RFC 6856
Post Office Protocol Version 3 (POP3) Support for UTF-8
Post Office Protocol Version 3 (POP3) Support for UTF-8 ✨
Okay bestie, this is RFC 6856 🎀 It's a Standards Track document from the IETF (ISSN 2070-1721), dated March 2013. The authors are R. Gellens (QUALCOMM Incorporated), C. Newman (Oracle), J. Yao (CNNIC), and K. Fujiwara (JPRS). It obsoletes RFC 5721 🦋 and its title block doesn't list any "Updates" entry, so it doesn't update anything listed there.
Abstract
This spec glows up POP3 (the Post Office Protocol version 3) so it can handle international strings encoded in UTF-8 🌍 That covers usernames, passwords, mail addresses, message headers, and protocol-level text strings. It's giving global. 💜
Status of This Memo
This is an Internet Standards Track document. 💅
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check out Section 2 of RFC 5741 📚
You can find out the current status of this document, any errata, and how to send feedback at http://www.rfc-editor.org/info/rfc6856 🌸
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License. 🫶
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English. 🧚
Table of Contents 📋
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Conventions Used in This Document . . . . . . . . . . . . 3
2. "UTF8" Capability . . . . . . . . . . . . . . . . . . . . . . 4
2.1. The "UTF8" Command . . . . . . . . . . . . . . . . . . . . 5
2.2. USER Argument to "UTF8" Capability . . . . . . . . . . . . 6
3. "LANG" Capability . . . . . . . . . . . . . . . . . . . . . . 7
3.1. Definition . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2. Discussion . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3. Examples . . . . . . . . . . . . . . . . . . . . . . . . . 8
4. Non-ASCII Character Maildrops . . . . . . . . . . . . . . . . 9
5. "UTF8" Response Code . . . . . . . . . . . . . . . . . . . . . 10
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10
7. Security Considerations . . . . . . . . . . . . . . . . . . . 10
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
8.1. Normative References . . . . . . . . . . . . . . . . . . . 11
8.2. Informative References . . . . . . . . . . . . . . . . . . 12
Appendix A. Design Rationale . . . . . . . . . . . . . . . . . . 13
Appendix B. Acknowledgments . . . . . . . . . . . . . . . . . . . 131. Introduction ✨
This doc is part of the Email Address Internationalization protocols, which are described in the Email Address Internationalization Framework document [RFC6530]. 🌏 As part of the bigger Email Address Internationalization project, email messages can be sent and delivered with a Unicode string encoded in UTF-8 in the header and/or body. Also, maildrops accessed with POP3 [RFC1939] might natively store Unicode characters. Iconic. 🦋
This spec extends POP3 using the POP3 extension mechanism [RFC2449] so it can permit un-encoded UTF-8 [RFC3629] in headers and bodies (for example, when transferred using 8-bit content-transfer-encoding) as described in "Internationalized Email Headers" [RFC6532]. 💌 It also adds a way to support login names and passwords containing a UTF-8 string (see Section 1.1 below), a way to support UTF-8 strings in protocol-level response strings, and the ability to negotiate a language for those response strings. 🌈
This spec also adds a new response code to say that a message wasn't delivered because it needed UTF-8 mode (as discussed in Section 2), and the server was unable or unwilling to create and deliver a surrogate form of the message, as discussed in Section 7 of "IMAP Support for UTF-8" [RFC6855]. 🫣
This spec replaces an earlier, experimental approach to the same problem [RFC5721]. 🔥
1.1. Conventions Used in This Document 📝
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in "Key words for use in RFCs to Indicate Requirement Levels" [RFC2119]. These are the official vibes-check words, so pay attention to them! 👑
The terms "UTF-8 string" or "UTF-8 character" are used to refer to Unicode characters, which may or may not be members of the ASCII repertoire, encoded in UTF-8 [RFC3629], which is a standard Unicode encoding form. Every other specialized term in this spec is defined in the Email Address Internationalization framework document. 🧠
In examples, "C:" and "S:" mean lines sent by the client and server, respectively. If a single "C:" or "S:" label covers multiple lines, the line breaks between those lines are just for editorial clarity and are not part of the actual protocol exchange. 💖
Heads up: examples always use ASCII characters because of limitations of the RFC format. Otherwise, some examples for the "LANG" command would have shown up incorrectly. 🙈
2. "UTF8" Capability 💅
This spec adds a new POP3 Extension [RFC2449] capability response tag and a new command, so a server can say it supports header field information outside the ASCII repertoire. The capability tag, the new command, and the functionality are described below. 🍓
Here's the capability summary:
CAPA tag:
UTF8
Arguments with CAPA tag:
USER
Added Commands:
UTF8
Standard commands affected:
USER, PASS, APOP, LIST, TOP, RETR
Announced states / possible differences:
both / no
Commands valid in states:
AUTHORIZATION
Specification reference:
this document
Discussion:This capability adds the "UTF8" command to POP3. The "UTF8" command switches the session from the ASCII-only mode of POP3 [RFC1939] into UTF-8 mode. In UTF-8 mode, every message sent between servers and clients is a UTF-8 string, and both servers and clients can send and accept UTF-8 strings. It's a whole mood. ✨
2.1. The "UTF8" Command 🦋
The "UTF8" command turns on UTF-8 mode. It has no parameters, so it's super simple. 🎀
UTF-8 mode has no effect on messages in an ASCII-only maildrop. Messages in native Unicode maildrops can be encoded in UTF-8 using internationalized headers [RFC6532], in 8bit content-transfer-encoding (see Section 2.8 of MIME [RFC2045]), in ASCII, or in any combination of these. 🌸 In UTF-8 mode, if the character encoding format of the maildrop is UTF-8 or ASCII, the messages are sent to the client as is. If the character encoding format of the maildrop is something other than UTF-8 or ASCII, the messages' encoding format SHOULD be converted to UTF-8 before they are sent to the client. 🔄
When UTF-8 mode has not been enabled, character strings outside the ASCII repertoire MUST NOT be sent to the client as is. ⚠️ If a client requests a UTF-8 message when UTF-8 mode is not enabled, the server MUST either send the client a surrogate message that complies with unextended POP and Internet Mail Format without UTF-8 mode support, or fail the request with an -ERR response. For info on making a surrogate message and a discussion of possible issues, see Section 7 of "IMAP Support for UTF-8" [RFC6855]. Section 5 of this document covers "UTF8" response codes. The server MAY respond to the "UTF8" command with an -ERR response. 🙃
Quick reminder: even in UTF-8 mode, MIME binary content-transfer-encoding (as defined in Section 6.2 of MIME [RFC2045]) is still not permitted. MIME 8bit content-transfer-encoding (8BITMIME) [RFC6152] is obviously allowed. 💀
The octet count (size) of a message reported in a response to the "LIST" command SHOULD match the actual number of octets sent in a "RETR" response (not counting byte-stuffing). Sizes reported elsewhere, like in "STAT" responses and in non-standardized, free-form text in positive status indicators (following "+OK"), don't have to be accurate, but it's preferable if they are. 📏
Normal operation for maildrops that natively support non-ASCII characters is for both servers and clients to support the extension in this spec. Upgrading both clients and servers is the only fully satisfactory way to support the capabilities offered by the "UTF8" extension, and SMTPUTF8 mail more generally. 🚀 Servers must, however, expect that a client might try to access a message that needs this extension without having issued the "UTF8" command. There are no completely satisfactory responses for this case other than upgrading the client to support this spec. 😭
One solution, which isn't fully satisfying because the user may get confused by being able to reach the message through some means and not others, is that a server MAY choose to reject the command to retrieve the message, as discussed in Section 5. 🫠 Other options, including creating and delivering a surrogate form of the message, are discussed in Section 7 of "IMAP Support for UTF-8" [RFC6855]. 🧚
Clients MUST NOT issue the "STLS" command [RFC2595] after issuing UTF8. Servers MAY (but are not required to) enforce this by rejecting an "STLS" command issued after a successful "UTF8" command with an -ERR response. (Because this is a protocol error, as opposed to a failure based on conditions, an extended response code [RFC2449] is not specified.) 🔐
2.2. USER Argument to "UTF8" Capability ✨
okay so if the USER argument is included with this capability, it's basically the server saying "yes, we take UTF-8 usernames and passwords" 💖 that's the whole vibe.
