1) and "Forwarded" (RFC7239, Section 4). </del> <ins> Addition of header fields such as "Via" (MESSAGING, Section 5.7.1) and "Forwarded" (RFC7239, Section 4). </ins> 1.3.
BCP 14 RFC2119 RFC8174 when, and only when, they appear in all capitals, as shown here. <del> The terms "HTTP message", "HTTP method", "HTTP request", "HTTP response", "absolute-form", "absolute-path", "effective request URI", "gateway", "header field", "intermediary", "request-target", "sender", and "recipient" are used as defined in RFC7230. </del> <ins> The terms "HTTP message", "HTTP request", "HTTP response", "absolute- form", "absolute-path", "effective request URI", "gateway", "header field", "intermediary", "request-target", "sender", and "recipient" are used as defined in MESSAGING. The term "method" is to be interpreted as defined in Section 4 of SEMANTICS. </ins> For brevity, the term "signature" on its own is used in this document to refer to both digital signatures and keyed MACs.  Similarly, the
[1] https://openjdk.java.net/groups/net/httpclient/intro.html <del> [2] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/ V1_chap04.html#tag_04_16 [3] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/ </del> <ins> [2] http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/ </ins> V1_chap04.html#tag_04_16
This list MUST NOT be empty, as this would result in creating a signature over the empty string. <del> If the signature's Algorithm name does not start with rsa, hmac, or ecdsa, signers SHOULD include "*created" and "*request-target" in the list. </del> <ins> Signers SHOULD include "*request-target" in the list. </ins> <del> If the signature's Algorithm starts with rsa, hmac, or ecdsa, signers SHOULD include "date" and "*request-target" in the list. </del> <ins> Signers SHOULD include a date stamp, such as the "date" header or the "*created" field in the list. </ins> Further guidance on what to include in this list and in what order is out of scope for this document.  However, the list
the identifier's canonicalized value (described below). If Covered Content contains "*created" and the signature's Creation <del> Time is undefined or the signature's Algorithm name starts with "rsa", "hmac", or "ecdsa" an implementation MUST produce an error. </del> <ins> Time is undefined an implementation MUST produce an error. </ins> If Covered Content contains "*expires" and the signature does not <del> have an Expiration Time or the signature's Algorithm name starts with "rsa", "hmac", or "ecdsa" an implementation MUST produce an error. </del> <ins> have an Expiration Time an implementation MUST produce an error. </ins> If Covered Content contains an identifier for a header field that is not present or malformed in the message, the implementation MUST
An HTTP-level integrity mechanism that operates independent of transfer can be used to detect programming errors and/or corruption of data in flight or at rest, be used across multiple hops in order <del> to provide end-to-end integrity guarantees, aid fault diagnosis </del> <ins> to provide end-to-end integrity guarantees, can aid fault diagnosis </ins> across hops and system boundaries, and can be used to validate integrity when reconstructing a resource fetched using different HTTP connections.
representation, or conveys a partial representation of a resource eg. Range Requests (see Section 14.2 of SEMANTICS). <del> Changes are semantically compatible with existing implementations and better cover both the request and response cases. </del> <ins> This document replaces RFC3230 to better align with SEMANTICS and to provide more detailed description of "Digest" usage in request and response cases.  Changes are intended to be semantically compatible with existing implementations but note that negotiation of "Content- MD5" is deprecated deprecate-contentMD5, "Digest" field parameters are obsoleted obsolete-parameters, "md5" and "sha" digest-algorithms are obsoleted broken-algorithms and the "adler32" algorithm is deprecated deprecated-algorithms. </ins> The value of "Digest" is calculated on selected representation, which is tied to the value contained in any "Content-Encoding" or "Content-
The goals do not include: <del> The digest mechanism described here does not cover the full HTTP message nor its semantic, as representation metadata are not included in the checksum. </del> <ins> Digest mechanisms do not cover the full HTTP message nor its semantic, as representation metadata is not included in the checksum. </ins> <del> The digest mechanisms described here cover only representation and selected representation data, and do not protect the integrity of </del> <ins> Digest mechanisms cover only representation and selected representation data, and do not protect the integrity of </ins> associated representation metadata or other message fields. <del> The digest mechanisms described here are not meant to support authentication of the source of a digest or of a message or anything else.  These mechanisms, therefore, are not a sufficient defense against many kinds of malicious attacks. </del> <ins> Digest mechanisms do not support authentication of the source of a digest, message or anything else.  These mechanisms, therefore, are not a sufficient defense against many kinds of malicious attacks. </ins> Digest mechanisms do not provide message privacy. <del> The digest mechanisms described here are not meant to support authorization or other kinds of access controls. </del> <ins> Digest mechanisms do not support authorization or other kinds of access controls. </ins> 1.4. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and <del> "OPTIONAL" in this document are to be interpreted as described in BCP 14 (RFC2119 and RFC8174) when, and only when, they appear in all </del> <ins> "OPTIONAL" in this document are to be interpreted as described in BCP 14 RFC2119 RFC8174 when, and only when, they appear in all </ins> capitals, as shown here. This document uses the Augmented BNF defined in RFC5234 and updated
