rfc3548.txt		rfc4648.txt
	Network Working Group S. Josefsson, Ed.		Network Working Group S. Josefsson
	Request for Comments: 3548 July 2003		Request for Comments: 4648 SJD
	Category: Informational		Obsoletes: 3548 October 2006
			Category: Standards Track
	The Base16, Base32, and Base64 Data Encodings		The Base16, Base32, and Base64 Data Encodings
	Status of this Memo		Status of This Memo
	This memo provides information for the Internet community. It does		This document specifies an Internet standards track protocol for the
	not specify an Internet standard of any kind. Distribution of this		Internet community, and requests discussion and suggestions for
	memo is unlimited.		improvements. Please refer to the current edition of the "Internet
			Official Protocol Standards" (STD 1) for the standardization state
			and status of this protocol. Distribution of this memo is unlimited.
	Copyright Notice		Copyright Notice
	Copyright (C) The Internet Society (2003). All Rights Reserved.		Copyright (C) The Internet Society (2006).
	Abstract		Abstract
	This document describes the commonly used base 64, base 32, and base		This document describes the commonly used base 64, base 32, and base
	16 encoding schemes. It also discusses the use of line-feeds in		16 encoding schemes. It also discusses the use of line-feeds in
	encoded data, use of padding in encoded data, use of non-alphabet		encoded data, use of padding in encoded data, use of non-alphabet
	characters in encoded data, and use of different encoding alphabets.		characters in encoded data, use of different encoding alphabets, and
			canonical encodings.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction ....................................................3
	2. Implementation discrepancies . . . . . . . . . . . . . . . . . 2		2. Conventions Used in This Document ...............................3
	2.1. Line feeds in encoded data . . . . . . . . . . . . . . . 2		3. Implementation Discrepancies ....................................3
	2.2. Padding of encoded data . . . . . . . . . . . . . . . . 3		3.1. Line Feeds in Encoded Data .................................3
	2.3. Interpretation of non-alphabet characters in encoded		3.2. Padding of Encoded Data ....................................4
	data . . . . . . . . . . . . . . . . . . . . . . . . . . 3		3.3. Interpretation of Non-Alphabet Characters in Encoded Data ..4
	2.4. Choosing the alphabet . . . . . . . . . . . . . . . . . 3		3.4. Choosing the Alphabet ......................................4
	3. Base 64 Encoding . . . . . . . . . . . . . . . . . . . . . . . 4		3.5. Canonical Encoding .........................................5
	4. Base 64 Encoding with URL and Filename Safe Alphabet . . . . . 6		4. Base 64 Encoding ................................................5
	5. Base 32 Encoding . . . . . . . . . . . . . . . . . . . . . . . 6		5. Base 64 Encoding with URL and Filename Safe Alphabet ............7
	6. Base 16 Encoding . . . . . . . . . . . . . . . . . . . . . . . 8		6. Base 32 Encoding ................................................8
	7. Illustrations and examples . . . . . . . . . . . . . . . . . . 9		7. Base 32 Encoding with Extended Hex Alphabet ....................10
	8. Security Considerations . . . . . . . . . . . . . . . . . . . 10		8. Base 16 Encoding ...............................................10
	9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11		9. Illustrations and Examples .....................................11
	9.1. Normative References . . . . . . . . . . . . . . . . . . 11		10. Test Vectors ..................................................12
	9.2. Informative References . . . . . . . . . . . . . . . . . 11		11. ISO C99 Implementation of Base64 ..............................14
	10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 11		12. Security Considerations .......................................14
	11. Editor's Address . . . . . . . . . . . . . . . . . . . . . . . 12		13. Changes Since RFC 3548 ........................................15
	12. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 13		14. Acknowledgements ..............................................15
			15. Copying Conditions ............................................15
			16. References ....................................................16
			16.1. Normative References .....................................16
			16.2. Informative References ...................................16
	1. Introduction		1. Introduction
	Base encoding of data is used in many situations to store or transfer		Base encoding of data is used in many situations to store or transfer
	data in environments that, perhaps for legacy reasons, are restricted		data in environments that, perhaps for legacy reasons, are restricted
	to only US-ASCII [9] data. Base encoding can also be used in new		to US-ASCII [1] data. Base encoding can also be used in new
	applications that do not have legacy restrictions, simply because it		applications that do not have legacy restrictions, simply because it
	makes it possible to manipulate objects with text editors.		makes it possible to manipulate objects with text editors.
	In the past, different applications have had different requirements		In the past, different applications have had different requirements
	and thus sometimes implemented base encodings in slightly different		and thus sometimes implemented base encodings in slightly different
	ways. Today, protocol specifications sometimes use base encodings in		ways. Today, protocol specifications sometimes use base encodings in
	general, and "base64" in particular, without a precise description or		general, and "base64" in particular, without a precise description or
	reference. MIME [3] is often used as a reference for base64 without		reference. Multipurpose Internet Mail Extensions (MIME) [4] is often
	considering the consequences for line-wrapping or non-alphabet		used as a reference for base64 without considering the consequences
	characters. The purpose of this specification is to establish common		for line-wrapping or non-alphabet characters. The purpose of this
	alphabet and encoding considerations. This will hopefully reduce		specification is to establish common alphabet and encoding
	ambiguity in other documents, leading to better interoperability.		considerations. This will hopefully reduce ambiguity in other
			documents, leading to better interoperability.
			2. Conventions Used in This Document
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this		"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
	document are to be interpreted as described in RFC 2119 [1].		document are to be interpreted as described in [2].
	2. Implementation discrepancies		3. Implementation Discrepancies
	Here we discuss the discrepancies between base encoding		Here we discuss the discrepancies between base encoding
	implementations in the past, and where appropriate, mandate a		implementations in the past and, where appropriate, mandate a
	specific recommended behavior for the future.		specific recommended behavior for the future.
	2.1. Line feeds in encoded data		3.1. Line Feeds in Encoded Data
	MIME [3] is often used as a reference for base 64 encoding. However,		MIME [4] is often used as a reference for base 64 encoding. However,
	MIME does not define "base 64" per se, but rather a "base 64		MIME does not define "base 64" per se, but rather a "base 64 Content-
	Content-Transfer-Encoding" for use within MIME. As such, MIME		Transfer-Encoding" for use within MIME. As such, MIME enforces a
	enforces a limit on line length of base 64 encoded data to 76		limit on line length of base 64-encoded data to 76 characters. MIME
	characters. MIME inherits the encoding from PEM [2] stating it is		inherits the encoding from Privacy Enhanced Mail (PEM) [3], stating
	"virtually identical", however PEM uses a line length of 64		that it is "virtually identical"; however, PEM uses a line length of
	characters. The MIME and PEM limits are both due to limits within		64 characters. The MIME and PEM limits are both due to limits within
	SMTP.		SMTP.
	Implementations MUST NOT not add line feeds to base encoded data		Implementations MUST NOT add line feeds to base-encoded data unless
	unless the specification referring to this document explicitly		the specification referring to this document explicitly directs base
	directs base encoders to add line feeds after a specific number of		encoders to add line feeds after a specific number of characters.
	characters.
	2.2. Padding of encoded data		3.2. Padding of Encoded Data
	In some circumstances, the use of padding ("=") in base encoded data		In some circumstances, the use of padding ("=") in base-encoded data
	is not required nor used. In the general case, when assumptions on		is not required or used. In the general case, when assumptions about
	size of transported data cannot be made, padding is required to yield		the size of transported data cannot be made, padding is required to
	correct decoded data.		yield correct decoded data.
	Implementations MUST include appropriate pad characters at the end of		Implementations MUST include appropriate pad characters at the end of
	encoded data unless the specification referring to this document		encoded data unless the specification referring to this document
	explicitly states otherwise.		explicitly states otherwise.
	2.3. Interpretation of non-alphabet characters in encoded data		The base64 and base32 alphabets use padding, as described below in
			sections 4 and 6, but the base16 alphabet does not need it; see
			section 8.
	Base encodings use a specific, reduced, alphabet to encode binary		3.3. Interpretation of Non-Alphabet Characters in Encoded Data
	data. Non alphabet characters could exist within base encoded data,
	caused by data corruption or by design. Non alphabet characters may		Base encodings use a specific, reduced alphabet to encode binary
			data. Non-alphabet characters could exist within base-encoded data,
			caused by data corruption or by design. Non-alphabet characters may
	be exploited as a "covert channel", where non-protocol data can be		be exploited as a "covert channel", where non-protocol data can be
	sent for nefarious purposes. Non alphabet characters might also be		sent for nefarious purposes. Non-alphabet characters might also be
	sent in order to exploit implementation errors leading to, e.g.,		sent in order to exploit implementation errors leading to, e.g.,
	buffer overflow attacks.		buffer overflow attacks.
	Implementations MUST reject the encoding if it contains characters		Implementations MUST reject the encoded data if it contains
	outside the base alphabet when interpreting base encoded data, unless		characters outside the base alphabet when interpreting base-encoded
	the specification referring to this document explicitly states		data, unless the specification referring to this document explicitly
	otherwise. Such specifications may, as MIME does, instead state that		states otherwise. Such specifications may instead state, as MIME
	characters outside the base encoding alphabet should simply be		does, that characters outside the base encoding alphabet should
	ignored when interpreting data ("be liberal in what you accept").		simply be ignored when interpreting data ("be liberal in what you
	Note that this means that any CRLF constitute "non alphabet		accept"). Note that this means that any adjacent carriage return/
	characters" and are ignored. Furthermore, such specifications may		line feed (CRLF) characters constitute "non-alphabet characters" and
	consider the pad character, "=", as not part of the base alphabet		are ignored. Furthermore, such specifications MAY ignore the pad
	until the end of the string. If more than the allowed number of pad		character, "=", treating it as non-alphabet data, if it is present
	characters are found at the end of the string, e.g., a base 64 string		before the end of the encoded data. If more than the allowed number
	terminated with "===", the excess pad characters could be ignored.		of pad characters is found at the end of the string (e.g., a base 64
			string terminated with "==="), the excess pad characters MAY also be
			ignored.
	2.4. Choosing the alphabet		3.4. Choosing the Alphabet
	Different applications have different requirements on the characters		Different applications have different requirements on the characters
	in the alphabet. Here are a few requirements that determine which		in the alphabet. Here are a few requirements that determine which
	alphabet should be used:		alphabet should be used:
	o Handled by humans. Characters "0", "O" are easily interchanged,		o Handled by humans. The characters "0" and "O" are easily
	as well "1", "l" and "I". In the base32 alphabet below, where 0		confused, as are "1", "l", and "I". In the base32 alphabet below,
	(zero) and 1 (one) is not present, a decoder may interpret 0 as		where 0 (zero) and 1 (one) are not present, a decoder may
	O, and 1 as I or L depending on case. (However, by default it		interpret 0 as O, and 1 as I or L depending on case. (However, by
	should not, see previous section.)		default it should not; see previous section.)
	o Encoded into structures that place other requirements. For base
			o Encoded into structures that mandate other requirements. For base
	16 and base 32, this determines the use of upper- or lowercase		16 and base 32, this determines the use of upper- or lowercase
	alphabets. For base 64, the non-alphanumeric characters (in		alphabets. For base 64, the non-alphanumeric characters (in
	particular "/") may be problematic in file names and URLs.		particular, "/") may be problematic in file names and URLs.
	o Used as identifiers. Certain characters, notably "+" and "/" in		o Used as identifiers. Certain characters, notably "+" and "/" in
	the base 64 alphabet, are treated as word-breaks by legacy text		the base 64 alphabet, are treated as word-breaks by legacy text
	search/index tools.		search/index tools.
	There is no universally accepted alphabet that fulfills all the		There is no universally accepted alphabet that fulfills all the
	requirements. In this document, we document and name some currently		requirements. For an example of a highly specialized variant, see
	used alphabets.		IMAP [8]. In this document, we document and name some currently used
			alphabets.
	3. Base 64 Encoding		3.5. Canonical Encoding
	The following description of base 64 is due to [2], [3], [4] and [5].		The padding step in base 64 and base 32 encoding can, if improperly
			implemented, lead to non-significant alterations of the encoded data.
			For example, if the input is only one octet for a base 64 encoding,
			then all six bits of the first symbol are used, but only the first
			two bits of the next symbol are used. These pad bits MUST be set to
			zero by conforming encoders, which is described in the descriptions
			on padding below. If this property do not hold, there is no
			canonical representation of base-encoded data, and multiple base-
			encoded strings can be decoded to the same binary data. If this
			property (and others discussed in this document) holds, a canonical
			encoding is guaranteed.
			In some environments, the alteration is critical and therefore
			decoders MAY chose to reject an encoding if the pad bits have not
			been set to zero. The specification referring to this may mandate a
			specific behaviour.
			4. Base 64 Encoding
			The following description of base 64 is derived from [3], [4], [5],
			and [6]. This encoding may be referred to as "base64".
	The Base 64 encoding is designed to represent arbitrary sequences of		The Base 64 encoding is designed to represent arbitrary sequences of
	octets in a form that requires case sensitivity but need not be		octets in a form that allows the use of both upper- and lowercase
	humanly readable.		letters but that need not be human readable.
	A 65-character subset of US-ASCII is used, enabling 6 bits to be		A 65-character subset of US-ASCII is used, enabling 6 bits to be
	represented per printable character. (The extra 65th character, "=",		represented per printable character. (The extra 65th character, "=",
	is used to signify a special processing function.)		is used to signify a special processing function.)
	The encoding process represents 24-bit groups of input bits as output		The encoding process represents 24-bit groups of input bits as output
	strings of 4 encoded characters. Proceeding from left to right, a		strings of 4 encoded characters. Proceeding from left to right, a
	24-bit input group is formed by concatenating 3 8-bit input groups.		24-bit input group is formed by concatenating 3 8-bit input groups.
	These 24 bits are then treated as 4 concatenated 6-bit groups, each		These 24 bits are then treated as 4 concatenated 6-bit groups, each
	of which is translated into a single digit in the base 64 alphabet.		of which is translated into a single character in the base 64
			alphabet.
	Each 6-bit group is used as an index into an array of 64 printable		Each 6-bit group is used as an index into an array of 64 printable
	characters. The character referenced by the index is placed in the		characters. The character referenced by the index is placed in the
	output string.		output string.
	Table 1: The Base 64 Alphabet		Table 1: The Base 64 Alphabet
	Value Encoding Value Encoding Value Encoding Value Encoding		Value Encoding Value Encoding Value Encoding Value Encoding
	0 A 17 R 34 i 51 z		0 A 17 R 34 i 51 z
	1 B 18 S 35 j 52 0		1 B 18 S 35 j 52 0
	skipping to change at page 5, line 29		skipping to change at page 6, line 44
	11 L 28 c 45 t 62 +		11 L 28 c 45 t 62 +
	12 M 29 d 46 u 63 /		12 M 29 d 46 u 63 /
	13 N 30 e 47 v		13 N 30 e 47 v
	14 O 31 f 48 w (pad) =		14 O 31 f 48 w (pad) =
	15 P 32 g 49 x		15 P 32 g 49 x
	16 Q 33 h 50 y		16 Q 33 h 50 y
	Special processing is performed if fewer than 24 bits are available		Special processing is performed if fewer than 24 bits are available
	at the end of the data being encoded. A full encoding quantum is		at the end of the data being encoded. A full encoding quantum is
	always completed at the end of a quantity. When fewer than 24 input		always completed at the end of a quantity. When fewer than 24 input
	bits are available in an input group, zero bits are added (on the		bits are available in an input group, bits with value zero are added
	right) to form an integral number of 6-bit groups. Padding at the		(on the right) to form an integral number of 6-bit groups. Padding
	end of the data is performed using the '=' character. Since all base		at the end of the data is performed using the '=' character. Since
	64 input is an integral number of octets, only the following cases		all base 64 input is an integral number of octets, only the following
	can arise:		cases can arise:
	(1) the final quantum of encoding input is an integral multiple of 24		(1) The final quantum of encoding input is an integral multiple of 24
	bits; here, the final unit of encoded output will be an integral		bits; here, the final unit of encoded output will be an integral
	multiple of 4 characters with no "=" padding,		multiple of 4 characters with no "=" padding.
	(2) the final quantum of encoding input is exactly 8 bits; here, the		(2) The final quantum of encoding input is exactly 8 bits; here, the
	final unit of encoded output will be two characters followed by two		final unit of encoded output will be two characters followed by
	"=" padding characters, or		two "=" padding characters.
	(3) the final quantum of encoding input is exactly 16 bits; here, the		(3) The final quantum of encoding input is exactly 16 bits; here, the
	final unit of encoded output will be three characters followed by one		final unit of encoded output will be three characters followed by
	"=" padding character.		one "=" padding character.
	4. Base 64 Encoding with URL and Filename Safe Alphabet		5. Base 64 Encoding with URL and Filename Safe Alphabet
	The Base 64 encoding with an URL and filename safe alphabet has been		The Base 64 encoding with an URL and filename safe alphabet has been
	used in [8].		used in [12].
	An alternative alphabet has been suggested that used "~" as the 63rd		An alternative alphabet has been suggested that would use "~" as the
	character. Since the "~" character has special meaning in some file		63rd character. Since the "~" character has special meaning in some
	system environments, the encoding described in this section is		file system environments, the encoding described in this section is
	recommended instead.		recommended instead. The remaining unreserved URI character is ".",
			but some file system environments do not permit multiple "." in a
			filename, thus making the "." character unattractive as well.
	This encoding should not be regarded as the same as the "base64"		The pad character "=" is typically percent-encoded when used in an
	encoding, and should not be referred to as only "base64". Unless		URI [9], but if the data length is known implicitly, this can be
	made clear, "base64" refer to the base 64 in the previous section.		avoided by skipping the padding; see section 3.2.
			This encoding may be referred to as "base64url". This encoding
			should not be regarded as the same as the "base64" encoding and
			should not be referred to as only "base64". Unless clarified
			otherwise, "base64" refers to the base 64 in the previous section.
	This encoding is technically identical to the previous one, except		This encoding is technically identical to the previous one, except
	for the 62:nd and 63:rd alphabet character, as indicated in table 2.		for the 62:nd and 63:rd alphabet character, as indicated in Table 2.
	Table 2: The "URL and Filename safe" Base 64 Alphabet		Table 2: The "URL and Filename safe" Base 64 Alphabet
	Value Encoding Value Encoding Value Encoding Value Encoding		Value Encoding Value Encoding Value Encoding Value Encoding
	0 A 17 R 34 i 51 z		0 A 17 R 34 i 51 z
	1 B 18 S 35 j 52 0		1 B 18 S 35 j 52 0
	2 C 19 T 36 k 53 1		2 C 19 T 36 k 53 1
	3 D 20 U 37 l 54 2		3 D 20 U 37 l 54 2
	4 E 21 V 38 m 55 3		4 E 21 V 38 m 55 3
	5 F 22 W 39 n 56 4		5 F 22 W 39 n 56 4
	6 G 23 X 40 o 57 5		6 G 23 X 40 o 57 5
	7 H 24 Y 41 p 58 6		7 H 24 Y 41 p 58 6
	8 I 25 Z 42 q 59 7		8 I 25 Z 42 q 59 7
	9 J 26 a 43 r 60 8		9 J 26 a 43 r 60 8
	10 K 27 b 44 s 61 9		10 K 27 b 44 s 61 9
	11 L 28 c 45 t 62 - (minus)		11 L 28 c 45 t 62 - (minus)
	12 M 29 d 46 u 63 _ (understrike)		12 M 29 d 46 u 63 _
	13 N 30 e 47 v		13 N 30 e 47 v (underline)
	14 O 31 f 48 w (pad) =		14 O 31 f 48 w
	15 P 32 g 49 x		15 P 32 g 49 x
	16 Q 33 h 50 y		16 Q 33 h 50 y (pad) =
	5. Base 32 Encoding		6. Base 32 Encoding
	The following description of base 32 is due to [7] (with		The following description of base 32 is derived from [11] (with
	corrections).		corrections). This encoding may be referred to as "base32".
	The Base 32 encoding is designed to represent arbitrary sequences of		The Base 32 encoding is designed to represent arbitrary sequences of
	octets in a form that needs to be case insensitive but need not be		octets in a form that needs to be case insensitive but that need not
	humanly readable.		be human readable.
	A 33-character subset of US-ASCII is used, enabling 5 bits to be		A 33-character subset of US-ASCII is used, enabling 5 bits to be
	represented per printable character. (The extra 33rd character, "=",		represented per printable character. (The extra 33rd character, "=",
	is used to signify a special processing function.)		is used to signify a special processing function.)
	The encoding process represents 40-bit groups of input bits as output		The encoding process represents 40-bit groups of input bits as output
	strings of 8 encoded characters. Proceeding from left to right, a		strings of 8 encoded characters. Proceeding from left to right, a
	40-bit input group is formed by concatenating 5 8bit input groups.		40-bit input group is formed by concatenating 5 8bit input groups.
	These 40 bits are then treated as 8 concatenated 5-bit groups, each		These 40 bits are then treated as 8 concatenated 5-bit groups, each
	of which is translated into a single digit in the base 32 alphabet.		of which is translated into a single character in the base 32
	When encoding a bit stream via the base 32 encoding, the bit stream		alphabet. When a bit stream is encoded via the base 32 encoding, the
	must be presumed to be ordered with the most-significant-bit first.		bit stream must be presumed to be ordered with the most-significant-
	That is, the first bit in the stream will be the high-order bit in		bit first. That is, the first bit in the stream will be the high-
	the first 8bit byte, and the eighth bit will be the low-order bit in		order bit in the first 8bit byte, the eighth bit will be the low-
	the first 8bit byte, and so on.		order bit in the first 8bit byte, and so on.
