jiebi/CodeConvo huggingface dataset:
it wishes to share with the user (e.g., store info, maps, flight status, or entertainment). <ins> "can-extend-session" (optional, boolean): indicates that the URL specified as "user-portal-url" allows the user to extend a session once the client is no longer in a state of captivity.  This provides a hint that a client system can suggest accessing the portal URL to the user when the session is near its limit in terms of time or bytes. </ins> "seconds-remaining" (optional, integer): indicates the number of seconds remaining, after which the client will be placed into a captive state.  The API server SHOULD include this value if the
4.2.2. <del> The "manifest" section records a single URL identifying the manifest of the bundle.  The URL MUST refer to a resource with representations contained in the bundle itself. The bundle can contain multiple representations at this URL, and the client is expected to content-negotiate for the best one.  For example, a client might select the one matching an "accept" header of "application/manifest+json" (appmanifest) and an "accept-language" header of "es-419". 4.2.3. </del> The "critical" section consists of the names of sections of the bundle that the client needs to understand in order to load the bundle correctly.  Other sections are assumed to be optional.
Do all of: <del> If the bundle's contained URLs (e.g. in the manifest and index) are derived from the request for the bundle, percent-encode [1] (URL) any bytes that are greater than 0x7E or are not URL code points [2] (URL) in these URLs.  It is particularly important to make sure no unescaped nulls (0x00) or angle brackets (0x3C and 0x3E) appear. </del> <ins> If the bundle's contained URLs (e.g. in the index) are derived from the request for the bundle, percent-encode [1] (URL) any bytes that are greater than 0x7E or are not URL code points [2] (URL) in these URLs.  It is particularly important to make sure no unescaped nulls (0x00) or angle brackets (0x3C and 0x3E) appear. </ins> Similarly, if the request headers for any contained resource are based on the headers sent while requesting the bundle, only
such cases, it is possible for the components to still uniquely identify the device if they are aware of the port mapping. <del> In some situations, the User Equipment may have multiple IP addresses, while still satisfying all of the recommended properties. This raises some challenges to the components of the network.  For example, if the User Equipment tries to access the network with multiple IP addresses, should the Enforcement Device and API Server treat each IP address as a unique User Equipment, or should it tie the multiple addresses together into one view of the subscriber?  An </del> <ins> In some situations, the User Equipment may have multiple IP addresses (either IPv4, IPv6 or a dual-stack RFC4213 combination), while still satisfying all of the recommended properties.  This raises some challenges to the components of the network.  For example, if the User Equipment tries to access the network with multiple IP addresses, should the Enforcement Device and API Server treat each IP address as a unique User Equipment, or should it tie the multiple addresses together into one view of the subscriber?  An </ins> implementation MAY do either.  Attention should be paid to IPv6 and the fact that it is expected for a device to have multiple IPv6 addresses on a single link.  In such cases, identification could be
Captive Portal API Server: Also known as API Server.  A server hosting the Captive Portal API. <del> Captive Portal Signal: A notification from the network used to inform the User Equipment that the state of its captivity could have </del> <ins> Captive Portal Signal: A notification from the network used to signal to the User Equipment that the state of its captivity could have </ins> changed. Captive Portal Signaling Protocol: Also known as Signaling Protocol.
7.5. <del> The Captive Portal Signal could inform the User Equipment that it is being held captive.  There is no requirement that the User Equipment do something about this.  Devices MAY permit users to disable automatic reaction to Captive Portal Signals indications for privacy reasons.  However, there would be the trade-off that the user doesn't get notified when network access is restricted.  Hence, end-user devices MAY allow users to manually control captive portal </del> <ins> The Captive Portal Signal could signal to the User Equipment that it is being held captive.  There is no requirement that the User Equipment do something about this.  Devices MAY permit users to disable automatic reaction to Captive Portal Signals indications for privacy reasons.  However, there would be the trade-off that the user doesn't get notified when network access is restricted.  Hence, end- user devices MAY allow users to manually control captive portal </ins> interactions, possibly on the granularity of Provisioning Domains.
The User Equipment's access to the outside network continues uninterrupted <ins> 4.3. A different Captive Portal API URI could be returned in the following cases: If DHCP is used, a lease renewal/rebind may return a different Captive Portal API URI. If RA is used, a new Captive Portal API URI may be specified in a new RA message received by end user equipment. Whenever a new Portal URI is received by end user equipment, it SHOULD discard the old URI and use the new one for future requests to the API. </ins> 5. The authors thank Lorenzo Colitti for providing the majority of the
addresses on a single link.  In such cases, identification could be performed by subnet, such as the /64 to which the IP belongs. <del> 3.4.3. The URIs provided in the API SHOULD contain all the information necessary to render the resources requested: the resources should not depend on ambient information, such as remote address on the connection.  This is to ensure that the content served from these URIs is correct and meaningful to the User Equipment, even when accessed from a network other than the one that contains the captive portal.  One consequence of this is that URIs provided in the API are expected to be resolved using public global DNS (as defined in Section 2 of RFC8499). </del> <ins> 3.5. A Captive Portal API needs to present information to clients that is unique to that client.  To do this, some systems use information from the context of a request, such as the source address, to identify the UE. Using information from context rather than information from the URI allows the same URI to be used for different clients.  However, it also means that the resource is unable to provide relevant information if the UE makes a request using a different network path. This might happen when UE has multiple network interfaces.  It might also happen if the address of the API provided by DNS depends on where the query originates (as in split DNS RFC8499). Accessing the API MAY depend on contextual information.  However, the URIs provided in the API SHOULD be unique to the UE and not dependent on contextual information to function correctly. </ins> Though a URI might still correctly resolve when the UE makes the request from a different network, it is possible that some functions
the equipment. At minimum, the API MUST provide: (1) the state of captivity and (2) <del> a URI for the Captive Portal Server.  The API SHOULD provide evidence to the caller that it supports the present architecture. </del> <ins> a URI for the Captive Portal Server. A caller to the API needs to be presented with evidence that the content it is receiving is for a version of the API that it supports. For an HTTP-based interaction, such as in I-D.ietf-capport-api this might be achieved by using a content type that is unique to the protocol. </ins> When User Equipment receives Captive Portal Signals, the User Equipment MAY query the API to check the state.  The User Equipment
The length of the Certificate message once it is uncompressed.  If after decompression the specified length does not match the actual length, the party receiving the invalid message MUST abort the <del> connection with the "bad_certificate" alert. </del> <ins> connection with the "bad_certificate" alert.  The presence of this field allows the receiver to pre-allocate the buffer for the uncompressed Certificate message and to enforce limits on the message size before performing decompression. </ins> The compressed body of the Certificate message, in the same format as it would normally be expressed in.  The compression algorithm
message MUST be compressed with the ZLIB compression algorithm, as defined in RFC1950.  If the specified compression algorithm is brotli, the Certificate message MUST be compressed with the Brotli <del> compression algorithm as defined in RFC7932. </del> <ins> compression algorithm as defined in RFC7932.  If the specified compression algorithm is zstd, the Certificate message MUST be compressed with the Zstandard compression algorithm as defined in RFC8478. </ins> It is possible to define a certificate compression algorithm that uses a pre-shared dictionary to achieve higher compression ratio.
4.3.1. <del> An endpoint can use the critical Default-Uri-Host Option to indicate the default value for the Uri-Host Options in the messages that it sends to the other endpoint.  Its value MUST be a valid value for the Uri-Host Option (Section 5.10.1 of RFC7252). For TLS, the base value for the Default-Uri-Host Option in the direction from the Connection Initiator to the Connection Acceptor is given by the SNI value. For WebSockets, the base value for the Default-Uri-Host Option in the direction from the Connection Initiator to the Connection Acceptor is given by the HTTP Host header field. The active value of the Default-Uri-Host Option is replaced each time the option is sent with a modified value.  Its starting value is its base value (if available). 4.3.2. </del> The sender can use the elective Max-Message-Size Option to indicate the maximum message size in bytes that it can receive.
environments, CoAP needs to support different transport protocols, namely TCP RFC0793, in some situations secured by TLS RFC5246. <del> In addition, some corporate networks only allow Internet access via a HTTP proxy.  In this case, the best transport for CoAP might be the RFC6455.  The WebSocket protocol provides two-way communication between a WebSocket client and a WebSocket server after upgrading an RFC7230 connection and may be available in an environment that blocks CoAP over UDP.  Another scenario for CoAP over WebSockets is a CoAP application running inside a web browser without access to connectivity other than HTTP and WebSockets. </del> <ins> CoAP applications running inside a web browser without access to connectivity other than HTTP and the RFC6455 may cross-proxy their CoAP requests via HTTP to a HTTP-to-CoAP cross-proxy or transport them via the the WebSocket protocol, which provides two-way communication between a WebSocket client and a WebSocket server after upgrading an RFC7230 connection. </ins> This document specifies how to access resources using CoAP requests and responses over the TCP, TLS and WebSocket protocols.  This allows
can send a CoAP Ping Signaling message (see sec-ping) to test the connection and verify that the CoAP server is responsive. <ins> When the underlying TCP connection is closed or reset, the signaling state and any observation state (see observe-cancel) associated with the reliable connection are removed.  In flight messages may or may not be lost. </ins> 4. CoAP over WebSockets is intentionally similar to CoAP over TCP;
RFC6455. All requests for which the CoAP client has not received a response <del> yet are cancelled when the connection is closed.  If the client observes one or more resources over the WebSocket connection, then the CoAP server (or intermediary in the role of the CoAP server) MUST remove all entries associated with the client from the lists of observers when the connection is closed. </del> <ins> yet are cancelled when the connection is closed. </ins> 4.
method allowed for doing MAC-ed messages.  In COSE, all of the key management methods can be used for MAC-ed messages. <ins> The COSE_encrypt structure for the recipient is organized as follows: The 'protected', 'iv', 'aad', 'ciphertext' and 'recipients' fields MUST be null. The plain text to be encrypted is the key from next layer down (usually the content layer). At a minimum, the 'unprotected' field SHOULD contain the 'alg' parameter as well as a parameter identifying the shared secret. </ins> 5.2.2. In key wrapping mode, the CEK is randomly generated and that key is
The COSE_encrypt structure for the recipient is organized as follows: <ins> The 'protected', 'aad', 'iv', and 'tag' fields all use the 'null' value. At a minimum, the 'unprotected' field SHOULD contain the 'alg' parameter as well as a parameter identifying the asymmetric key. The 'unprotected' field MUST contain the 'epk' parameter. </ins> 5.2.5. Key Agreement with Key Wrapping uses a randomly generated CEK.  The
This parameter holds a part of the IV value.  When using the COSE_Encrypted structure, frequently a portion of the IV is part of the context associated with the key value.  This field is used <del> to carry the portion of the IV that changes for each message.  As the IV is authenticated by the encryption process, this value can be placed in the unprotected header bucket.  The 'Initialization Vector' and 'Partial Initialization Vector' parameters MUST NOT be present in the same security layer. The final IV is generated by concatenating the fixed portion of the IV, a zero string and the changing portion of the IV.  The length of the zero string is computed by taking the required IV length and subtracting the lengths of the fixed and changing IV portions. </del> <ins> to carry a value that causes the IV to be changed for each message.  As the IV is authenticated by the encryption process, this value can be placed in the unprotected header bucket.  The 'Initialization Vector' and 'Partial Initialization Vector' parameters MUST NOT be present in the same security layer. The message IV is generated by the following steps: Left pad the partial IV with zeros to the length of IV. XOR the padded partial IV with the context IV. </ins> This parameter holds a counter signature value.  Counter signatures provide a method of having a second party sign some