Servers that include the USER argument in the "UTF8" capability response SHOULD apply SASLprep [RFC4013] or one of its Standards Track successors to the arguments of the "USER" and "PASS" commands. 🫶
A client or server that supports APOP and permits UTF-8 in usernames or passwords MUST apply SASLprep or one of its Standards Track successors to the username and password used to compute the APOP digest. no skipping this part bestie 😭
When applying SASLprep, servers MUST reject UTF-8 usernames or passwords that contain a UTF-8 character listed in Section 2.3 of SASLprep. 💀 when applying SASLprep to the USER argument, the PASS argument, or the APOP username argument, a compliant server or client MUST treat them as a query string [RFC3454]. when applying SASLprep to the APOP password argument, a compliant server or client MUST treat them as a stored string [RFC3454]. these are different treatments, so don't mix them up 🎀
If the server includes the USER argument in the UTF8 capability response, the client MAY use UTF-8 characters with a "USER", "PASS", or "APOP" command. the client MAY do so before issuing the "UTF8" command too. 🦋 but clients MUST NOT use UTF-8 characters when authenticating if the server did not include the USER argument in the UTF8 capability response. not me doing it anyway 🙅♀️
The server MUST reject UTF-8 usernames or passwords that fail to comply with the formal syntax in UTF-8 [RFC3629]. ✨
Use of UTF-8 strings in the "AUTH" command is governed by the POP3 SASL [RFC5034] mechanism. 🌸
3. "LANG" Capability 🌈
This document adds a new POP3 extension [RFC2449] capability response tag to indicate support for a new command: "LANG". it's the main character of this section 👑
3.1. Definition
The capability tag and new command are described below. here's the whole spec at a glance 👀
CAPA tag:
LANG
Arguments with CAPA tag:
none
Added Commands:
LANG
Standard commands affected:
All
Announced states / possible differences:
both / no
Commands valid in states:
AUTHORIZATION, TRANSACTION
Specification reference:
this document3.2. Discussion
okay so POP3 lets most +OK and -ERR server responses include human-readable text that, in some cases, might get shown to the user. but that text is limited to ASCII by the POP3 specification [RFC1939] 🥺 which is so 1990s. the "LANG" capability and command let a POP3 client negotiate which language the server uses when sending that text 🌍 iconic.
The "LANG" command requests that human-readable text included in all subsequent +OK and -ERR responses be localized to a language matching the language range argument (the "basic language range" as described by the "Matching of Language Tags" [RFC4647]). If the command succeeds, the server returns a +OK response followed by a single space, the exact language tag selected, and another space. Human-readable text in the appropriate language then appears in the rest of the line. This, and subsequent protocol-level human-readable text, is encoded in the UTF-8 charset. ✨
If the command fails, the server returns an -ERR response and subsequent human-readable response text continues to use the language that was previously used. so nothing changes if it flops 💅
If the client issues a "LANG" command with the special * language range argument, it indicates a request to use a language designated as preferred by the server administrator. The preferred language MAY vary based on the currently active user. 🧚
If no argument is given and the POP3 server issues a positive response, that response will usually consist of multiple lines. After the initial +OK, for each language tag the server supports, the POP3 server responds with a line for that language. This line is called a "language listing". 🍓
In order to simplify parsing, all POP3 servers are required to use a certain format for language listings. A language listing consists of the language tag [RFC5646] of the message, optionally followed by a single space and a human-readable description of the language in the language itself, using the UTF-8 charset. There is no specific order to the listing of languages; the order may depend on configuration or implementation. no fixed order, it's giving chaos but make it cute 🌸
3.3. Examples
Examples for "LANG" capability usage are shown below. 💖
Note that some examples do not include the correct character accents due to limitations of the RFC format. sorry in advance for the missing accents, the format is being extra 🙈
C: USER karen
S: +OK Hello, karen
C: PASS password
S: +OK karen's maildrop contains 2 messages (320 octets)The client requests the deprecated MUL language [ISO639-2]. The server replies with an -ERR response. 💀
C: LANG MUL
