RFC 4289

Multipurpose Internet Mail Extensions (MIME) Part Four: Registration Procedures

📅 published December 2005, from ietf

RFC 4289 📜✨

Multipurpose Internet Mail Extensions (MIME) Part Four: Registration Procedures 🎀

Okay bestie, so this is RFC 4289 💖, and it's a Best Current Practice (that's BCP 13 🌸) from December 2005. It's in the Network Working Group, and it was written by N. Freed of Sun Microsystems and J. Klensin 🧑‍💻. It's part four of the MIME series, and it obsoletes RFC 2048 🙈, so if you've got the old one bookmarked, it's time to let it go 💅.

Status of This Memo 🦋

So this doc is a Best Current Practice for the whole Internet Community 🌍, and it's literally asking for your discussion and suggestions for improvements 💬. Distribution of this memo is unlimited, so share away 🫶.

Copyright (C) The Internet Society (2005). The legal bit, but make it cute 🌈.

Abstract ✨

The TL;DR is that this doc spells out how IANA registration works for MIME external body access types and content-transfer-encodings 🧚.

Table of Contents 📚

1. Introduction ....................................................2
2. External Body Access Types ......................................3
   2.1. Registration Requirements ..................................3
      2.1.1. Naming Requirements ...................................3
      2.1.2. Mechanism Specification Requirements ..................3
      2.1.3. Publication Requirements ..............................4
      2.1.4. Security Requirements .................................4
   2.2. Registration Procedure .....................................4
      2.2.1. Present the Access Type to the Community ..............4
      2.2.2. Access Type Reviewer ..................................4
      2.2.3. IANA Registration .....................................5
   2.3. Location of Registered Access Type List ....................5
   2.4. IANA Procedures for Registering Access Types ...............5
3. Transfer Encodings ..............................................5
   3.1. Transfer Encoding Requirements .............................6
      3.1.1. Naming Requirements ...................................6
      3.1.2. Algorithm Specification Requirements ..................6
      3.1.3. Input Domain Requirements .............................6
      3.1.4. Output Range Requirements .............................6
      3.1.5. Data Integrity and Generality Requirements ............7
      3.1.6. New Functionality Requirements ........................7
      3.1.7. Security Requirements .................................7
   3.2. Transfer Encoding Definition Procedure .....................7
   3.3. IANA Procedures for Transfer Encoding Registration .........8
   3.4. Location of Registered Transfer Encodings List .............8
4. Security Considerations .........................................8
5. IANA Considerations .............................................8
6. Acknowledgements ................................................8
7. References ......................................................9
A.  Changes Since RFC 2048 .........................................9

1. Introduction ✨

Okay, so recent Internet protocols were carefully designed to be super extensible in certain areas 🧚. MIME [RFC2045] is the big example: it's open-ended, so it can take new object types, charsets, and access methods without changing the basic protocol 💅. Still, we need a registration process so those values get added in an orderly, well-specified, and public way 📋.

This doc sets up registration procedures with the Internet Assigned Numbers Authority (IANA) as the central registry for all of that 🗂️.

Note: media types and charsets have their own docs, [RFC4288] [RFC2978], so they're not covered here 🙈.

1.1. Conventions Used in This Document 🫶

When you see the big-caps words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc, read them as described in [RFC2119] 🔑.

2. External Body Access Types 🌸

[RFC2046] gives us message/external-body, which lets a MIME entity point at the real body data instead of including it directly in the entity body 📍. Each message/external-body reference names an access type, and that access type decides how the body data gets fetched 🦋. RFC 2046 comes with a starter set of access types, but it lets you register more for new retrieval mechanisms 🌈.

2.1. Registration Requirements 📝

New access type specs MUST conform to the requirements below 📜.

2.1.1. Naming Requirements 🏷️

Every access type MUST have a unique name. That name shows up in the access-type parameter of the message/external-body content-type header field, and it MUST conform to MIME content type parameter syntax 💖.

2.1.2. Mechanism Specification Requirements 🔍

All of the protocols, transports, and procedures used by a given access type MUST be described. You can do that in the access type's own spec or in some other publicly available spec, and it has to be detailed enough that any competent implementor can build the access type 🛠️. Secret and/or proprietary methods in access types are expressly prohibited, no exceptions 🚫. The restrictions [RFC2026] puts on standardizing patented algorithms must be respected as well ⚖️.

2.1.3. Publication Requirements 📖

Every access type MUST be described by an RFC. That RFC can be informational instead of standards-track, though standards-track review and approval are encouraged for every access type 🌟.

