Network Working Group S. Hollenbeck
Internet-Draft VeriSign, Inc.
Expires: December 6, 2004 June 7, 2004
Domain Name System (DNS) Security Extensions Mapping for the
Extensible Provisioning Protocol (EPP)
draft-hollenbeck-epp-secdns-03.txt
Status of this Memo
By submitting this Internet-Draft, I certify that any applicable
patent or other IPR claims of which I am aware have been disclosed,
and any of which I become aware will be disclosed, in accordance with
RFC 3668.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on December 6, 2004.
Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved.
Abstract
This document describes an Extensible Provisioning Protocol (EPP)
extension mapping for the provisioning and management of Domain Name
System (DNS) security extensions for domain names stored in a shared
central repository. Specified in XML, this mapping extends the EPP
domain name mapping to provide additional features required for the
provisioning of DNS security extensions.
Hollenbeck Expires December 6, 2004 [Page 1]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 Conventions Used In This Document . . . . . . . . . . . . 3
2. Object Attributes . . . . . . . . . . . . . . . . . . . . . . 3
2.1 Public Key Information . . . . . . . . . . . . . . . . . . 4
2.2 Signature Information . . . . . . . . . . . . . . . . . . 4
2.3 Delegation Signer Information . . . . . . . . . . . . . . 4
3. EPP Command Mapping . . . . . . . . . . . . . . . . . . . . . 5
3.1 EPP Query Commands . . . . . . . . . . . . . . . . . . . . 5
3.1.1 EPP <check> Command . . . . . . . . . . . . . . . . . 5
3.1.2 EPP <info> Command . . . . . . . . . . . . . . . . . . 5
3.1.3 EPP <transfer> Command . . . . . . . . . . . . . . . . 11
3.2 EPP Transform Commands . . . . . . . . . . . . . . . . . . 11
3.2.1 EPP <create> Command . . . . . . . . . . . . . . . . . 11
3.2.2 EPP <delete> Command . . . . . . . . . . . . . . . . . 11
3.2.3 EPP <renew> Command . . . . . . . . . . . . . . . . . 11
3.2.4 EPP <transfer> Command . . . . . . . . . . . . . . . . 11
3.2.5 EPP <update> Command . . . . . . . . . . . . . . . . . 12
4. Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . . 18
5. Internationalization Considerations . . . . . . . . . . . . . 23
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23
7. Security Considerations . . . . . . . . . . . . . . . . . . . 24
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 25
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 25
9.1 Normative References . . . . . . . . . . . . . . . . . . . . 25
9.2 Informative References . . . . . . . . . . . . . . . . . . . 25
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 26
Intellectual Property and Copyright Statements . . . . . . . . 27
Hollenbeck Expires December 6, 2004 [Page 2]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
1. Introduction
This document describes an extension mapping for version 1.0 of the
Extensible Provisioning Protocol (EPP) described in RFC 3730 [1].
This mapping, an extension of the domain name mapping described in
RFC 3731 [2], is specified using the Extensible Markup Language (XML)
1.0 [3] and XML Schema notation ([4], [5]).
The EPP core protocol specification [1] provides a complete
description of EPP command and response structures. A thorough
understanding of the base protocol specification is necessary to
understand the mapping described in this document. Familiarity with
the DNS described in RFC 1034 [10] and RFC 1035 [11], and DNS
security extensions described in RFC 2535 [6], RFC 3008 [12], and RFC
3090 [13] is required to understand the DNS security concepts
described in this document.
The EPP mapping described in this document specifies a mechanism for
the provisioning and management of DNS security extensions in a
shared central repository. Information exchanged via this mapping
can be extracted from the repository and used to publish DNS resource
records as described in RFC 2535 [6] and RFC 3658 [7].
1.1 Conventions Used In This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [8].
In examples, "C:" represents lines sent by a protocol client and "S:"
represents lines returned by a protocol server. "////" is used to
note element values that have been shortened to better fit page
boundaries. Indentation and white space in examples is provided only
to illustrate element relationships and is not a REQUIRED feature of
this protocol.
XML is case sensitive. Unless stated otherwise, XML specifications
and examples provided in this document MUST be interpreted in the
character case presented to develop a conforming implementation.
2. Object Attributes
This extension adds additional elements to the EPP domain name
mapping [2]. Only new element descriptions are described here.
This document describes update scenarios in which a client can create
an initial key set, add new keys to a set, remove keys from a set,
and replace an existing key set. Key set replacement vs. adding and
Hollenbeck Expires December 6, 2004 [Page 3]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
removing individual keys might be a matter of server operator policy
or the subject of another document.
2.1 Public Key Information
Public key information is sent to the server so that the server can
sign RRs published in a zone managed by the server operator using a
zone-level key. A server operator SHOULD NOT sign any key provided
by a client without cryptographically confirming that the client
possesses the private key associated with the public key.
Clients can send information describing multiple keys to a server.
Each key element MUST be accompanied by a corresponding signature
element when adding keys to a set.
Public key information provided by a client maps to the KEY RR fields
described in RFC 2535 [6]. A KEY RR contains four fields: flags, a
protocol octet, an algorithm number octet, and a public key. See RFC
2535 for specific field formats.
2.2 Signature Information
Signature information is sent to the server to prove that the client
(or an entity for whom the client is acting as agent) has the private
key corresponding to the public key and that the key has not been
modified while in transit. It allows the server to do basic error
checking as part of the provisioning process.
Clients can send information describing multiple signatures to a
server. Each signature element MUST correspond to a key element when
adding keys to a set. The signature value in each signature element
MUST cover all of the keys in the given set.
Signature information provided by a client maps to the SIG RR fields
described in RFC 2535 [6]. A SIG RR contains nine fields: a "type
covered" field, an algorithm number octet, a labels octet, an
original TTL field, a signature expiration field, a signature
inception field, a key tag field, a signer's name field, and a
signature field. See RFC 2535 for specific field formats.
2.3 Delegation Signer Information
Delegation signer (DS) information is published by the server to
indicate that a delegated zone is digitally signed and that the
delegation zone recognizes the indicated key as a valid zone key for
the delegated zone. A DS RR contains four fields: a key tag field, a
KEY algorithm number octet, an octet identifying the digest algorithm
used, and a digest field. See RFC 3658 [7] for specific field
Hollenbeck Expires December 6, 2004 [Page 4]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
formats.
This document describes multiple DS provisioning mechanisms. The
RECOMMENDED mechanism is one in which the information needed to
publish DS RRs is derived by the server from key and signature
information provided by the client. This provisioning mechanism
minimizes client complexity and ensures that there is no DS version
conflict between the client and server, minimizing or eliminating
client-server DS errors.
It is worth noting, though, that there are other DS provisioning
options. One option that is supported in this specification is for
the client to generate and send only DS information to the server.
This option is the simplest for the server to implement, though more
complex for the client because the client is responsible for
generating the DS information. The server has no means of detecting
errors in the data provided by the client prior to publishing the DS
information. Another option that is not supported in this
specification is for the client to send DS information, KEY
information, and SIG(DS) information to the server. This option is
verbose and does nothing to reduce the client-server error rate, but
it does provide the server with enough information to detect DS
errors before they appear in a zone.
3. EPP Command Mapping
A detailed description of the EPP syntax and semantics can be found
in the EPP core protocol specification [1]. The command mappings
described here are specifically for use in provisioning and managing
DNS security extensions via EPP.
3.1 EPP Query Commands
EPP provides three commands to retrieve object information: <check>
to determine if an object is known to the server, <info> to retrieve
detailed information associated with an object, and <transfer> to
retrieve object transfer status information.
3.1.1 EPP <check> Command
This extension does not add any elements to the EPP <check> command
or <check> response described in the EPP domain mapping [2].
3.1.2 EPP <info> Command
This extension does not add any elements to the EPP <info> command
described in the EPP domain mapping [2]. Additional elements are
defined for the <info> response.
Hollenbeck Expires December 6, 2004 [Page 5]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
When an <info> command has been processed successfully, the EPP
<resData> element MUST contain child elements as described in the EPP
domain mapping [2]. In addition, the EPP <extension> element MUST
contain a child <secDNS:infData> element that identifies the
extension namespace and the location of the extension schema. The
<secDNS:infData> element contains the following child elements:
A <secDNS:status> element that describes extension status for the
domain. This element contains an attribute named "s" whose value
is either "secure" or "insecure". Domains that have been
provisioned with security extensions are represented with "secure"
status. Domains that have not been provisioned with security
extensions are represented with "insecure" status.
The <secDNS:status> element is followed by either a
<secDNS:insecure> element, a <secDNS:keyData> element, or a
<secDNS:dsData> element depending on the status of the delegation.
A <secDNS:keyData> element or a <secDNS:dsData> element MUST be
present if the status of the delegation is "secure". A
<secDNS:insecure> element MUST be present if the status of the
delegation is "insecure".
The <secDNS:insecure> element contains no child elements. It does
contain a REQUIRED "nxt" attribute that notes if the delegation is
included in the parent zone's chain of NXT records. A value of
"1" or "true" indicates that the delegation is insecure, but is
included in the parent zone's chain of NXT records. A value of
"0" or "false" indicates that the delegation is insecure and is
not included in the parent zone's chain of NXT records.
The <secDNS:keyData> element contains a subset of the public key
information originally provided by the client for a secured
delegation. Each <secDNS:keyData> element contains a <secDNS:key>
element, an OPTIONAL <secDNS:startDate> element, and an OPTIONAL
<secDNS:endDate> element. The <secDNS:startDate> and
<secDNS:endDate> elements indicate a client's preferences for the
start and end date of DNS security extension resource record
publication in the zone administered by the server operator. The
<secDNS:key> element contains the following child elements:
A <secDNS:flags> element that contains a flags field value as
described in sections 3.1 and 3.1.2 of RFC 2535 [6].
A <secDNS:protocol> element that contains a protocol field
value as described in sections 3.1 and 3.1.3 of RFC 2535 [6].
A <secDNS:alg> element that contains an algorithm number field
value as described in sections 3.1 and 3.2 of RFC 2535 [6].
Hollenbeck Expires December 6, 2004 [Page 6]
An OPTIONAL <secDNS:pubKey> element that contains an encoded
public key field value as described in section 3.1 of RFC 2535
[6]. The format of the public key is algorithm dependent.
This value will be provided only if server policy supports
retention of client-provided keys.
The <secDNS:dsData> element contains delegation signer information
originally provided by the client for a secured delegation. If
present, the <secDNS:dsData> element contains the following child
elements:
A <secDNS:keyTag> element that contains a key tag value as
described in section 2.4 of RFC 3658 [7].
A <secDNS:alg> element that contains an algorithm value as
described in section 2.4 of RFC 3658 [7].
A <secDNS:digestType> element that contains a digest type value
as described in section 2.4 of RFC 3658 [7].
A <secDNS:digest> element that contains a digest value as
described in section 2.4 of RFC 3658 [7].
An OPTIONAL <secDNS:startDate> element and an OPTIONAL
<secDNS:endDate> element. The <secDNS:startDate> and
<secDNS:endDate> elements indicate a client's preferences for
the start and end date of DNS security extension resource
record publication in the zone administered by the server
operator.
Example <info> Response for a Secure Delegation with Key Data:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.tld</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
Hollenbeck Expires December 6, 2004 [Page 7]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>ns1.example.tld</domain:ns>
S: <domain:ns>ns2.example.tld</domain:ns>
S: <domain:host>ns1.example.tld</domain:host>
S: <domain:host>ns2.example.tld</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:status s="secure"/>
S: <secDNS:keyData>
S: <secDNS:key>
S: <secDNS:flags>256</secDNS:flags>
S: <secDNS:protocol>3</secDNS:protocol>
S: <secDNS:alg>1</secDNS:alg>
S: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
S: </secDNS:key>
S: </secDNS:keyData>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Example <info> Response for a Secure Delegation with DS Data:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
Hollenbeck Expires December 6, 2004 [Page 8]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.tld</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>ns1.example.tld</domain:ns>
S: <domain:ns>ns2.example.tld</domain:ns>
S: <domain:host>ns1.example.tld</domain:host>
S: <domain:host>ns2.example.tld</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:status s="secure"/>
S: <secDNS:dsData>
S: <secDNS:keyTag>12345</secDNS:keyTag>
S: <secDNS:alg>3</secDNS:alg>
S: <secDNS:digestType>1</secDNS:digestType>
S: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
S: </secDNS:dsData>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Hollenbeck Expires December 6, 2004 [Page 9]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Example <info> Response for an Insecure Delegation:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.tld</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>ns1.example.tld</domain:ns>
S: <domain:ns>ns2.example.tld</domain:ns>
S: <domain:host>ns1.example.tld</domain:host>
S: <domain:host>ns2.example.tld</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:status s="insecure"/>
S: <secDNS:insecure nxt="0"/>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
Hollenbeck Expires December 6, 2004 [Page 10]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
S: </trID>
S: </response>
S:</epp>
An EPP error response MUST be returned if an <info> command can not
be processed for any reason.
3.1.3 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer>
command or <transfer> response described in the EPP domain mapping
[2].
3.2 EPP Transform Commands
EPP provides five commands to transform objects: <create> to create
an instance of an object, <delete> to delete an instance of an
object, <renew> to extend the validity period of an object,
<transfer> to manage object sponsorship changes, and <update> to
change information associated with an object.
3.2.1 EPP <create> Command
This extension defines additional elements for the EPP <create>
command described in the EPP domain mapping [2]. No additional
elements are defined for the EPP <create> response.
When a <create> command has been processed successfully, the EPP
response is as described in the EPP domain mapping [2].
3.2.2 EPP <delete> Command
This extension does not add any elements to the EPP <delete> command
or <delete> response described in the EPP domain mapping [2].
3.2.3 EPP <renew> Command
This extension does not add any elements to the EPP <renew> command
or <renew> response described in the EPP domain mapping [2].
3.2.4 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer>
command or <transfer> response described in the EPP domain mapping
[2].
Hollenbeck Expires December 6, 2004 [Page 11]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
3.2.5 EPP <update> Command
This extension defines additional elements for the EPP <update>
command described in the EPP domain mapping [2]. No additional
elements are defined for the EPP <update> response.
The EPP <update> command provides a transform operation that allows a
client to modify the attributes of a domain object. In addition to
the EPP command elements described in the EPP domain mapping, the
command MUST contain an <extension> element. The <extension> element
MUST contain a child <secDNS:update> element that identifies the
extension namespace and the location of the extension schema. The
<secDNS:update> element contains a <secDNS:add> element to add
security information to a delegation, a <secDNS:rem> element to
remove security information from a delegation, or a <secDNS:chg>
element to replace (possibly empty) security information with new
security information.
The <secDNS:add> element is used to add keys to an existing set. The
<secDNS:add> element contains a <secDNS:keyData> element whose child
elements are the same as those listed in the description of the EPP
<create> command. The <secDNS:add> element MAY only be used to add
keys to an existing set; it MUST NOT be used to replace DS data with
key data, for example.
The <secDNS:rem> element contains either a <secDNS:key> element that
is used to remove keys from an existing set, or a <secDNS:dsData>
element that is used to remove DS data from a delegation. Removing
all keys or DS data MUST change the status of the delegation to
"notSecured". The <secDNS:key> element contains the following child
elements used to identify the key to be removed:
A <secDNS:alg> element that contains an algorithm number field
value as described in sections 3.1 and 3.2 of RFC 2535 [6].
A <secDNS:keyTag> element that contains a key tag field value as
described in sections 4.1 and 4.1.6 of RFC 2535 [6].
The <secDNS:rem> element MAY contain a <secDNS:dsData> element whose
child elements are the same as those listed in the description of the
EPP <create> command.
The <secDNS:chg> element is used to replace an existing key set with
a new key set and to remove a key set completely. The <secDNS:chg>
element contains child elements that are the same as those presented
in the description of the <secDNS:create> element as part of the EPP
<create> command.