S: -ERR invalid language MULA LANG command with no parameters is a request for a language listing. 🎀
C: LANG
S: +OK Language listing follows:
S: en English
S: en-boont English Boontling dialect
S: de Deutsch
S: it Italiano
S: es Espanol
S: sv Svenska
S: .A request for a language listing might fail. 😭
C: LANG
S: -ERR Server is unable to list languagesOnce the client selects the language, all responses will be in that language, starting with the response to the "LANG" command. 🇪🇸
C: LANG es
S: +OK es Idioma cambiadoIf a server returns an -ERR response to a "LANG" command that specifies a primary language, the current language for responses remains in effect. no change, we stay in our lane 💅
C: LANG uga
S: -ERR es Idioma <<UGA>> no es conocido
C: LANG sv
S: +OK sv Kommandot "LANG" lyckades
C: LANG *
S: +OK es Idioma cambiado4. Non-ASCII Character Maildrops 🦋
When a POP3 server uses a native non-ASCII character maildrop, it is the responsibility of the server to comply with the POP3 base specification [RFC1939] and Internet Message Format [RFC5322] when not in UTF-8 mode. When the server is not in UTF-8 mode and the message requires that mode, requests to download the message MAY be rejected (as specified in the next section), or the various alternatives outlined in Section 2.1 above, including creation and delivery of surrogates for the original message, MAY be considered. so the server has options, but it's on the server to keep things compliant 🫶
5. "UTF8" Response Code 💜
Per "POP3 Extension Mechanism" [RFC2449], this document adds a new response code: UTF8, described below. 🔥
Complete response code:
UTF8
Valid for responses:
-ERR
Valid for commands:
LIST, TOP, RETR
Response code meaning and expected client behavior:
The "UTF8" response code indicates that a failure is due to a
request for message content that contains a UTF-8 string when the
client is not in UTF-8 mode.
The client MAY reissue the command after entering UTF-8 mode.so basically the server says "nope, you're not in UTF-8 mode," and the client MAY try again after switching modes ✨
6. IANA Considerations 🌸
Sections 2 and 3 of this specification update two capabilities ("UTF8" and "LANG") in the POP3 capability registry [RFC2449].
Section 5 of this specification adds one new response code ("UTF8") to the POP3 response codes registry [RFC2449]. 🎀
7. Security Considerations 🚨
this part is serious, so we're going full focus mode 🔒
The security considerations of UTF-8 [RFC3629], SASLprep [RFC4013], and the Unicode Format for Network Interchange [RFC5198] apply to this specification, particularly with respect to use of UTF-8 strings in usernames and passwords.
The LANG * command might reveal the existence and preferred language of a user to an active attacker probing the system if the active language changes in response to the "USER", "PASS", or "APOP" commands prior to validating the user's credentials. Servers are strongly advised to implement a configuration to prevent this exposure. 😱 this is a whole leak risk, so please lock it down
It is possible for a man-in-the-middle attacker to insert a "LANG" command in the command stream, thus making protocol-level diagnostic responses unintelligible to the user. A mechanism to protect the integrity of the session can be used to defeat such attacks. For example, a client can issue the "STLS" command [RFC2595] before issuing the "LANG" command. 🕵️♀️ a sneaky attacker could scramble the responses, so protect the session first 🔐
As with other internationalization upgrades, modifications to server authentication code (in this case, to support non-ASCII strings) need to be done with care to avoid introducing vulnerabilities (for example, in string parsing or matching). This is particularly important if the native databases or mailstore of the operating system use some character set or encoding other than Unicode in UTF-8. 💀 string parsing bugs are NOT the vibe, so take it slow and careful
8. References 📚
8.1. Normative References
[RFC1939] Myers, J. and M. Rose, "Post Office Protocol - Version
3", STD 53, RFC 1939, May 1996.
[RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message
Bodies", RFC 2045, November 1996.
[RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions)
Part Three: Message Header Extensions for Non-ASCII
Text", RFC 2047, November 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2449] Gellens, R., Newman, C., and L. Lundblade, "POP3
Extension Mechanism", RFC 2449, November 1998.
[RFC3454] Hoffman, P. and M. Blanchet, "Preparation of
Internationalized Strings ("stringprep")", RFC 3454,
December 2002.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003.