2.1.4. Security Requirements 🔐

Any known security issues that come from using the access type MUST be completely and fully described. Honestly, the access type doesn't have to be secure or risk-free 😅, but the known risks really do need to be identified, no skipping 💀. Publishing a new access type doesn't require an exhaustive security review, and the security considerations section is subject to continuing evaluation 🔄. Additional security considerations SHOULD be addressed by publishing revised versions of the access type specification 🛡️.

2.2. Registration Procedure 🎀

Registering a new access type starts with publishing the spec as an Internet Draft 📄.

2.2.1. Present the Access Type to the Community 📣

A proposed access type spec gets sent to the "ietf-types@iana.org" mailing list for a two-week review period 📬. That list exists to review proposed access and media types, so that's where the drama happens 🍿. Proposed access types are not formally registered and must not be used 🙅‍♀️.

The whole point of the public posting is to collect comments and feedback on the access type spec, plus a look at any security considerations 👀.

2.2.2. Access Type Reviewer 🧐

Once the two-week period is up, the access type reviewer (appointed by the IETF Applications Area Director(s)) either forwards the request to iana@iana.org or rejects it because of significant objections raised on the list 👑.

Decisions made by the reviewer must be posted to the ietf-types mailing list within 14 days 📅. Decisions made by the reviewer may be appealed to the IESG as specified in [RFC2026] ⚖️.

2.2.3. IANA Registration ✅

As long as the access type has passed review or has been successfully appealed to the IESG, IANA will register it and make the registration available to the community 🎉. The access type spec must also be published as an RFC 💅.

2.3. Location of Registered Access Type List 🗺️

IANA lists access type registrations on this web page:

http://www.iana.org/assignments/access-types

2.4. IANA Procedures for Registering Access Types 🧾

The IESG tells IANA who the access type reviewer is 🫡. IANA then only acts in two situations: when the reviewer has approved an access type definition and forwarded it for registration, or when the IESG says an appeal has overturned the reviewer's ruling 🔁.

3. Transfer Encodings 🦋

Transfer encodings are transformations applied to MIME media types after they've been converted to the media type's canonical form 🔄. They're used for a few different reasons:

  • Lots of transports, especially message transports, can only handle data made of relatively short lines of text 📏. There can be harsh limits on which characters are allowed in those lines, since some transports only take a small slice of US-ASCII and others choke on certain character sequences 😬. Transfer encodings turn binary data into a textual form that can survive those transports 🧃. The base64 and quoted-printable transfer encodings defined in [RFC2045] are examples of this 💜.
  • Image, audio, video, and even application entities can be huge 🐘. Compression algorithms are often great at shrinking large entities 🗜️. Transfer encodings can apply general-purpose non-lossy compression algorithms to MIME entities 🌈.
  • Transport encodings can be defined as a way to represent existing encoding formats in a MIME context 🧩.
IMPORTANT: Standardizing a bunch of different transfer encodings is seen as a major barrier to widespread interoperability, so it's expressly discouraged 🚨. That said, the following procedure exists to define additional transfer encodings, should standardization actually be justified 🙏.

3.1. Transfer Encoding Requirements 📝

Transfer encoding specs MUST conform to the requirements below 📜.

3.1.1. Naming Requirements 🏷️

Every transfer encoding MUST have a unique name. That name appears in the Content-Transfer-Encoding header field, and it MUST conform to the syntax of that field 💖.

3.1.2. Algorithm Specification Requirements 🧪

All of the algorithms used in a transfer encoding (for example, conversion to printable form or compression) MUST be described in their entirety in the transfer encoding spec 📖. Secret and/or proprietary algorithms in standardized transfer encodings are expressly prohibited 🚫. The restrictions [RFC2026] puts on standardizing patented algorithms MUST be respected as well ⚖️.

3.1.3. Input Domain Requirements 🎯

Every transfer encoding MUST be applicable to an arbitrary sequence of octets of any length 🌊. Depending on particular input forms is not allowed 🙅‍♀️.

It's worth noting that the 7bit and 8bit encodings don't meet this requirement 🙈. Beyond not wanting specialized encodings floating around, the goal here is to stop people from adding new encodings that are similar to, or redundant with, 7bit and 8bit 🧹.

3.1.4. Output Range Requirements 📤

There's no requirement that a particular transfer encoding produce any particular form of encoded output 🤷‍♀️. However, the output format for each transfer encoding MUST be fully and completely documented 📚. Specifically, each spec MUST clearly state whether the output format always stays within 7bit or 8bit, or whether it's just pure binary data 💅.