	Each 5-bit group is used as an index into an array of 32 printable		Each 5-bit group is used as an index into an array of 32 printable
	characters. The character referenced by the index is placed in the		characters. The character referenced by the index is placed in the
	output string. These characters, identified in Table 2, below, are		output string. These characters, identified in Table 3, below, are
	selected from US-ASCII digits and uppercase letters.		selected from US-ASCII digits and uppercase letters.
	Table 3: The Base 32 Alphabet		Table 3: The Base 32 Alphabet
	Value Encoding Value Encoding Value Encoding Value Encoding		Value Encoding Value Encoding Value Encoding Value Encoding
	0 A 9 J 18 S 27 3		0 A 9 J 18 S 27 3
	1 B 10 K 19 T 28 4		1 B 10 K 19 T 28 4
	2 C 11 L 20 U 29 5		2 C 11 L 20 U 29 5
	3 D 12 M 21 V 30 6		3 D 12 M 21 V 30 6
	4 E 13 N 22 W 31 7		4 E 13 N 22 W 31 7
	5 F 14 O 23 X		5 F 14 O 23 X
	6 G 15 P 24 Y (pad) =		6 G 15 P 24 Y (pad) =
	7 H 16 Q 25 Z		7 H 16 Q 25 Z
	8 I 17 R 26 2		8 I 17 R 26 2
	Special processing is performed if fewer than 40 bits are available		Special processing is performed if fewer than 40 bits are available
	at the end of the data being encoded. A full encoding quantum is		at the end of the data being encoded. A full encoding quantum is
	always completed at the end of a body. When fewer than 40 input bits		always completed at the end of a body. When fewer than 40 input bits
	are available in an input group, zero bits are added (on the right)		are available in an input group, bits with value zero are added (on
	to form an integral number of 5-bit groups. Padding at the end of		the right) to form an integral number of 5-bit groups. Padding at
	the data is performed using the "=" character. Since all base 32		the end of the data is performed using the "=" character. Since all
	input is an integral number of octets, only the following cases can		base 32 input is an integral number of octets, only the following
	arise:		cases can arise:
	(1) the final quantum of encoding input is an integral multiple of 40		(1) The final quantum of encoding input is an integral multiple of 40
	bits; here, the final unit of encoded output will be an integral		bits; here, the final unit of encoded output will be an integral
	multiple of 8 characters with no "=" padding,		multiple of 8 characters with no "=" padding.
	(2) the final quantum of encoding input is exactly 8 bits; here, the
	final unit of encoded output will be two characters followed by six
	"=" padding characters,
	(3) the final quantum of encoding input is exactly 16 bits; here, the		(2) The final quantum of encoding input is exactly 8 bits; here, the
	final unit of encoded output will be four characters followed by four		final unit of encoded output will be two characters followed by
	"=" padding characters,		six "=" padding characters.
	(4) the final quantum of encoding input is exactly 24 bits; here, the		(3) The final quantum of encoding input is exactly 16 bits; here, the
			final unit of encoded output will be four characters followed by
			four "=" padding characters.
			(4) The final quantum of encoding input is exactly 24 bits; here, the
	final unit of encoded output will be five characters followed by		final unit of encoded output will be five characters followed by
	three "=" padding characters, or		three "=" padding characters.
	(5) the final quantum of encoding input is exactly 32 bits; here, the		(5) The final quantum of encoding input is exactly 32 bits; here, the
	final unit of encoded output will be seven characters followed by one		final unit of encoded output will be seven characters followed by
	"=" padding character.		one "=" padding character.
	6. Base 16 Encoding		7. Base 32 Encoding with Extended Hex Alphabet
			The following description of base 32 is derived from [7]. This
			encoding may be referred to as "base32hex". This encoding should not
			be regarded as the same as the "base32" encoding and should not be
			referred to as only "base32". This encoding is used by, e.g.,
			NextSECure3 (NSEC3) [10].
			One property with this alphabet, which the base64 and base32
			alphabets lack, is that encoded data maintains its sort order when
			the encoded data is compared bit-wise.
			This encoding is identical to the previous one, except for the
			alphabet. The new alphabet is found in Table 4.
			Table 4: The "Extended Hex" Base 32 Alphabet
			Value Encoding Value Encoding Value Encoding Value Encoding
			0 0 9 9 18 I 27 R
			1 1 10 A 19 J 28 S
			2 2 11 B 20 K 29 T
			3 3 12 C 21 L 30 U
			4 4 13 D 22 M 31 V
			5 5 14 E 23 N
			6 6 15 F 24 O (pad) =
			7 7 16 G 25 P
			8 8 17 H 26 Q
			8. Base 16 Encoding
	The following description is original but analogous to previous		The following description is original but analogous to previous
	descriptions. Essentially, Base 16 encoding is the standard standard		descriptions. Essentially, Base 16 encoding is the standard case-
	case insensitive hex encoding, and may be referred to as "base16" or		insensitive hex encoding and may be referred to as "base16" or "hex".
	"hex".
	A 16-character subset of US-ASCII is used, enabling 4 bits to be		A 16-character subset of US-ASCII is used, enabling 4 bits to be
	represented per printable character.		represented per printable character.
	The encoding process represents 8-bit groups (octets) of input bits		The encoding process represents 8-bit groups (octets) of input bits
	as output strings of 2 encoded characters. Proceeding from left to		as output strings of 2 encoded characters. Proceeding from left to
	right, a 8-bit input is taken from the input data. These 8 bits are		right, an 8-bit input is taken from the input data. These 8 bits are
	then treated as 2 concatenated 4-bit groups, each of which is		then treated as 2 concatenated 4-bit groups, each of which is
	translated into a single digit in the base 16 alphabet.		translated into a single character in the base 16 alphabet.
