Secure Protocol Format

Injection attacks can occur when transmitted data is not interpreted the same way by both the sender and the receiver. Guaranteeing equivalence in data interpretation by both the sender and the receiver is called operational congruity. There is a simple technique for achieving guaranteeing operational congruity: separating fields of data on the basis of their length. When the length of the data is known in advance, there is no risk of misinterpreting it on the basis of spaces or other text delimiters. The Distinguished Encoding Rules, or DER, of the ASN.1 standard follows this approach; however, the DER specification includes numerous constraints and its implementation involves some complexity. The Secure Protocol Format, or SPF, was created as a simplified version of DER. Thus, SPF prevents command injection attacks by guaranteeing that the interpretation of data cannot change during transfer.