J. Twine INTERNET-DRAFT JRTwine Software, LLC draft-twine-ftpmd5-00.txt May, 2002 The 'MD5' and "MMD5" FTP Command Extensions Status of This Document This document is an Internet-Draft and is subject to all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/1id-abstracts.html The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html Abstract This document specifies two additions to the File Transfer Protocol (FTP). These additions (new Server commands) would give FTP Servers the ability to generate (or otherwise obtain) and return MD5 checksums for the files it has available for transfer. It is the author's belief that this would provide a great benefit to the Internet community, because it would allow automated transfer agents, as well as Web Browsers and other "click-to-download" applications to be able to automatically verify the data of a downloaded file, and hence be able to detect any data tampering and/or corruption that may occurred while "on the wire", or possibly while the file was on the Server (a virus infection). Copyright Notice This document is in the public domain. Any and all copyright protection that might apply in any jurisdiction is expressly disclaimed. Comments Comments should be directed to James R. Twine (jtwine@jrtwine.com). J.Twine Internet-Draft [Page 1]
INTERNET-DRAFT The 'MD5' and "MMD5" FTP Command Extensions May 2002 Table of Contents Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Table of Contents . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Rational . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Server Requirements . . . . . . . . . . . . . . . . . . . . 3 3.1 Command Format (MD5) . . . . . . . . . . . . . . . . . . . 4 3.1.1 MD5 Examples . . . . . . . . . . . . . . . . . . . . . . . 4 3.2 Command Format (MMD5) . . . . . . . . . . . . . . . . . . . 5 3.2.1 MMD5 Examples . . . . . . . . . . . . . . . . . . . . . . 5 4. References . . . . . . . . . . . . . . . . . . . . . . . . . 6 5. Author's Address . . . . . . . . . . . . . . . . . . . . . . 6 J.Twine Internet-Draft [Page 2]
INTERNET-DRAFT The 'MD5' and "MMD5" FTP Command Extensions May 2002 1. Introduction This Draft is being distributed to members of the Internet community in order to solicit their reactions to the proposals contained in it. 2. Rational FTP is still very much in use on the Internet. These days, some servers make available files that contain the checksums for some of the files that are available. These available checksums allow users to be able to verify the content of the files that they have downloaded. However, this introduces some additional overhead: these MD5 checksums must be manually generated, put into a file, the file placed where it can be accessed. Then, users must manually download the file containing the checksum, generate an MD5 checksum from the file they just downloaded, and (usually) visually compare the two checksums to determine the validity of the file. Having these tasks automated, by making the MD5 checksums available directly from the FTP Server proper, and having file-transfer implementations use them, alleviates some of the user intervention that would otherwise be required. 3. Server Requirements FTP Servers would have to implement a new server-side command, called "MD5", this command would normally generate and return a MD5 for the specified file. Optionally, the FTP Server could also implement the "MMD5" command, which is used to obtain MD5 checksums for multiple files using a single request. (These commands impose no specific or additional syntax on the formatting of a filepath, they use the Server's existing conventions.) The Server implementation is also free to use some form of caching to keep the generated MD5 checksums, so that the MD5 checksum values do not have to be regenerated over and over again when requested. This also allows the Server implementations to maintain some level of security: the Server can expose administrative commands that regenerate the cache of MD5 checksums on command, thus allowing for "known good" checksums to be kept, and would be insensitive to things like the file becoming corrupted or otherwise tampered with after the "known good" MD5 checksum was generated. J.Twine Internet-Draft [Page 3]
INTERNET-DRAFT The 'MD5' and "MMD5" FTP Command Extensions May 2002 A Server implementation could even take that approach one step further: by generating additional MD5 checksums "on the fly" and comparing them to the "known good" values that were stored earlier, the Server would now have the ability to detect file corruption and/or tampering earlier than the user would normally discover. The command would support a full or relative path, so that a directory change would not be necessary in order to obtain the MD5 checksum of a particular file. Of course, the command should normally be restricted to the directory tree and/or files that the connected user would normally have access to. 3.1 Command Format (MD5) The "MD5" command is used to obtain a MD5 checksum for a single file, and is specified as follows: MD5 [Filepath] Possible responses to this command would normally include: 251 [FilePath] E67DED2886048D308532042B777D53CF 500 Command Not Recognized 502 Command Not Implemented 504 Command Not Implemented for the Specified Argument (Note that the returned MD5 checksum is in UPPERCASE.) A successful response of "251" would contain the specified filepath (verbatim) followed by a space (or some amount of whitespace), and then followed by the MD5 checksum value in ASCII format. An error return of "500" would be for an obvious reason: the FTP Server does not recognize the "MD5" command. An error return of "502" would be appropriate if the FTP Server regocnized the command, but did not support it, or the FTP Server administrator disabled it. An error return of "504" would be appropriate if the user requested an MD5 checksum for a directory (for example). 3.1.1 MD5 Examples This first example demonstrates a request for a MD5 checksum of a single file ("C>" is Client input, and "S>" is Server response): C> MD5 filename.ext S> 251 filename.ext E67DED2886048D308532042B777D53CF This second example demonstrates a request for a MD5 checksum of a directory: J.Twine Internet-Draft [Page 4]
INTERNET-DRAFT The 'MD5' and "MMD5" FTP Command Extensions May 2002 C> MD5 ".." S> 504 Command Not Implemented for the Specified Argument This third example demonstrates a request for a MD5 checksum of a file using a relative path: C> MD5 "../SomeDir/A File.txt" S> 251 "../SomeDir/A File.txt" 604E67DED8D308B777D53CF532042288 3.2 Command Format (MMD5) The "MMD5" command is used to obtain MD5 checksums for multiple files by a single request. Filepaths are comma separated, and are specified as follows (it is to be considered valid to specify a single filepath with with MMD5 command): MMD5 [Filepath1], [Filepath2] [...] Possible responses to this command would normally include: 252 [FilePath1] E67DED2886048D308532042B777D53CF,[Filepath2] 308536048D20E67D77D53CFED28842B7 [...] 500 Command Not Recognized 502 Command Not Implemented 504 Command Not Implemented for the Specified Argument A successful response of "252" would contain comma separated "groups" of MD5 checksum information. Each group would contain the specified filepath (verbatim) followed by a space (or some amount of whitespace) followed by the MD5 checksum value in ASCII format. An error return of "500" would be the same as described for the "MD5" command. An error return of "502" would be appropriate if the "MMD5" command was not implemented or disabled. An error return of "504" would be the same as described form the "MD5" command, with this exception: of any of the specified filepaths were invalid, the server would return this error code (i.e. it would no MD5 checksums at all). 3.2.1 MMD5 Examples This first example demonstrates a request for a MD5 checksum of a single file: C> MMD5 filename.ext S> 251 filename.ext E67DED2886048D308532042B777D53CF J.Twine Internet-Draft [Page 5]
INTERNET-DRAFT The 'MD5' and "MMD5" FTP Command Extensions May 2002 This second example demonstrates a request for the MD5 checksums for two files: C> MMD5 filename.ext, "../SomeDir/A File.txt" S> 252 filename.ext E67DED2886048D308532042B777D53CF, "../SomeDir/A File.txt" 604E67DED8D308B777D53CF532042288 This third example demonstrates a request for the MD5 checksums of a file and a directory: C> MD5 filename.ext, ".." S> 504 Command Not Implemented for the Specified Argument 4. References [1] Postel, J., Reynolds J., "Instructions to RFC Authors", RFC 2223, October 1997 [2] Postel, J., Reynolds J., "FILE TRANSFER PROTOCOL (FTP)", RFC 959, October 1958 [3] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992 [4] Various, "Guidelines to Authors of Internet-Drafts", http://www.ietf.org/ietf/1id-guidelines.txt 4. Author's Address James R. Twine JRTwine Software, LLC 379 Shirley Hill Road Goffstown, NH, 03045 (USA) Phone: +1 603-644-1307 EMail: jtwine@jrtwine.com J.Twine Internet-Draft [Page 6]