	Each 4-bit group is used as an index into an array of 16 printable		Each 4-bit group is used as an index into an array of 16 printable
	characters. The character referenced by the index is placed in the		characters. The character referenced by the index is placed in the
	output string.		output string.
	Table 5: The Base 16 Alphabet		Table 5: The Base 16 Alphabet
	Value Encoding Value Encoding Value Encoding Value Encoding		Value Encoding Value Encoding Value Encoding Value Encoding
	0 0 4 4 8 8 12 C		0 0 4 4 8 8 12 C
	1 1 5 5 9 9 13 D		1 1 5 5 9 9 13 D
	2 2 6 6 10 A 14 E		2 2 6 6 10 A 14 E
	3 3 7 7 11 B 15 F		3 3 7 7 11 B 15 F
	Unlike base 32 and base 64, no special padding is necessary since a		Unlike base 32 and base 64, no special padding is necessary since a
	full code word is always available.		full code word is always available.
	7. Illustrations and examples		9. Illustrations and Examples
	To translate between binary and a base encoding, the input is stored		To translate between binary and a base encoding, the input is stored
	in a structure and the output is extracted. The case for base 64 is		in a structure, and the output is extracted. The case for base 64 is
	displayed in the following figure, borrowed from [4].		displayed in the following figure, borrowed from [5].
	+--first octet--+-second octet--+--third octet--+		+--first octet--+-second octet--+--third octet--+
	|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|		|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|
	+-----------+---+-------+-------+---+-----------+		+-----------+---+-------+-------+---+-----------+
	|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|		|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|
	+--1.index--+--2.index--+--3.index--+--4.index--+		+--1.index--+--2.index--+--3.index--+--4.index--+
	The case for base 32 is shown in the following figure, borrowed from		The case for base 32 is shown in the following figure, borrowed from
	[6]. Each successive character in a base-32 value represents 5		[7]. Each successive character in a base-32 value represents 5
	successive bits of the underlying octet sequence. Thus, each group		successive bits of the underlying octet sequence. Thus, each group
	of 8 characters represents a sequence of 5 octets (40 bits).		of 8 characters represents a sequence of 5 octets (40 bits).
	1 2 3		1 2 3
	01234567 89012345 67890123 45678901 23456789		01234567 89012345 67890123 45678901 23456789
	+--------+--------+--------+--------+--------+		+--------+--------+--------+--------+--------+
	|< 1 >< 2| >< 3 ><|.4 >< 5.|>< 6 ><.|7 >< 8 >|		|< 1 >< 2| >< 3 ><|.4 >< 5.|>< 6 ><.|7 >< 8 >|
	+--------+--------+--------+--------+--------+		+--------+--------+--------+--------+--------+
	<===> 8th character		<===> 8th character
	<====> 7th character		<====> 7th character
	<===> 6th character		<===> 6th character
	<====> 5th character		<====> 5th character
	<====> 4th character		<====> 4th character
	<===> 3rd character		<===> 3rd character
	<====> 2nd character		<====> 2nd character
	<===> 1st character		<===> 1st character
	The following example of Base64 data is from [4].		The following example of Base64 data is from [5], with corrections.
	Input data: 0x14fb9c03d97e		Input data: 0x14fb9c03d97e
	Hex: 1 4 f b 9 c | 0 3 d 9 7 e		Hex: 1 4 f b 9 c | 0 3 d 9 7 e
	8-bit: 00010100 11111011 10011100 | 00000011 11011001		8-bit: 00010100 11111011 10011100 | 00000011 11011001 01111110
	11111110		6-bit: 000101 001111 101110 011100 | 000000 111101 100101 111110
	6-bit: 000101 001111 101110 011100 | 000000 111101 100111
	111110
	Decimal: 5 15 46 28 0 61 37 62		Decimal: 5 15 46 28 0 61 37 62
	Output: F P u c A 9 l +		Output: F P u c A 9 l +
	Input data: 0x14fb9c03d9		Input data: 0x14fb9c03d9
	Hex: 1 4 f b 9 c | 0 3 d 9		Hex: 1 4 f b 9 c | 0 3 d 9
	8-bit: 00010100 11111011 10011100 | 00000011 11011001		8-bit: 00010100 11111011 10011100 | 00000011 11011001
	pad with 00		pad with 00
	6-bit: 000101 001111 101110 011100 | 000000 111101 100100		6-bit: 000101 001111 101110 011100 | 000000 111101 100100
	Decimal: 5 15 46 28 0 61 36		Decimal: 5 15 46 28 0 61 36
	pad with =		pad with =
	skipping to change at page 10, line 33		skipping to change at page 12, line 31
	Input data: 0x14fb9c03		Input data: 0x14fb9c03
	Hex: 1 4 f b 9 c | 0 3		Hex: 1 4 f b 9 c | 0 3
	8-bit: 00010100 11111011 10011100 | 00000011		8-bit: 00010100 11111011 10011100 | 00000011
	pad with 0000		pad with 0000
	6-bit: 000101 001111 101110 011100 | 000000 110000		6-bit: 000101 001111 101110 011100 | 000000 110000
	Decimal: 5 15 46 28 0 48		Decimal: 5 15 46 28 0 48
	pad with = =		pad with = =
	Output: F P u c A w = =		Output: F P u c A w = =
	8. Security Considerations		10. Test Vectors
	When implementing Base encoding and decoding, care should be taken		BASE64("") = ""
			BASE64("f") = "Zg=="
			BASE64("fo") = "Zm8="
			BASE64("foo") = "Zm9v"
			BASE64("foob") = "Zm9vYg=="
			BASE64("fooba") = "Zm9vYmE="
			BASE64("foobar") = "Zm9vYmFy"
			BASE32("") = ""
			BASE32("f") = "MY======"
			BASE32("fo") = "MZXQ===="
			BASE32("foo") = "MZXW6==="
			BASE32("foob") = "MZXW6YQ="
			BASE32("fooba") = "MZXW6YTB"
			BASE32("foobar") = "MZXW6YTBOI======"
			BASE32-HEX("") = ""
			BASE32-HEX("f") = "CO======"
			BASE32-HEX("fo") = "CPNG===="
			BASE32-HEX("foo") = "CPNMU==="
			BASE32-HEX("foob") = "CPNMUOG="
			BASE32-HEX("fooba") = "CPNMUOJ1"
			BASE32-HEX("foobar") = "CPNMUOJ1E8======"
			BASE16("") = ""
			BASE16("f") = "66"
			BASE16("fo") = "666F"
			BASE16("foo") = "666F6F"
			BASE16("foob") = "666F6F62"
			BASE16("fooba") = "666F6F6261"
			BASE16("foobar") = "666F6F626172"
			11. ISO C99 Implementation of Base64
			An ISO C99 implementation of Base64 encoding and decoding that is
			believed to follow all recommendations in this RFC is available from:
			http://josefsson.org/base-encoding/
			This code is not normative.