[RFC4013] Zeilenga, K., "SASLprep: Stringprep Profile for User
Names and Passwords", RFC 4013, February 2005.
[RFC4647] Phillips, A. and M. Davis, "Matching of Language Tags",
BCP 47, RFC 4647, September 2006.
[RFC5198] Klensin, J. and M. Padlipsky, "Unicode Format for Network
Interchange", RFC 5198, March 2008.
[RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322,
October 2008.
[RFC5646] Phillips, A. and M. Davis, "Tags for Identifying
Languages", BCP 47, RFC 5646, September 2009.
[RFC6152] Klensin, J., Freed, N., Rose, M., and D. Crocker, "SMTP
Service Extension for 8-bit MIME Transport", STD 71,
RFC 6152, March 2011.
[RFC6530] Klensin, J. and Y. Ko, "Overview and Framework for
Internationalized Email", RFC 6530, February 2012.
[RFC6532] Yang, A., Steele, S., and N. Freed, "Internationalized
Email Headers", RFC 6532, February 2012.
[RFC6855] Resnick, P., Newman, C., and S. Shen, "IMAP Support for
UTF-8", RFC 6855, March 2013.8.2. Informative References
[ISO639-2] International Organization for Standardization, "ISO
639-2:1998. Codes for the representation of names of
languages -- Part 2: Alpha-3 code", October 1998.
[RFC2231] Freed, N. and K. Moore, "MIME Parameter Value and Encoded
Word Extensions:
Character Sets, Languages, and Continuations", RFC 2231,
November 1997.
[RFC2595] Newman, C., "Using TLS with IMAP, POP3 and ACAP",
RFC 2595, June 1999.
[RFC5034] Siemborski, R. and A. Menon-Sen, "The Post Office
Protocol (POP3) Simple Authentication and Security Layer
(SASL) Authentication Mechanism", RFC 5034, July 2007.
[RFC5721] Gellens, R. and C. Newman, "POP3 Support for UTF-8",
RFC 5721, February 2010.Appendix A. Design Rationale 🎀
okay so this appendix is the "why did they do it this way?" section 🧠✨ it's totally non-normative, meaning it's just the backstory and not a rule you have to follow, but it's SO good for understanding the vibe behind the choices 💅
Bestie, the first one is about the old 7-bit encoding tricks 🙈 Because the MIME Message Header Extensions [RFC2047] kept causing interoperability problems, and the extended MIME parameter encodings [RFC2231] barely got deployed, the hope is that these 7-bit encoding mechanisms can be deprecated someday, once UTF-8 header support is everywhere 🌈🦋 fingers crossed!!
The second one is giving careful, responsible energy 🫶 The USER capability (Section 2.2) and the upgraded "USER" command, plus the extra support for non-ASCII credentials, are optional 🍓 Why? Because nobody fully understands the implementation burden of SASLprep [RFC4013] yet, and forcing everyone to support it could hurt deployment. Not every server needs to be a superhero on day one 💜
Appendix B. Acknowledgments 🌸
Huge thanks to John Klensin, Joseph Yee, Tony Hansen, Alexey Melnikov, and the other Email Address Internationalization working group participants 🫶✨ They gave helpful suggestions and had some seriously interesting debates that made this spec way better. Iconic teamwork, no cap 👑
Authors' Addresses 💌
Randall Gellens
QUALCOMM Incorporated
5775 Morehouse Drive
San Diego, CA 92651
USA
EMail: rg+ietf@qualcomm.com
Chris Newman
Oracle
800 Royal Oaks
Monrovia, CA 91016-6347
USA
EMail: chris.newman@oracle.com
Jiankang YAO
CNNIC
No.4 South 4th Street, Zhongguancun
Beijing
China
Phone: +86 10 58813007
EMail: yaojk@cnnic.cn
Kazunori Fujiwara
Japan Registry Services Co., Ltd.
Chiyoda First Bldg. East 13F, 3-8-1 Nishi-Kanda
Tokyo
Japan
Phone: +81 3 5215 8451
EMail: fujiwara@jprs.co.jp📦 where this page comes from
- ietf: rfc6856 2013-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms