Adam M. Costello Created 2026-10-13 Updated 2026-11-05
Adam M. Costello authored the Punycode specification in RFC 3492, which describes a reversible encoding of Unicode strings using the basic ASCII repertoire for internationalized domain-name applications. The encoding preserves basic code points literally and represents additional ones through the Bootstring algorithm.[ref] He is also listed as an author and former editor of the PNG specification.[ref]
ASCII 2026-11-05
ASCII is a seven-bit code defining 128 values for control functions and characters, including Latin letters, decimal digits and punctuation. Uppercase A has value 65, hexadecimal 41. When stored in an eight-bit byte with the high bit zero, the remaining seven bits carry the ASCII value. RFC20 documents this convention for network interchange.[ref]
The first 128 Unicode code points preserve these assignments, and UTF-8 represents them by the same single-byte values. This compatibility does not make arbitrary eight-bit text ASCII: values 128–255 belong to some other encoding or byte protocol. Nor does the code assign a particular glyph shape or font. Separating a character code from its rendering makes text transport and typography distinct operations.
Francois Yergeau 2026-11-05
Francois Yergeau authored RFC 3629, the UTF-8 specification cited here. It describes a variable-length encoding of Unicode scalar values using one to four octets, retaining ordinary ASCII values as single octets. The author-address section supplies the identity spelling used in this article.[ref]
A key technical detail is that accepting arbitrary byte sequences is unsafe: the specification excludes surrogate code points and requires valid encodings rather than overlong alternatives. Thus decoding is not just collecting low bits from whichever bytes happen to arrive. Checking the permitted forms prevents distinct byte representations from bypassing a text-based security check.[ref]
UTF-8, a transformation format of ISO 10646 by Francois Yergeau. §§3–4 and §10, Security Considerations
Magnus Nystrom 2026-11-05
Magnus Nystrom is a computer scientist working in computer security and cryptography. An ITU-hosted speaker biography uses the spelling Magnus Nyström and describes his work on security architectures, cryptographic protocols and standards at RSA Security. The biography and RFC identify a security specialist of the same name at RSA Security.[ref]
Magnus Nyström biography for ITU Cybersecurity Symposium II. One-page speaker biography, name, research description and contact.
Magnus Nystrom authored RFC 4231, which supplies identifiers and cryptographic test vectors for HMAC used with several members of the SHA-2 family. This is a practical contribution to reproducibility and interoperability: two implementations given the same key and message should produce exactly the same authentication value.[ref]
Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 (RFC 4231). Abstract, §§3–4.1 and Author’s Address.
For a concrete published check, Test Case 1 uses twenty bytes of hexadecimal
0b as the key and the eight ASCII characters Hi There as data. The HMAC-SHA-256 output starts b0344c61. A developer must decode 0b as one byte rather than submit the two text characters 0 and b; confusing those representations changes the input.[ref]Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 (RFC 4231). §4.2, Test Case 1; keys, data and outputs are hexadecimal.
A cryptographic test vector is an exact check of specified behavior. Passing one example cannot establish the absence of implementation errors for every input, and conformance does not itself prove resistance to every attack. The value of a published collection is that its fixed inputs expose disagreements that informal descriptions of an algorithm can leave hidden.
Percent-encoding 2026-11-05
Percent-encoding represents a byte using a percent sign followed by two hexadecimal digits. For example, byte value 32 is written
%20. Non-ASCII text is first encoded as bytes: in UTF-8, é becomes the two bytes hexadecimal C3 A9, represented as %C3%A9.[ref]Uniform Resource Identifier (URI): Generic Syntax. Section2.1: percent-encoded octets
A useful example distinguishes data from delimiters. The path in
https://example.org/a/b has two segments; the path in https://example.org/a%2Fb retains the encoded slash within one segment in the parsed URL record. A server may apply additional decoding, but the two spellings must not be assumed interchangeable at every processing stage.Percent-encoding is neither encryption nor a universal instruction to decode repeatedly. The string
%252F decodes once to the text %2F; a second decoding changes it again. Likewise, the plus sign is not universally a space: that convention belongs to form-style query string processing, including URLSearchParams, rather than all URL components.[ref]URL Standard by WHATWG. Section1.3; Section5: form-urlencoded processing
Punycode 2026-11-05
Punycode encodes a sequence of Unicode code points using a restricted basic-character alphabet. It preserves basic ASCII characters and represents the remaining code points by an adaptive generalized integer encoding. RFC3492 defines the algorithm; it is one component used by internationalized-domain-name protocols, rather than a complete definition of which names those protocols accept.[ref]
For example, the Punycode payload for
bücher is bcher-kva. In the domain-name protocol, the ASCII-compatible label is written xn--bcher-kva; the prefix belongs to the protocol's label convention, not the basic Punycode payload. Encoding is reversible representation, not encryption, identity verification or protection against lookalike names. TeX character code 2026-11-05
A TeX character code is the numerical component identifying a character in TeX's character model. An ordinary character TeX token combines that code with a TeX category code. Classic TeX uses an eight-bit character-code range, 0–255.[ref]
URL scheme 2026-11-05
A URL scheme is the leading component before
:, selecting a family of interpretation and processing rules. For example, https is the scheme of https://example.org/a. Scheme syntax begins with an ASCII letter and then permits letters, digits, plus, hyphen and period. Comparison is case-insensitive, and standard serialization uses lowercase.[ref]The scheme does not imply that every URL names a remote server. Compare
https://example.org/a with data:text/plain,hello: both have schemes, but the second example carries data in its own spelling rather than naming an HTTPS host. A URL parser must apply the appropriate rules rather than demand a host and port for every case. URL serialization 2026-11-05
URL serialization produces the textual spelling of a structured URL record. It is the output side of processing that begins with a URL parser. The WHATWG serializer returns an ASCII string and can optionally omit the fragment identifier.[ref]
A worked example separates the stages. Constructing
new URL('https://EXAMPLE.org:443/a/../b?q=hello%20world~#top') gives href equal to https://example.org/b?q=hello%20world~#top. Lowercasing the host, removing the default port and resolving the parent-directory segment happen during parsing; the serializer exposes the resulting record.Now call
u.searchParams.sort() on that object. Even though there is only one query pair to sort, href becomes https://example.org/b?q=hello+world%7E#top. The decoded query value is unchanged, but URLSearchParams has rewritten its spelling using form URL encoding. Thus changing the query through an API can alter its percent-encoding without changing the value returned by that API.[ref]URL API in the Node.js documentation. url.searchParams: query-update and encoding caveat; URLSearchParams.sort
UTF-8 2026-11-05
UTF-8 encodes each Unicode scalar value in one to four bytes. ASCII values use one byte; non-ASCII leading bytes announce the sequence length, and continuation bytes begin with the bit pattern
10. This makes byte boundaries identifiable without using a separate delimiter after every character.[ref]For example,
U+00E9 is encoded as hexadecimal C3 A9, while U+1F600 uses F0 9F 98 80. Valid decoding excludes surrogate values, values above U+10FFFF and overlong encodings of smaller values. A byte offset therefore need not be a code-point boundary, and a code-point boundary need not be a grapheme cluster boundary. Correct slicing and validation must state which unit they operate on. Vint Cerf 2026-11-05
Vint Cerf contributed to the architecture and protocols of the Internet, including the design of TCP and IP. His Internet Society biography identifies this internetworking contribution.[ref] An early primary document is his 1969 RFC 20, which records an ASCII representation for network interchange.[ref]
Agreeing on transmitted bits is only one part of communication: endpoints must also agree on how those bits encode characters. The RFC's seven-bit table and placement within an eight-bit byte make that convention explicit. This small document illustrates the same broad interoperability problem encountered in network protocols: independent implementations need common meanings as well as a connection.
