The Internet Assigned Number Authority (IANA) Application Configuration Access Protocol (ACAP) Vendor Subtrees Registry

Since the publication of RFC 2244 (ACAP), concerns arose about handling and comparing full Unicode strings, prompting this specification to restrict new registrations to the ASCII subset of UTF-8 while preserving the requirement that processors accept arbitrary Unicode vendor tags already in use.

registry, security

Textual rather than numeric vendor identifiers were chosen so engineers and operators diagnosing protocol problems have some possibility of recognizing the origin of a vendor attribute without consulting a registry. The ASCII restriction for registrations is not believed to harm this diagnostic use case.

registry

At the time of publication, no existing registrations violate the newly restricted ASCII-only character syntax for registrations, so the tightened constraint is not believed to introduce any interoperability issues with deployed systems.

registry

Changes from RFC 2244 include: restricting registrations to ASCII, clarifying that 'vendor.<name>' is a name in its own right (not only a prefix), prohibiting embedded slashes in the company/product name, and adding an example registration entry.

registry

A Vendor Token's company or product name component MUST NOT contain any slash character, period, or the percent and asterisk characters typically used as wildcards.

registry

Applications and specifications MUST be able to accept Vendor Tokens conforming to the broader 'possible-vendor-tag' production, which includes non-ASCII Unicode codepoints encoded as UTF-8, even though registrations are currently restricted to ASCII.

registry

Vendor Tokens MUST be registered with IANA before use, as indicated by the 'vendor-token' ABNF production which carries this normative annotation.

registry

Vendors may only use names conforming to the 'iana-vendor-tag' ABNF production (ASCII letters, digits, hyphen, and space) at the current time; future revisions may relax this constraint.

registry

A Vendor Token is a UTF-8 string beginning with the literal prefix 'vendor.' followed by the company or product name. It forms a Vendor Name when further dot-separated name components are appended, though those additional components need not be registered.

registry

This document updates the IANA 'ACAP Vendor Subtrees' registry, originally created by RFC 2244. Registration is on a first come, first served basis, and reserved Vendor Names apply across all protocols that reuse this namespace (including IMAP ANNOTATE and IMAP METADATA).

registry, ldap

There are no known security issues with the registry itself. Individual protocols using Vendor Subtree names may have their own security issues. The introduction of Unicode carries inherent security implications, and restricting registrations to ASCII is considered to mitigate those risks.

security, registry

The ABNF defines 'vendor-name' as a 'vendor-token' optionally followed by dot-separated 'name-component' segments. The 'iana-vendor-tag' production restricts registrations to 1*(ALPHA / DIGIT / SP / "-"), while 'possible-vendor-tag' allows arbitrary UTF-8 multi-byte sequences (UTF8-2, UTF8-3, UTF8-4) and most ASCII except '.', '/', '%', and '*'.

registry