If the 'alg' field present, it MUST match the HMAC algorithm being used. <del> If the 'key_ops' field is present, it MUST include 'sign' when creating an HMAC authentication tag. </del> <ins> If the 'key_ops' field is present, it MUST include 'MAC create' when creating an HMAC authentication tag. </ins> <del> If the 'key_ops' field is present, it MUST include 'verify' when verifying an HMAC authentication tag. </del> <ins> If the 'key_ops' field is present, it MUST include 'MAC verify' when verifying an HMAC authentication tag. </ins> Implementations creating and validating MAC values MUST validate that the key type, key length, and algorithm are correct and appropriate
If the 'alg' field present, it MUST match the AES-MAC algorithm being used. <del> If the 'key_ops' field is present, it MUST include 'sign' when creating an AES-MAC authentication tag. </del> <ins> If the 'key_ops' field is present, it MUST include 'MAC create' when creating an AES-MAC authentication tag. </ins> <del> If the 'key_ops' field is present, it MUST include 'verify' when verifying an AES-MAC authentication tag. </del> <ins> If the 'key_ops' field is present, it MUST include 'MAC verify' when verifying an AES-MAC authentication tag. </ins> 9.2.1.
cryptographic key, we use the term "label" for this usage of either an integer or a string to identify map keys and choice data items. <ins> 1.5. One of the standard issues that is specified in IETF cryptographic algorithms is a requirement that a standard specify a set of minimal algorithms that are required to be implemented.  This is done to promote interoperability as it provides a minimal set of algorithms that all devices can be sure will exist at both ends.  However, we have elected not to specify a set of mandatory algorithms in this document. It is expected that COSE is going to be used in a wide variety of applications and on a wide variety of devices.  Many of the constrained devices are going to be setup to used a small fixed set of algorithms, and this set of algorithms may not match those available on a device.  We therefore have deferred to the application protocols the decision of what to specify for mandatory algorithms. Since the set of algorithms in an environment of constrained devices may depend on what the set of devices are and how long they have been in operation, we want to highlight that application protocols will need to specify some type of discovery method of algorithm capabilities.  The discovery method may be as simple as requiring preconfiguration of the set of algorithms to providing a discovery method built into the protocol.  S/MIME provided a number of different ways to approach the problem: Advertising in the message (S/MIME capabilities) Advertising in the certificate (capabilities extension) Minimum requirements for the S/MIME which have been updated over time </ins> 2. The COSE_MSG structure is a top level CBOR object that corresponds to
including the signature algorithm identifier in the data to be signed. <ins> 9.2. The RSASSA-PSS signature algorithm is defined in RFC3447. The RSASSA-PSS signature algorithm is parametized with a hash function, a mask generation function and a salt length (sLen).  For this specification, the mask generation function is fixed to be MGF1 as defined in RFC3447.  It has been recommended that the same hash function be used for hashing the data as well as in the mask generation function, for this specification we following this recommendation.  The salt length is the same length as the hash function output. Three algorithms are defined in this document.  These algorithms are: This uses the hash algorithm SHA-256 for signature processing. The value used for this algorithm is -10.  The key type used for this algorithm is 'RSA'. This uses the hash algorithm SHA-384 for signature processing. The value used for this algorithm is "PS384".  The key type used for this algorithm is 'RSA'. This uses the hash algorithm SHA-512 for signature processing. The value used for this algorithm is -11.  The key type used for this algorithm is 'RSA'. There are no algorithm parameters defined for these signature algorithms.  A summary of the algorithm definitions can be found in table-rsa-algs. 9.2.1. Key size.  is there a MUST for 2048? or do we need to specify a minimum here? </ins> 10. Message Authentication Codes (MACs) provide data authentication and
the future and private curves can be used as well. contains the x coordinate for the EC point.  The integer is <del> converted to an octet string as defined in SEC1.  Zero octets MUST NOT be removed from the front of the octet string.  [CREF21] contains either the sign bit or the value of y coordinate for the EC point.  For the value, the integer is converted to an octet string as defined in SEC1.  Zero octets MUST NOT be removed from the front of the octet string.  For the sign bit, the value is true if the value of y is positive. </del> <ins> converted to an octet string use ???.  Note that the octet string represents a little-endian encoding of x.  [CREF21] </ins> contains the private key.