This takes into account the effect of the HTTP semantics on the messages; for example, the payload data can be affected by Range Requests or methods such as HEAD, while the way the payload data is <del> transferred "on the wire" is dependent on other transformations (eg. transfer codings for HTTP/1.1 - see Section 6.1 of HTTP11): resource- representation contains several examples to help illustrate those effects. </del> <ins> transferred "on the wire" is dependent on other transformations (e.g. transfer codings for HTTP/1.1 - see Section 6.1 of HTTP11).  To help illustrate how such things affect "Digest", several examples are provided in resource-representation. </ins> A representation digest consists of the value of a checksum computed on the entire selected "representation data" (see Section 8 of SEMANTICS) of a resource identified according to Section 6.4.2 of <del> SEMANTICS together with an indication of the algorithm used </del> <ins> SEMANTICS together with an indication of the algorithm used: </ins> The checksum is computed using one of the digest-algorithms listed in algorithms and then encoded in the associated format. <del> The example below shows the "sha-256" digest-algorithm which uses </del> <ins> The example below shows the "sha-256" digest-algorithm that uses </ins> base64 encoding. 3.
algorithm without knowing whether the recipient supports the digest- algorithm, or even knowing that the recipient will ignore it. <del> "Digest" can be sent in a trailer section.  When using incremental digest-algorithms this allows the sender and the receiver to </del> <ins> "Digest" can be sent in a trailer section.  When an incremental digest-algorithms is used, the sender and the receiver can </ins> dynamically compute the digest value while streaming the content. <del> Two examples of its use are </del> 4. The "Want-Digest" field indicates the sender's desire to receive a
sender's preferred digest-algorithm is the one (or ones) with the highest "qvalue". <del> Two examples of its use are </del> <ins> Two examples of its use are: </ins> 5. Digest-algorithm values are used to indicate a specific digest computation. <del> All digest-algorithm values are case-insensitive but the lower case is preferred. </del> <ins> All digest-algorithm values are case-insensitive but lower case is preferred. </ins> The Internet Assigned Numbers Authority (IANA) acts as a registry for digest-algorithm values.  The registry contains the tokens listed
6.1. <del> In PATCH requests the representation digest MUST be computed on the </del> <ins> In PATCH requests, the representation digest MUST be computed on the </ins> patch document because the representation metadata refers to the patch document and not to the target resource (see Section 2 of PATCH). <del> In PATCH responses the representation digest MUST be computed on the </del> <ins> In PATCH responses, the representation digest MUST be computed on the </ins> selected representation of the patched resource. <del> "Digest" usage with PATCH is thus very similar to the POST one, but with the resource's own semantic partly implied by the method and by the patch document. </del> <ins> "Digest" usage with PATCH is thus very similar to POST, but with the resource's own semantic partly implied by the method and by the patch document. </ins> 7.
8. <del> This document obsoletes the usage of parameters with "Digest" introduced in Section 4.1.1 and 4.2 of RFC3230 because this feature has not been widely deployed and complicates field-value processing. </del> <ins> Section 4.1.1 and 4.2 of RFC3230 defined field parameters.  This document obsoletes the usage of parameters with "Digest" because this feature has not been widely deployed and complicates field-value processing. </ins> <del> Field parameters provided a common way to attach additional information to a representation-data-digest, but if they are used as an input to validate the checksum, an attacker could alter them to steer the validation behavior. </del> <ins> RFC3230 intended field parameters to provide a common way to attach additional information to a representation-data-digest.  However, if parameters are used as an input to validate the checksum, an attacker could alter them to steer the validation behavior. </ins> <del> A digest-algorithm can still be parameterized defining its own way to encode parameters into the representation-data-digest in such a way as to mitigate security risks related to its computation. </del> <ins> A digest-algorithm can still be parameterized by defining its own way to encode parameters into the representation-data-digest, in such a way as to mitigate security risks related to its computation. </ins> 9.