3.1.5. Data Integrity and Generality Requirements ✨

Okay bestie, this one's a big deal 🧩 Every transfer encoding MUST be fully invertible on any platform, which means anyone MUST be able to get the original data back by running the matching decoding operation 💖 ngl this basically kicks out lossy compression 🙅‍♀️ and encryption too, so neither one can be used as a transfer encoding 💀

3.1.6. New Functionality Requirements 🦋

Every transfer encoding MUST bring some sort of new functionality 🔥 It's totally fine for it to overlap a bit with older encodings, but any new one MUST also offer something no other transfer encoding provides. Main character energy only 👑

3.1.7. Security Requirements 🔒

To the greatest extent possible, transfer encodings SHOULD NOT contain known security issues 🛡️ Regardless, any known security issues that come from using the transfer encoding MUST be completely and fully described. And if new security issues pop up after the initial publication and registration, they SHOULD be addressed by publishing revised versions of the transfer encoding specification 🫶

3.2. Transfer Encoding Definition Procedure 📝

Okay so, defining a new transfer encoding starts with publishing the spec as an Internet Draft ✨ The draft MUST define the transfer encoding precisely and completely, and it MUST also give substantial justification for defining and standardizing a new one 💅 After that, the spec MUST be presented to the IESG for consideration. The IESG can:

  • reject the specification outright as being inappropriate for standardization,
  • assign the specification to an existing IETF working group for further work,
  • approve the formation of an IETF working group to work on the specification in accordance with IETF procedures, or
  • accept the specification as-is for processing as an individual standards-track submission.

Transfer encoding specs on the standards track follow the normal IETF rules for standards-track documents 🌸 And a transfer encoding is considered defined and available for use once it's on the standards track 🎀

3.3. IANA Procedures for Transfer Encoding Registration 🗂️

No special procedure is needed for registering Transfer Encodings with the IANA 💁‍♀️ All legitimate transfer encoding registrations MUST appear as a standards-track RFC, so it's the IESG's job to notify the IANA when a new transfer encoding has been approved 🙌

3.4. Location of Registered Transfer Encodings List 📍

The list of transfer encoding registrations lives at:

http://www.iana.org/assignments/transfer-encodings

4. Security Considerations 🛡️

Security requirements for access types are discussed in Section 2.1.4. Security requirements for transfer encodings are discussed in Section 3.1.7. Read them both, no skipping 😭

5. IANA Considerations 📚

The sole purpose of this document is to define IANA registries for access types and transfer encodings 💜 The IANA procedures for these registries are specified in Section 2.4 and Section 3.3 respectively.

6. Acknowledgements 🫶

The current authors want to acknowledge their debt to the late Dr. Jon Postel, whose general model of IANA registration procedures and specific contributions shaped the predecessors of this document [RFC2048] 🕊️ They hope the current version is one he'd have agreed with, but since that's impossible to verify, they regretfully removed his name as a co-author 🥹

7. References 📖

7.1. Normative References

  • [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996.
  • [RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, November 1996.
  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and Registration Procedures", BCP 13, RFC 4288, December 2005.

7.2. Informative References

  • [RFC2026] Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, October 1996.
  • [RFC2048] Freed, N., Klensin, J., and J. Postel, "Multipurpose Internet Mail Extensions (MIME) Part Four: Registration Procedures", BCP 13, RFC 2048, November 1996.
  • [RFC2978] Freed, N. and J. Postel, "IANA Charset Registration Procedures", BCP 19, RFC 2978, October 2000.

Appendix A. Changes Since RFC 2048 🎀

Here's the tea on what changed since RFC 2048 ☕

  • Media type registration procedures are now described in a separate document [RFC4288].
  • The various URLs and addresses in this document have been changed so they all refer to iana.org rather than isi.edu. Additionally, many of the URLs have been changed to use HTTP; formerly they used FTP.
  • Much of the document has been clarified in the light of operational experience with these procedures.
  • Several of the references in this document have been updated to refer to current versions of the relevant specifications.
  • The option of assigning the task of working on a new transfer encoding to an existing working group has been added to the list of possible actions the IESG can take.
  • Security considerations and IANA considerations sections have been added.
  • Registration of charsets for use in MIME is specified in [RFC2978] and is no longer addressed by this document.

Authors' Addresses 📮

Ned Freed
Sun Microsystems
3401 Centrelake Drive, Suite 410
Ontario, CA  92761-1205
USA

Phone: +1 909 457 4293
EMail: ned.freed@mrochek.com


John C. Klensin
1770 Massachusetts Ave, #322
Cambridge, MA  02140

EMail: klensin+ietf@jck.com

Copyright (C) The Internet Society (2005).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🧠

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 💜

Funding for the RFC Editor function is currently provided by the Internet Society. 🌈

📦 where this page comes from