			The code could not be included in this RFC for procedural reasons
			(RFC 3978 section 5.4).
			12. Security Considerations
			When base encoding and decoding is implemented, care should be taken
	not to introduce vulnerabilities to buffer overflow attacks, or other		not to introduce vulnerabilities to buffer overflow attacks, or other
	attacks on the implementation. A decoder should not break on invalid		attacks on the implementation. A decoder should not break on invalid
	input including, e.g., embedded NUL characters (ASCII 0).		input including, e.g., embedded NUL characters (ASCII 0).
	If non-alphabet characters are ignored, instead of causing rejection		If non-alphabet characters are ignored, instead of causing rejection
	of the entire encoding (as recommended), a covert channel that can be		of the entire encoding (as recommended), a covert channel that can be
	used to "leak" information is made possible. The implications of		used to "leak" information is made possible. The ignored characters
	this should be understood in applications that do not follow the		could also be used for other nefarious purposes, such as to avoid a
	recommended practice. Similarly, when the base 16 and base 32		string equality comparison or to trigger implementation bugs. The
	alphabets are handled case insensitively, alteration of case can be		implications of ignoring non-alphabet characters should be understood
	used to leak information.		in applications that do not follow the recommended practice.
			Similarly, when the base 16 and base 32 alphabets are handled case
			insensitively, alteration of case can be used to leak information or
			make string equality comparisons fail.
			When padding is used, there are some non-significant bits that
			warrant security concerns, as they may be abused to leak information
			or used to bypass string equality comparisons or to trigger
			implementation problems.
	Base encoding visually hides otherwise easily recognized information,		Base encoding visually hides otherwise easily recognized information,
	such as passwords, but does not provide any computational		such as passwords, but does not provide any computational
	confidentiality. This has been known to cause security incidents		confidentiality. This has been known to cause security incidents
	when, e.g., a user reports details of a network protocol exchange		when, e.g., a user reports details of a network protocol exchange
	(perhaps to illustrate some other problem) and accidentally reveals		(perhaps to illustrate some other problem) and accidentally reveals
	the password because she is unaware that the base encoding does not		the password because she is unaware that the base encoding does not
	protect the password.		protect the password.
	9. References		Base encoding adds no entropy to the plaintext, but it does increase
			the amount of plaintext available and provide a signature for
			cryptanalysis in the form of a characteristic probability
			distribution.
	9.1. Normative References		13. Changes Since RFC 3548
	[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement		Added the "base32 extended hex alphabet", needed to preserve sort
			order of encoded data.
			Referenced IMAP for the special Base64 encoding used there.
			Fixed the example copied from RFC 2440.
			Added security consideration about providing a signature for
			cryptoanalysis.
			Added test vectors.
			Fixed typos.
			14. Acknowledgements
			Several people offered comments and/or suggestions, including John E.
			Hadstate, Tony Hansen, Gordon Mohr, John Myers, Chris Newman, and
			Andrew Sieber. Text used in this document are based on earlier RFCs
			describing specific uses of various base encodings. The author
			acknowledges the RSA Laboratories for supporting the work that led to
			this document.
			This revised version is based in parts on comments and/or suggestions
			made by Roy Arends, Eric Blake, Brian E Carpenter, Elwyn Davies, Bill
			Fenner, Sam Hartman, Ted Hardie, Per Hygum, Jelte Jansen, Clement
			Kent, Tero Kivinen, Paul Kwiatkowski, and Ben Laurie.
			15. Copying Conditions
			Copyright (c) 2000-2006 Simon Josefsson
			Regarding the abstract and sections 1, 3, 8, 10, 12, 13, and 14 of
			this document, that were written by Simon Josefsson ("the author",
			for the remainder of this section), the author makes no guarantees
			and is not responsible for any damage resulting from its use. The
			author grants irrevocable permission to anyone to use, modify, and
			distribute it in any way that does not diminish the rights of anyone
			else to use, modify, and distribute it, provided that redistributed
			derivative works do not contain misleading author or version
			information and do not falsely purport to be IETF RFC documents.
			Derivative works need not be licensed under similar terms.
			16. References
			16.1. Normative References
			[1] Cerf, V., "ASCII format for network interchange", RFC 20,
			October 1969.
			[2] Bradner, S., "Key words for use in RFCs to Indicate Requirement
	Levels", BCP 14, RFC 2119, March 1997.		Levels", BCP 14, RFC 2119, March 1997.
	9.2. Informative References		16.2. Informative References
	[2] Linn, J., "Privacy Enhancement for Internet Electronic Mail:		[3] Linn, J., "Privacy Enhancement for Internet Electronic Mail:
	Part I: Message Encryption and Authentication Procedures", RFC		Part I: Message Encryption and Authentication Procedures", RFC
	1421, February 1993.		1421, February 1993.
	[3] Freed, N. and N. Borenstein, "Multipurpose Internet Mail		[4] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
	Extensions (MIME) Part One: Format of Internet Message Bodies",		Extensions (MIME) Part One: Format of Internet Message Bodies",
	RFC 2045, November 1996.		RFC 2045, November 1996.
	[4] Callas, J., Donnerhacke, L., Finney, H. and R. Thayer, "OpenPGP		[5] Callas, J., Donnerhacke, L., Finney, H., and R. Thayer,
	Message Format", RFC 2440, November 1998.		"OpenPGP Message Format", RFC 2440, November 1998.
	[5] Eastlake, D., "Domain Name System Security Extensions", RFC 2535,		[6] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
	March 1999.		"DNS Security Introduction and Requirements", RFC 4033, March
			2005.
	[6] Klyne, G. and L. Masinter, "Identifying Composite Media		[7] Klyne, G. and L. Masinter, "Identifying Composite Media
	Features", RFC 2938, September 2000.		Features", RFC 2938, September 2000.
	[7] Myers, J., "SASL GSSAPI mechanisms", Work in Progress.		[8] Crispin, M., "INTERNET MESSAGE ACCESS PROTOCOL - VERSION
			4rev1", RFC 3501, March 2003.
	[8] Wilcox-O'Hearn, B., "Post to P2P-hackers mailing list", World		[9] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
	Wide Web http://zgp.org/pipermail/p2p-hackers/2001-		Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986,
	September/000315.html, September 2001.		January 2005.
	[9] Cerf, V., "ASCII format for Network Interchange", RFC 20, October		[10] Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNSSEC Hash
	1969.		Authenticated Denial of Existence", Work in Progress, June
			2006.
	10. Acknowledgements		[11] Myers, J., "SASL GSSAPI mechanisms", Work in Progress, May
			2000.
	Several people offered comments and suggestions, including Tony		[12] Wilcox-O'Hearn, B., "Post to P2P-hackers mailing list",
	Hansen, Gordon Mohr, John Myers, Chris Newman, and Andrew Sieber.		http://zgp.org/pipermail/p2p-hackers/2001-September/
	Text used in this document is based on earlier RFCs describing		000315.html, September 2001.
	specific uses of various base encodings. The author acknowledges the
	RSA Laboratories for supporting the work that led to this document.
	11. Editor's Address		Author's Address
	Simon Josefsson		Simon Josefsson
			SJD
	EMail: simon@josefsson.org		EMail: simon@josefsson.org
	12. Full Copyright Statement		Full Copyright Statement
	Copyright (C) The Internet Society (2003). All Rights Reserved.		Copyright (C) The Internet Society (2006).
	This document and translations of it may be copied and furnished to		This document is subject to the rights, licenses and restrictions
	others, and derivative works that comment on or otherwise explain it		contained in BCP 78, and except as set forth therein, the authors
	or assist in its implementation may be prepared, copied, published		retain all their rights.
	and distributed, in whole or in part, without restriction of any
	kind, provided that the above copyright notice and this paragraph are
	included on all such copies and derivative works. However, this
	document itself may not be modified in any way, such as by removing
	the copyright notice or references to the Internet Society or other
	Internet organizations, except as needed for the purpose of
	developing Internet standards in which case the procedures for
	copyrights defined in the Internet Standards process must be
	followed, or as required to translate it into languages other than
	English.
	The limited permissions granted above are perpetual and will not be		This document and the information contained herein are provided on an
	revoked by the Internet Society or its successors or assignees.		"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
			OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
			ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
			INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
			INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
			WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
	This document and the information contained herein is provided on an		Intellectual Property
	"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
	TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING		The IETF takes no position regarding the validity or scope of any
	BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION		Intellectual Property Rights or other rights that might be claimed to
	HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF		pertain to the implementation or use of the technology described in
	MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.		this document or the extent to which any license under such rights
			might or might not be available; nor does it represent that it has
			made any independent effort to identify any such rights. Information
			on the procedures with respect to rights in RFC documents can be
			found in BCP 78 and BCP 79.
			Copies of IPR disclosures made to the IETF Secretariat and any
			assurances of licenses to be made available, or the result of an
			attempt made to obtain a general license or permission for the use of
			such proprietary rights by implementers or users of this
			specification can be obtained from the IETF on-line IPR repository at
			http://www.ietf.org/ipr.
			The IETF invites any interested party to bring to its attention any
			copyrights, patents or patent applications, or other proprietary
			rights that may cover technology that may be required to implement
			this standard. Please address the information to the IETF at
			ietf-ipr@ietf.org.
	Acknowledgement		Acknowledgement
	Funding for the RFC Editor function is currently provided by the		Funding for the RFC Editor function is provided by the IETF
	Internet Society.		Administrative Support Activity (IASA).
End of changes. 86 change blocks.
	212 lines changed or deleted		429 lines changed or added
This html diff was produced by rfcdiff 1.29, available from http://www.levkowetz.com/ietf/tools/rfcdiff/