contain at least one byte of padding and a 16 octet authentication tag. <del> Each record contains between 1 and 256 octets of padding, inserted </del> <ins> Each record contains between 2 and 65537 octets of padding, inserted </ins> into a record before the enciphered content.  Padding consists of a <del> length byte, followed that number of zero-valued octets.  A receiver MUST fail to decrypt if any padding octet other than the first is non-zero, or a record has more padding than the record size can accommodate. </del> <ins> two octet unsigned integer in network byte order, followed that number of zero-valued octets.  A receiver MUST fail to decrypt if any padding octet other than the first two are non-zero, or a record has more padding than the record size can accommodate. </ins> The nonce for each record is a 96-bit value constructed from the record sequence number and the input keying material.  Nonce
problematic and presents possible mitigations, or where unfairness is desirable. <del> TODO: Discuss if we should add a signal that mitigates this issue. For example, we might add a SETTINGS parameter that indicates the next hop that the connection is NOT coalesced (see https://github.com/kazuho/draft-kazuho-httpbis-priority/issues/99). </del> 10.1. When an intermediary coalesces HTTP requests coming from multiple
2. <del> The "aesgcm128" HTTP content-coding indicates that a payload has been </del> <ins> The "aesgcm" HTTP content-coding indicates that a payload has been </ins> encrypted using Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM) as identified as AEAD_AES_128_GCM in RFC5116, Section 5.1. The AEAD_AES_128_GCM algorithm uses a 128 bit content encryption key.
Key header field (crypto-key) can be included to describe how the content encryption key is derived or retrieved. <del> The "aesgcm128" content-coding uses a single fixed set of encryption </del> <ins> The "aesgcm" content-coding uses a single fixed set of encryption </ins> primitives.  Cipher suite agility is achieved by defining a new content-coding scheme.  This ensures that only the HTTP Accept- Encoding header field is necessary to negotiate the use of encryption. <del> The "aesgcm128" content-coding uses a fixed record size.  The resulting encoding is a series of fixed-size records, with a final record that is one or more octets shorter than a fixed sized record. </del> <ins> The "aesgcm" content-coding uses a fixed record size.  The resulting encoding is a series of fixed-size records, with a final record that is one or more octets shorter than a fixed sized record. </ins> The record size determines the length of each portion of plaintext that is enciphered, with the exception of the final record, which is
header field (crypto-key).  The first step of HKDF is therefore: The info parameter to HKDF is set to the ASCII-encoded string <del> "Content-Encoding: aesgcm128", a single zero octet and an optional </del> <ins> "Content-Encoding: aesgcm", a single zero octet and an optional </ins> context string: Unless otherwise specified, the context is a zero length octet
The "keyid" parameter corresponds to the "keyid" parameter in the Encryption header field. <del> The "aesgcm128" parameter contains the URL-safe base64 RFC4648 octets of the input keying material. </del> <ins> The "aesgcm" parameter contains the URL-safe base64 RFC4648 octets of the input keying material. </ins> The "dh" parameter contains an ephemeral Diffie-Hellman share. This form of the header field can be used to encrypt content for a
4.1. <del> The "aesgcm128" parameter is decoded and used as the input keying material for the "aesgcm128" content encoding.  The "aesgcm128" parameter MUST decode to at least 16 octets in order to be used as input keying material for "aesgcm128" content encoding. </del> <ins> The "aesgcm" parameter is decoded and used as the input keying material for the "aesgcm" content encoding.  The "aesgcm" parameter MUST decode to at least 16 octets in order to be used as input keying material for "aesgcm" content encoding. </ins> <del> Other key determination parameters can be ignored if the "aesgcm128" </del> <ins> Other key determination parameters can be ignored if the "aesgcm" </ins> parameter is present. 4.2.
7.1. This memo registers the "encrypted" HTTP content-coding in the HTTP <del> Content Codings Registry, as detailed in aesgcm128. </del> <ins> Content Codings Registry, as detailed in aesgcm. </ins> <del> Name: aesgcm128 </del> <ins> Name: aesgcm </ins> Description: AES-GCM encryption with a 128-bit content encryption key
3.3. <del> When attempting to extend priorities, care must be taken to ensure any use of existing parameters leaves them either unchanged or modified in a way that is backwards compatible for peers that are unaware of the extended meaning. </del> <ins> When attempting to define new parameters, care must be taken so that they do not adversely interfere with prioritization performed by existing endpoints or intermediaries that do not understand the newly defined parameter.  Since unknown parameters are ignored, new parameters should not change the interpretation of or modify the predefined parameters in a way that is not backwards compatible or fallback safe. </ins> For example, if there is a need to provide more granularity than eight urgency levels, it would be possible to subdivide the range