[CREF20] JLS: Do we create a registry for curves?  Is is the same registry for both EC1 and EC2? <del> [CREF21] JLS: Should we use the integer encoding for x, y and d instead of bstr? </del> <ins> [CREF21] JLS: Should we use the integer encoding for x and d instead of bstr? </ins> [CREF22] JLS: Should we use the integer encoding for x, y and d instead of bstr?
bounded end-to-end delivery latency.  General background and concepts of DetNet can be found in the DetNet Architecture RFC8655. <del> The DetNet Architecture models the DetNet related data plane functions decomposed into two sub-layers: a service sub-layer and a forwarding sub-layer.  The service sub-layer is used to provide DetNet service functions such as protection and reordering.  The </del> <ins> The purpose of this document is to describe the use of the MPLS data plane to establish and support DetNet flows.  The DetNet Architecture models the DetNet related data plane functions decomposed into two sub-layers: a service sub-layer and a forwarding sub-layer.  The service sub-layer is used to provide DetNet service functions such as protection and reordering.  At the DetNet data plane a new set of functions (PREOF) provide the service sub-layer specific tasks.  The </ins> forwarding sub-layer is used to provide forwarding assurance (low <del> loss, assured latency, and limited out-of-order delivery). </del> <ins> loss, assured latency, and limited out-of-order delivery) via already existing Traffic Engineering and queuing tools.  The use of the functionalities of the DetNet service sub-layer and the DetNet forwarding sub-layer require careful design and control by the controller plane in addition to the DetNet specific use of MPLS encapsulation as specified by this document. </ins> This document specifies the DetNet data plane operation and the on- wire encapsulation of DetNet flows over an MPLS-based Packet Switched
basis.  The number of out of order packets that can be processed also impacts the latency of a flow. <ins> The latency impact on the system resources needed to support a specific DetNet flow will need to be evaluated by the controller plane based on that flow's traffic specification.  An example traffic specification that can be used with MPLS with Traffic Engineering (MPLS-TE) can be found in RFC2212. DetNet uses flow-specific requirements (e.g., maximum number of out- of-order packets, maximum latency of the flow) for configuration of POF-related buffers.  POF implementation details are out-of-scope for this document and POF configuration parameters are implementation specific.  The Controller Plane determines and sets the POF configuration parameters.  If PEF is combined with POF, then their configurations need to be coordinated to ensure the combined functionality. </ins> 4.2.3. F-Labels support the DetNet forwarding sub-layer.  F-Labels are used
protect against DOS attacks, excess traffic due to malicious or malfunctioning devices is prevented or mitigated through the use of existing mechanisms, for example by policing and shaping incoming <del> traffic.  To prevent DetNet packets from being delayed by an entity external to a DetNet domain, DetNet technology definition can allow for the mitigation of on-path attackers, for example through use of authentication and authorization of devices within the DetNet domain. </del> <ins> traffic.  To prevent DetNet packets having their delay manipulated by an external entity, precautions need to be taken to ensure that all devices on an LSP are those intended to be there by the network operator and that they are well behaved.  In addition to physical security, technical methods such as authentication and authorization of network equipment and the instrumentation and monitoring of the LSP packet delay may be used.  If a delay attack is suspected, traffic may be moved to an alternate path, for example through changing the LSP or management of the PREOF configuration. </ins> 7.