Microid mailing list

[Peter Saint-Andre <stpeter AT jabber.org>]

David Koblas wrote:
> If I'm reading this thread correctly it sounds like people are proposing 
> to double encode URIs before having their checksums  taken.

No no no. Never double-encode URIs.

> Section 5 of the spec says:
>    hash = algo(algo(EntityURI) + algo(EntityURI))
>
> It doesn't say:
>    hash = algo(algo(escaped(URI)) + ...)

But a URI must conform to RFC 3986.

> Fundamentally, the URL:      
> http://www.mediauk.com/discussions/profile.muk?mode=viewprofile&u=1   is 
> encoded per RFC 3986 

You're right -- "?", "=", and "&" are used here in their reserved meaning.

> - section 3 -      URI = scheme ":" hier-part [ "?" 
> query ] [ "#" fragment ]
> as soon as you start double encoding a URL you're in deep doodoo.

Agreed. I was wrong.

/psa

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature