RFC 2119

RFC 2119

RFC 2119 is a short technical memorandum that codified terminology for requirement levels used in Internet standards. Authored by Scott Bradner and published by the Internet Engineering Task Force, it established precise meanings for words that specify obligation strength in protocol and policy documents. The memorandum influenced standards work across organisations involved in networking and software, shaping how Internet Engineering Task Force documents interoperate with work from International Organization for Standardization, Institute of Electrical and Electronics Engineers, and other standards bodies.

Background

RFC 2119 emerged from discussions within the Internet Engineering Task Force and related groups such as the Internet Architecture Board and the Internet Society on the need for unambiguous prescriptive language in technical specifications. Prior to its publication, specifications produced by working groups like IETF Working Groups and contributing organisations such as the World Wide Web Consortium and the Open Group often used ordinary English modalities that led to interoperability problems between implementations from companies like Cisco Systems, Microsoft, and Sun Microsystems. Influences include procedural practices from International Telecommunication Union and editorial conventions in documents from ANSI and IEEE Standards Association committees. The memorandum sought to harmonize language with long-standing drafting traditions exemplified by texts from the United States Code, the European Union directives, and guidance used by agencies such as National Institute of Standards and Technology.

Content and Key Terms

The document introduced a small set of capitalised keywords to convey requirement strength: MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL. Authors drafting protocol specifications were instructed to apply these words with precise intent, mirroring authoritative terminologies used in ISO/IEC 2382-style standards and legal drafting seen in instruments like the Treaty of Lisbon or regulations from the Federal Communications Commission. The guidance clarifies how normative verbs interact with compliance and testing regimes developed by organisations such as European Telecommunications Standards Institute and 3rd Generation Partnership Project. The memo also advised on avoiding ambiguity by not mixing the capitalised terms with ordinary usage, following editorial norms from publications like the Oxford English Dictionary and style guides used by bodies like The Chicago Manual of Style.

Adoption and Impact

Standards bodies and technical communities across the Internet ecosystem adopted the terminology, including working groups in IETF, the World Wide Web Consortium, and regional standards organisations such as ETSI and ARIN. Major protocol specifications for suites like Transmission Control Protocol, Hypertext Transfer Protocol, Simple Mail Transfer Protocol, and Domain Name System referenced the keyword semantics to reduce implementation divergence among vendors like Juniper Networks and Oracle Corporation. The approach influenced compliance testing laboratories and certification programmes run by consortia such as Open Web Application Security Project and IEEE 802 committees. Academic and industrial research cited the memo in discussions spanning MIT, Stanford University, and corporate labs at Bell Labs and IBM Research.

Criticism and Limitations

Critics from legal, linguistic, and standards communities pointed to limits when porting the capped-keyword scheme into regulatory, procurement, and judicial contexts such as those involving the European Court of Justice or national courts. Linguists at institutions like Harvard University and University of Cambridge argued that prescriptive keywords cannot eliminate all interpretive ambiguity, echoing concerns raised in analyses by the American Bar Association and commentators within IETF mailing lists. Some implementers reported inconsistent application in specifications authored by bodies like the World Wide Web Consortium and vendors including Google and Apple Inc., leading to debates in venues such as IETF IAB and regional forums like RIPE NCC. Standards harmonisation efforts with organisations such as ITU-T and ISO revealed semantic mismatches that required supplementary normative guidance or errata.

Examples and Usage in Standards

RFC 2119-style wording appears in numerous protocol and framework documents, including updates and extensions for HTTP/1.1, SMTP enhancements, and authentication profiles used in OAuth and SAML. Security specifications from IETF Working Groups and guidelines by NIST reference the keywords when defining mandatory implementation requirements for cryptographic modules and interoperability profiles. Technical specifications in cloud and virtualization standards from consortia like OASIS and projects at The Linux Foundation also adopt the terminology to coordinate multi-vendor implementations. The pattern established by the memo continues to inform modern drafting within organisations such as IETF, W3C, IANA, and national standards bodies including ANSI and BSI.

Category:Internet standards