Hollenbeck Expires December 6, 2004 [Page 12]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Example <update> Command, Adding a Key:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:add>
C: <secDNS:keyData>
C: <secDNS:key>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:key>
C: <secDNS:sig>
C: <secDNS:type>KEY</secDNS:type>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:labels>2</secDNS:labels>
C: <secDNS:origTTL>172800</secDNS:origTTL>
C: <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
C: <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: <secDNS:signerName>example.tld</secDNS:signerName>
C: <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
C: </secDNS:sig>
C: </secDNS:keyData>
C: </secDNS:add>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires December 6, 2004 [Page 13]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Example <update> Command, Replacing a Key Set:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:keyData>
C: <secDNS:key>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:key>
C: <secDNS:sig>
C: <secDNS:type>KEY</secDNS:type>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:labels>2</secDNS:labels>
C: <secDNS:origTTL>172800</secDNS:origTTL>
C: <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
C: <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: <secDNS:signerName>example.tld</secDNS:signerName>
C: <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
C: </secDNS:sig>
C: </secDNS:keyData>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires December 6, 2004 [Page 14]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Example <update> Command, Removing a Key Set:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:insecure nxt="0"/>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Example <update> Command, Removing a Key:
Hollenbeck Expires December 6, 2004 [Page 15]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:rem>
C: <secDNS:key>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: </secDNS:key>
C: </secDNS:rem>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Example <update> Command, Changing DS Data:
Hollenbeck Expires December 6, 2004 [Page 16]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: </secDNS:dsData>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Example <update> Command, Removing DS Data:
Hollenbeck Expires December 6, 2004 [Page 17]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:rem>
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: </secDNS:dsData>
C: </secDNS:rem>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
When an extended <update> command has been processed successfully,
the EPP response is as described in the EPP domain mapping [2].
4. Formal Syntax
An EPP object mapping is specified in XML Schema notation. The
formal syntax presented here is a complete schema representation of
the object mapping suitable for automated validation of EPP XML
instances. The BEGIN and END tags are not part of the schema; they
are used to note the beginning and ending of the schema for URI
registration purposes.
BEGIN
<?xml version="1.0" encoding="UTF-8"?>
Hollenbeck Expires December 6, 2004 [Page 18]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
<schema targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified">
<annotation>
<documentation>
Extensible Provisioning Protocol v1.0
domain name extension schema for provisioning
DNS security extensions.
</documentation>
</annotation>
<!--
Child elements found in EPP commands.
-->
<element name="create" type="secDNS:createType"/>
<element name="update" type="secDNS:updateType"/>
<!--
Child elements of the <create> command.
-->
<complexType name="createType">
<choice>
<element name="dsData" type="secDNS:dsDataType"/>
<element name="insecure" type="secDNS:insecureType"/>
<element name="keyData" type="secDNS:keyDataType"/>
</choice>
</complexType>
<complexType name="dsDataType">
<sequence>
<element name="keyTag" type="unsignedShort"/>
<element name="alg" type="unsignedByte"/>
<element name="digestType" type="unsignedByte"/>
<element name="digest" type="hexBinary"/>
<element name="startDate" type="dateTime"
minOccurs="0"/>
<element name="endDate" type="dateTime"
minOccurs="0"/>
</sequence>
</complexType>
<complexType name="keyDataType">
<sequence>
<element name="key" type="secDNS:keyType"
maxOccurs="unbounded"/>
<element name="sig" type="secDNS:sigType"
Hollenbeck Expires December 6, 2004 [Page 19]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
maxOccurs="unbounded"/>
<element name="startDate" type="dateTime"
minOccurs="0"/>
<element name="endDate" type="dateTime"
minOccurs="0"/>
</sequence>
</complexType>
<complexType name="keyType">
<sequence>
<element name="flags" type="unsignedShort"/>
<element name="protocol" type="unsignedByte"/>
<element name="alg" type="unsignedByte"/>
<element name="pubKey" type="secDNS:keySigType"/>
</sequence>
</complexType>
<complexType name="sigType">
<sequence>
<element name="type" type="secDNS:typeCovType"/>
<element name="alg" type="unsignedByte"/>
<element name="labels" type="unsignedByte"/>
<element name="origTTL" type="unsignedInt"/>
<element name="sigExp" type="dateTime"/>
<element name="sigInc" type="dateTime"/>
<element name="keyTag" type="unsignedShort"/>
<element name="signerName" type="secDNS:nameType"/>
<element name="sigVal" type="secDNS:keySigType"/>
</sequence>
</complexType>
<simpleType name="keySigType">
<restriction base="base64Binary">
<minLength value="1"/>
</restriction>
</simpleType>
<simpleType name="typeCovType">
<restriction base="token">
<enumeration value="KEY"/> <!-- Type 25 -->
</restriction>
</simpleType>
<simpleType name="nameType">
<restriction base="token">
<minLength value="1"/>
<maxLength value="255"/>
</restriction>
Hollenbeck Expires December 6, 2004 [Page 20]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
</simpleType>
<complexType name="insecureType">
<attribute name="nxt" type="boolean" use="required"/>
</complexType>
<!--
Child elements of the <update> command.
-->
<complexType name="updateType">
<choice>
<element name="add" type="secDNS:addType"/>
<element name="chg" type="secDNS:createType"/>
<element name="rem" type="secDNS:remType"/>
</choice>
</complexType>
<complexType name="addType">
<sequence>
<element name="keyData" type="secDNS:keyDataType"/>
</sequence>
</complexType>
<complexType name="remType">
<choice>
<element name="key" type="secDNS:keyRemType"
maxOccurs="unbounded"/>
<element name="dsData" type="secDNS:dsDataType"/>
</choice>
</complexType>
<complexType name="keyRemType">
<sequence>
<element name="alg" type="unsignedByte"/>
<element name="keyTag" type="unsignedShort"/>
</sequence>
</complexType>
<!--
Child response elements.
-->
<element name="infData" type="secDNS:infDataType"/>
<!--
<info> response elements.
-->
<complexType name="infDataType">
<sequence>
Hollenbeck Expires December 6, 2004 [Page 21]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
<element name="status" type="secDNS:statusType"/>
<choice>
<element name="dsData" type="secDNS:dsDataType"/>
<element name="insecure" type="secDNS:insecureType"/>
<element name="keyData" type="secDNS:infoKeyDataType"/>
</choice>
</sequence>
</complexType>
<complexType name="statusType">
<simpleContent>
<extension base="token">
<attribute name="s" type="secDNS:statusValueType"
use="required"/>
</extension>
</simpleContent>
</complexType>
<simpleType name="statusValueType">
<restriction base="token">
<enumeration value="insecure"/>
<enumeration value="secure"/>
</restriction>
</simpleType>
<complexType name="infoKeyDataType">
<sequence>
<element name="key" type="secDNS:infoKeyType"
maxOccurs="unbounded"/>
<element name="startDate" type="dateTime"
minOccurs="0"/>
<element name="endDate" type="dateTime"
minOccurs="0"/>
</sequence>
</complexType>
<complexType name="infoKeyType">
<sequence>
<element name="flags" type="unsignedShort"/>
<element name="protocol" type="unsignedByte"/>
<element name="alg" type="unsignedByte"/>
<element name="pubKey" type="secDNS:keySigType"
minOccurs="0"/>
</sequence>
</complexType>
<!--
End of schema.
Hollenbeck Expires December 6, 2004 [Page 22]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
-->
</schema>
END
5. Internationalization Considerations
EPP is represented in XML, which provides native support for encoding
information using the Unicode character set and its more compact
representations including UTF-8 [14]. Conformant XML processors
recognize both UTF-8 and UTF-16 [15]. Though XML includes provisions
to identify and use other character encodings through use of an
"encoding" attribute in an <?xml?> declaration, use of UTF-8 is
RECOMMENDED in environments where parser encoding support
incompatibility exists.
As an extension of the EPP domain mapping [2], the elements, element
content, attributes, and attribute values described in this document
MUST inherit the internationalization conventions used to represent
higher-layer domain and core protocol structures present in an XML
instance that includes this extension.
6. IANA Considerations
This document uses URNs to describe XML namespaces and XML schemas
conforming to a registry mechanism described in RFC 3688 [9]. Two
URI assignments are requested.
Registration request for the extension namespace:
URI: urn:ietf:params:xml:ns:secDNS-1.0
Registrant Contact: See the "Author's Address" section of this
document.
XML: None. Namespace URIs do not represent an XML specification.
Registration request for the extension XML schema:
URI: uurn:ietf:params:xml:schema:secDNS-1.0
Registrant Contact: See the "Author's Address" section of this
document.
XML: See the "Formal Syntax" section of this document.
Hollenbeck Expires December 6, 2004 [Page 23]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
7. Security Considerations
The mapping extensions described in this document do not provide any
security services beyond those described by EPP [1], the EPP domain
name mapping [2], and protocol layers used by EPP. The security
considerations described in these other specifications apply to this
specification as well.
As with other domain object transforms, the EPP transform operations
described in this document MUST be restricted to the sponsoring
client as authenticated using the mechanisms described in sections
2.9.1.1 and 7 of RFC 3730 [1]. Any attempt to perform a transform
operation on a domain object by any client other than the sponsoring
client MUST be rejected with an appropriate EPP authorization error.
The provisioning service described in this document involves the
exchange of information that can have an operational impact on the
DNS. A trust relationship MUST exist between the EPP client and
server, and provisioning of public key information MUST only be done
after the identities of both parties have been confirmed using a
strong authentication mechanism.
An EPP client might be acting as an agent for a zone administrator
who wants to send key information to be signed and published by the
server operator. Man-in-the-middle attacks are thus possible as a
result of direct client activity or inadvertent client data
manipulation.
The signature information provided by a client allows a server to
confirm that the corresponding key is usable and has not been
modified while in transit, but the server generally does not have
enough information to confirm that the key was generated and provided
by the child zone administrator. Authentication and integrity
services MUST be provided on a hop-by-hop basis to ensure that data
is not modified while in transit between entities.
Acceptance of a false key by a server operator can produce
significant operational consequences. The child and parent zones
MUST be consistent to properly secure the delegation. In the absence
of consistent signatures the delegation will not appear in the secure
name space, yielding untrustworthy query responses.
Signature checking at the server requires computational resources. A
purposeful or inadvertent denial of service attack is possible if a
client requests some number of update operations that exceed a
server's processing capabilities. Server operators SHOULD take steps
to manage command load and command processing requirements to
minimize the risk of a denial of service attack.
Hollenbeck Expires December 6, 2004 [Page 24]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
8. Acknowledgements
The author would like to thank the following people who have provided
significant contributions to the development of this document:
David Blacka, Olafur Gudmundsson, Mark Kosters, and Dan Massey.
9. References
9.1 Normative References
[1] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", RFC
3730, March 2004.
[2] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain
Name Mapping", RFC 3731, March 2004.
[3] Bray, T., Paoli, J., Sperberg-McQueen, C. and E. Maler,
"Extensible Markup Language (XML) 1.0 (2nd ed)", W3C REC-xml,
October 2000, <http://www.w3.org/TR/REC-xml>.
[4] Thompson, H., Beech, D., Maloney, M. and N. Mendelsohn, "XML
Schema Part 1: Structures", W3C REC-xmlschema-1, May 2001,
<http://www.w3.org/TR/xmlschema-1/>.
[5] Biron, P. and A. Malhotra, "XML Schema Part 2: Datatypes", W3C
REC-xmlschema-2, May 2001, <http://www.w3.org/TR/xmlschema-2/>.
[6] Eastlake, D., "Domain Name System Security Extensions", RFC
2535, March 1999.
[7] Gudmundsson, O., "Delegation Signer (DS) Resource Record (RR)",
RFC 3658, December 2003.
[8] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[9] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, January
2004.
9.2 Informative References
[10] Mockapetris, P., "Domain names - concepts and facilities", STD
13, RFC 1034, November 1987.
[11] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
Hollenbeck Expires December 6, 2004 [Page 25]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
[12] Wellington, B., "Domain Name System Security (DNSSEC) Signing
Authority", RFC 3008, November 2000.
[13] Lewis, E., "DNS Security Extension Clarification on Zone
Status", RFC 3090, March 2001.
[14] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD
63, RFC 3629, November 2003.
[15] Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646",
RFC 2781, February 2000.
Author's Address
Scott Hollenbeck
VeriSign, Inc.
21345 Ridgetop Circle
Dulles, VA 20166-6503
US
EMail: shollenbeck@verisign.com
Hollenbeck Expires December 6, 2004 [Page 26]
Internet-Draft EPP DNS Security Extensions Mapping June 2004
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society.
Hollenbeck Expires December 6, 2004 [Page 27]
