Internet Engineering Task Force S. Hollenbeck
Internet-Draft VeriSign, Inc.
February 12, 2002 Expires: August 12, 2002
Extensible Provisioning Protocol DNS Security Extensions Mapping
Status of this Memo
This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Task
Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress".
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Abstract
This document describes an Extensible Provisioning Protocol (EPP)
extension mapping for the provisioning and management of DNS security
extensions for domain names stored in a shared central repository.
Specified in XML, this mapping extends the EPP domain name mapping to
provide additional features required for the provisioning of DNS
security extensions.
Conventions Used In This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
In examples, "C:" represents lines sent by a protocol client and "S:"
represents lines returned by a protocol server. "////" is used to
note element values that have been shortened to better fit page
boundaries. Indentation and white space in examples is provided only
to illustrate element relationships and is not a REQUIRED feature of
this protocol.
Hollenbeck Expires August 12, 2002 [Page 1]
Internet-Draft EPP DNS Security Mapping February 12, 2002
Table of Contents
1. Introduction ................................................. 3
2. Object Attributes ............................................ 4
2.1 Public Key Information ...................................... 4
2.2 Signature Information ....................................... 4
2.3 Delegation Signer Information ............................... 5
3. EPP Command Mapping .......................................... 6
3.1 EPP Query Commands .......................................... 6
3.1.1 EPP <check> Command ....................................... 6
3.1.2 EPP <info> Command ........................................ 6
3.1.3 EPP <transfer> Command .................................... 11
3.2 EPP Transform Commands ...................................... 11
3.2.1 EPP <create> Command ...................................... 11
3.2.2 EPP <delete> Command ...................................... 15
3.2.3 EPP <renew> Command ....................................... 16
3.2.4 EPP <transfer> Command .................................... 16
3.2.5 EPP <update> Command ...................................... 16
4. Formal Syntax ................................................ 22
5. Internationalization Considerations .......................... 26
6. IANA Considerations .......................................... 26
7. Security Considerations ...................................... 27
8. Acknowledgements ............................................. 27
9. References ................................................... 28
10. Author's Address ............................................ 29
A. Revisions From Previous Version .............................. 29
B. Full Copyright Statement ..................................... 30
Hollenbeck Expires August 12, 2002 [Page 2]
Internet-Draft EPP DNS Security Mapping February 12, 2002
1. Introduction
This document describes a DNS security extension mapping for version
1.0 of the Extensible Provisioning Protocol (EPP). This mapping, an
extension of the domain name mapping described in [EPP-D], is
specified using the Extensible Markup Language (XML) 1.0 as described
in [XML] and XML Schema notation as described in [XMLS-1] and [XMLS-
2].
[EPP] provides a complete description of EPP command and response
structures. A thorough understanding of the base protocol
specification is necessary to understand the mapping described in this
document.
Familiarity with the Domain Name System (DNS) described in [RFC1034]
and [RFC1035] and DNS security extensions described in [RFC2535],
[RFC3008], and [RFC3090] is required to understand the concepts
described in this document.
The EPP mapping described in this document specifies a mechanism for
the provisioning and management of DNS security extensions in a shared
central repository. Information exchanged via this mapping can be
extracted from the repository and used to publish DNS resource records
as described in [RFC2535], [IETF-DS], and [IETF-OPTIN].
XML is case sensitive. Unless stated otherwise, XML specifications
and examples provided in this document MUST be interpreted in the
character case presented to develop a conforming implementation.
Hollenbeck Expires August 12, 2002 [Page 3]
Internet-Draft EPP DNS Security Mapping February 12, 2002
2. Object Attributes
This extension adds additional elements to the domain name mapping
described in [EPP-D]. Only new element descriptions are described
here.
This document describes update scenarios in which a client can create
an initial key set, add new keys to a set, remove keys from a set, and
replace an existing key set. Key set replacement vs. adding and
removing individual keys might be a matter of server policy or the
subject of another document. Insights into operational requirements
are welcome.
2.1 Public Key Information
Public key information is sent to the server so that the server can
sign RRs published in a zone managed by the server operator using a
zone-level key. A server operator SHOULD NOT sign any key provided by
a client without cryptographically confirming that the client
possesses the private key associated with the public key.
Clients can send information describing multiple keys to a server.
Each key element MUST be accompanied by a corresponding signature
element when adding keys to a set.
Public key information provided by a client maps to the KEY RR fields
described in [RFC2535]. A KEY RR contains four fields: flags, a
protocol octet, an algorithm number octet, and a public key. See
[RFC2535] for specific field formats.
2.2 Signature Information
Signature information is sent to the server to prove that the client
(or an entity for whom the client is acting as agent) has the private
key corresponding to the public key and that the key has not been
modified while in transit. It allows the server to do basic error
checking as part of the provisioning process.
Clients can send information describing multiple signatures to a
server. Each signature element MUST correspond to a key element when
adding keys to a set. The signature value in each signature element
MUST cover all of the keys in the given set.
Signature information provided by a client maps to the SIG RR fields
described in [RFC2535]. A SIG RR contains nine fields: a "type
covered" field, an algorithm number octet, a labels octet, an original
TTL field, a signature expiration field, a signature inception field,
a key tag field, a signer's name field, and a signature field. See
Hollenbeck Expires August 12, 2002 [Page 4]
Internet-Draft EPP DNS Security Mapping February 12, 2002
[RFC2535] for specific field formats.
2.3 Delegation Signer Information
Delegation signer (DS) information is generated by the server to
indicate that a delegated zone is digitally signed and that the
delegation zone recognizes the indicated key as a valid zone key for
the delegated zone. A DS RR contains four fields: a key tag field, a
KEY algorithm number octet, an octet identifying the digest algorithm
used, and a digest field. See [IETF-DS] for specific field formats.
This document does not describe an explicit DS provisioning mechanism.
Instead, the information needed to publish DS RRs is derived by the
server from key and signature information provided by the client.
This provisioning mechanism minimizes client complexity and ensures
that there is no DS version conflict between the client and server,
minimizing or eliminating client-server DS errors. A REQUIRED flag is
used by clients to notify servers that DS provisioning is requested.
It is worth noting, though, that there are other DS provisioning
options. One option is for client to generate and send only DS
information to the server. This option is the simplest for the server
to implement, though the server has no means of detecting errors in
the data provided by the client. Another option is for the client to
send DS information, KEY information, and SIG(DS) information to the
server. This option is verbose and does nothing to reduce the
client-server error rate, but it provides the server with enough
information to detect DS errors easily.
Hollenbeck Expires August 12, 2002 [Page 5]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3. EPP Command Mapping
A detailed description of the EPP syntax and semantics can be found in
[EPP]. The command mappings described here are specifically for use
in provisioning and managing DNS security extensions via EPP.
3.1 EPP Query Commands
EPP provides three commands to retrieve object information: <check> to
determine if an object can be provisioned, <info> to retrieve detailed
information associated with an object, and <transfer> to retrieve
object transfer status information.
3.1.1 EPP <check> Command
This extension does not add any elements to the EPP <check> command or
<check> response described in [EPP-D].
3.1.2 EPP <info> Command
This extension does not add any elements to the EPP <info> command
described in [EPP-D]. Additional elements are defined for the <info>
response.
When an <info> command has been processed successfully, the EPP
<resData> element MUST contain child elements as described in [EPP-D].
In addition, the EPP <extension> element MUST contain a child
<secDNS:infData> element that identifies the secDNS namespace and the
location of the secDNS schema. The <secDNS:infData> element contains
the following child elements:
- A <secDNS:status> element that describes extension status for the
domain. This element contains an attribute named "s" whose value is
either "secure" or "insecure". Domains that have been provisioned
with security extensions are represented with "secure" status. Domains
that have not been provisioned with security extensions are
represented with "insecure" status.
The <secDNS:status> element is followed by either a <secDNS:keyData>
element or a <secDNS:insecure> element depending on the status of the
delegation. A <secDNS:keyData> element MUST be present if the status
of the delegation is "secure". A <secDNS:insecure> element MUST be
present if the status of the delegation is "insecure".
The <secDNS:insecure> element contains no child elements. It does
contain a REQUIRED "nxt" attribute that notes if the delegation is
included in the parent zone's chain of NXT records. A value of "1" or
"true" indicates that the delegation is insecure, but is included in
Hollenbeck Expires August 12, 2002 [Page 6]
Internet-Draft EPP DNS Security Mapping February 12, 2002
the parent zone's chain of NXT records. A value of "0" or "false"
indicates that the delegation is insecure and is not included in the
parent zone's chain of NXT records. Server policy and further
discussion around [IETF-OPTIN] might have an impact on the necessity
of this element.
The <secDNS:keyData> element contains a subset of the public key
information originally provided by the client for a secured
delegation. Each <secDNS:keyData> element contains a <secDNS:key>
element, an OPTIONAL <secDNS:startDate> element, and an OPTIONAL
<secDNS:endDate> element. The <secDNS:startDate> and <secDNS:endDate>
elements indicate a client's preferences for the start and end date of
DNS security extension resource record publication in the zone
administered by the server operator. The <secDNS:key> element
contains the following child elements:
- A <secDNS:flags> element that contains a flags field value as
described in [RFC2535] sections 3.1 and 3.1.2.
- A <secDNS:protocol> element that contains a protocol field value
as described in [RFC2535] sections 3.1 and 3.1.3.
- A <secDNS:alg> element that contains an algorithm number field
value as described in [RFC2535] sections 3.1 and 3.2.
- An OPTIONAL <secDNS:pubKey> element that contains an encoded
public key field value as described in [RFC2535] section 3.1. The
format of the public key is algorithm dependent. This value will be
provided only if server policy supports retention of client-provided
keys.
Hollenbeck Expires August 12, 2002 [Page 7]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.1.2.1 Example <info> Response for a Secure Delegation
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.tld</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>ns1.example.tld</domain:ns>
S: <domain:ns>ns2.example.tld</domain:ns>
S: <domain:host>ns1.example.tld</domain:host>
S: <domain:host>ns2.example.tld</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:status s="secure"/>
S: <secDNS:keyData>
S: <secDNS:key>
S: <secDNS:flags>256</secDNS:flags>
S: <secDNS:protocol>3</secDNS:protocol>
S: <secDNS:alg>1</secDNS:alg>
Hollenbeck Expires August 12, 2002 [Page 8]
Internet-Draft EPP DNS Security Mapping February 12, 2002
S: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
S: </secDNS:key>
S: </secDNS:keyData>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Hollenbeck Expires August 12, 2002 [Page 9]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.1.2.2 Example <info> Response for an Insecure Delegation
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.tld</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>ns1.example.tld</domain:ns>
S: <domain:ns>ns2.example.tld</domain:ns>
S: <domain:host>ns1.example.tld</domain:host>
S: <domain:host>ns2.example.tld</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:status s="insecure"/>
S: <secDNS:insecure nxt="0"/>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
Hollenbeck Expires August 12, 2002 [Page 10]
Internet-Draft EPP DNS Security Mapping February 12, 2002
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
An EPP error response MUST be returned if an <info> command can not be
processed for any reason.
3.1.3 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer> command
or <transfer> response described in [EPP-D].
3.2 EPP Transform Commands
EPP provides five commands to transform objects: <create> to create an
instance of an object, <delete> to delete an instance of an object,
<renew> to extend the validity period of an object, <transfer> to
manage object sponsorship changes, and <update> to change information
associated with an object.
3.2.1 EPP <create> Command
This extension defines additional elements for the EPP <create>
command described in [EPP-D]. No additional elements are defined for
the EPP <create> response.
The EPP <create> command provides a transform operation that allows a
client to create a domain object. In addition to the EPP command
elements described in [EPP-D], the command MUST contain an <extension>
element. The <extension> element MUST contain a child <secDNS:create>
element that identifies the secDNS namespace and the location of the
secDNS schema. The <secDNS:create> element MUST contain one of the
following child elements:
- A <secDNS:insecure> element that contains no child elements, but
does contain a REQUIRED "nxt" attribute that notes if the delegation
is to be included in the parent zone's chain of NXT records. A value
of "1" or "true" indicates that the delegation is insecure, but is to
be included in the parent zone's chain of NXT records. A value of "0"
or "false" indicates that the delegation is insecure and is not to be
included in the parent zone's chain of NXT records. Server policy and
further discussion around [IETF-OPTIN] might have an impact on the
necessity of this element.
- A <secDNS:keyData> element that contains key and signature data.
Each <secDNS:keyData> element contains one or more <secDNS:key>
elements, one or more corresponding <secDNS:sig> elements, an OPTIONAL
Hollenbeck Expires August 12, 2002 [Page 11]
Internet-Draft EPP DNS Security Mapping February 12, 2002
<secDNS:startDate> element, and an OPTIONAL <secDNS:endDate> element.
The <secDNS:startDate> and <secDNS:endDate> elements MAY be used to
indicate a client's preferences for the start and end date of DNS
security extension resource record publication in the zone
administered by the server operator. If not provided, the server
operator's standard resource record publication policies apply.
The <secDNS:key> element contains the following child elements:
- A <secDNS:flags> element that contains a flags field value as
described in [RFC2535] sections 3.1 and 3.1.2.
- A <secDNS:protocol> element that contains a protocol field value
as described in [RFC2535] sections 3.1 and 3.1.3.
- A <secDNS:alg> element that contains an algorithm number field
value as described in [RFC2535] sections 3.1 and 3.2.
- A <secDNS:pubKey> element that contains an encoded public key
field value as described in [RFC2535] section 3.1. The format of
the public key is algorithm dependent.
The <secDNS:sig> element contains the following child elements:
- A <secDNS:type> element that contains a "type covered" field value
as described in [RFC2535] sections 4.1 and 4.1.1.
- A <secDNS:alg> element that contains an algorithm number field
value as described in [RFC2535] sections 4.1 and 4.1.2.
- A <secDNS:labels> element that contains a labels field value as
described in [RFC2535] sections 4.1 and 4.1.3.
- A <secDNS:origTTL> element that contains an original TTL field
value as described in [RFC2535] sections 4.1 and 4.1.4.
- A <secDNS:sigExp> element that contains a date-time value
describing the end of the signature's validity period as described
in [RFC2535] sections 4.1 and 4.1.5.
- A <secDNS:sigInc> element that contains a date-time value
describing the start of the signature's validity period as described
in [RFC2535] sections 4.1 and 4.1.5.
- A <secDNS:keyTag> element that contains a key tag field value as
described in [RFC2535] sections 4.1 and 4.1.6.
- A <secDNS:signerName> element that contains a signer name field
Hollenbeck Expires August 12, 2002 [Page 12]
Internet-Draft EPP DNS Security Mapping February 12, 2002
value as described in [RFC2535] sections 4.1 and 4.1.7.
- A <secDNS:sigVal> element that contains a signature field value as
described in [RFC2535] sections 4.1 and 4.1.8.
Hollenbeck Expires August 12, 2002 [Page 13]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.2.1.1 Example <create> Command for a Secure Delegation
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <create>
C: <domain:create
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: <domain:period unit="y">2</domain:period>
C: <domain:ns>ns1.example.tld</domain:ns>
C: <domain:ns>ns2.example.tld</domain:ns>
C: <domain:registrant>jd1234</domain:registrant>
C: <domain:contact type="admin">sh8013</domain:contact>
C: <domain:contact type="tech">sh8013</domain:contact>
C: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
C: </domain:create>
C: </create>
C: <extension>
C: <secDNS:create
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:keyData>
C: <secDNS:key>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:key>
C: <secDNS:sig>
C: <secDNS:type>KEY</secDNS:type>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:labels>2</secDNS:labels>
C: <secDNS:origTTL>172800</secDNS:origTTL>
C: <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
C: <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: <secDNS:signerName>example.tld</secDNS:signerName>
C: <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
C: </secDNS:sig>
C: </secDNS:keyData>
Hollenbeck Expires August 12, 2002 [Page 14]
Internet-Draft EPP DNS Security Mapping February 12, 2002
C: </secDNS:create>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
3.2.1.2 Example <create> Command for a Insecure Delegation
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <create>
C: <domain:create
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: <domain:period unit="y">2</domain:period>
C: <domain:ns>ns1.example.tld</domain:ns>
C: <domain:ns>ns2.example.tld</domain:ns>
C: <domain:registrant>jd1234</domain:registrant>
C: <domain:contact type="admin">sh8013</domain:contact>
C: <domain:contact type="tech">sh8013</domain:contact>
C: <domain:authInfo type="pw">2fooBAR</domain:authInfo>
C: </domain:create>
C: </create>
C: <extension>
C: <secDNS:create
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:insecure nxt="0"/>
C: </secDNS:create>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
When a <create> command has been processed successfully, the EPP
response is as described in [EPP-D].
3.2.2 EPP <delete> Command
This extension does not add any elements to the EPP <delete> command
Hollenbeck Expires August 12, 2002 [Page 15]
Internet-Draft EPP DNS Security Mapping February 12, 2002
or <delete> response described in [EPP-D].
3.2.3 EPP <renew> Command
This extension does not add any elements to the EPP <renew> command or
<renew> response described in [EPP-D].
3.2.4 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer> command
or <transfer> response described in [EPP-D].
3.2.5 EPP <update> Command
This extension defines additional elements for the EPP <update>
command described in [EPP-D]. No additional elements are defined for
the EPP <update> response.
The EPP <update> command provides a transform operation that allows a
client to modify the attributes of a domain object. In addition to
the EPP command elements descried in [EPP-D], the command MUST contain
an <extension> element. The <extension> element MUST contain a child
<secDNS:update> element that identifies the secDNS namespace and the
location of the secDNS schema. The <secDNS:update> element contains a
<secDNS:add> element to add keys to a set, a <secDNS:rem> element to
remove keys from a set, or a <secDNS:chg> element to replace a
(possibly empty) key set with a new key set.
The <secDNS:add> element is used to add keys to an existing set. The
<secDNS:add> element contains a <secDNS:keyData> element whose child
elements are the same as those presented in the description of the EPP
<create> command.
The <secDNS:rem> element contains a <secDNS:keyData> element that is
used to remove keys from an existing set. Removing all keys returns
the status of the delegation to "notSecured". The <secDNS:rem>
element contains the following child elements used to identify the
security extension information to be removed:
- A <secDNS:alg> element that contains an algorithm number field
value as described in [RFC2535] sections 3.1 and 3.2.
- A <secDNS:keyTag> element that contains a key tag field value as
described in [RFC2535] sections 4.1 and 4.1.6.
The <secDNS:chg> element is used to replace an existing key set with a
new key set and to remove a key set completely. The <secDNS:chg>
element contains child elements that are the same as those presented
Hollenbeck Expires August 12, 2002 [Page 16]
Internet-Draft EPP DNS Security Mapping February 12, 2002
in the description of the <secDNS:create> element as part of the EPP
<create> command.
Hollenbeck Expires August 12, 2002 [Page 17]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.2.5.1 Example <update> Command, Adding a Key
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:add>
C: <secDNS:keyData>
C: <secDNS:key>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:key>
C: <secDNS:sig>
C: <secDNS:type>KEY</secDNS:type>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:labels>2</secDNS:labels>
C: <secDNS:origTTL>172800</secDNS:origTTL>
C: <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
C: <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: <secDNS:signerName>example.tld</secDNS:signerName>
C: <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
C: </secDNS:sig>
C: </secDNS:keyData>
C: </secDNS:add>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires August 12, 2002 [Page 18]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.2.5.2 Example <update> Command, Replacing a Key Set
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:keyData>
C: <secDNS:key>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:key>
C: <secDNS:sig>
C: <secDNS:type>KEY</secDNS:type>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:labels>2</secDNS:labels>
C: <secDNS:origTTL>172800</secDNS:origTTL>
C: <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
C: <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: <secDNS:signerName>example.tld</secDNS:signerName>
C: <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
C: </secDNS:sig>
C: </secDNS:keyData>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires August 12, 2002 [Page 19]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.2.5.3 Example <update> Command, Removing a Key
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:rem>
C: <secDNS:key>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:keyTag>14845</secDNS:keyTag>
C: </secDNS:key>
C: </secDNS:rem>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires August 12, 2002 [Page 20]
Internet-Draft EPP DNS Security Mapping February 12, 2002
3.2.5.4 Example <update> Command, Removing a Key Set
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.tld</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:insecure nxt="0"/>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
When an <update> command has been processed successfully, the EPP
response is as described in [EPP-D].
Hollenbeck Expires August 12, 2002 [Page 21]
Internet-Draft EPP DNS Security Mapping February 12, 2002
4. Formal Syntax
An EPP object mapping is specified in XML Schema notation. The formal
syntax presented here is a complete schema representation of the
object mapping suitable for automated validation of EPP XML instances.
The BEGIN and END tags are not part of the schema; they are used to
note the beginning and ending of the schema for URI registration
purposes.
BEGIN
<?xml version="1.0" encoding="UTF-8"?>
<schema targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified">
<annotation>
<documentation>
Extensible Provisioning Protocol v1.0
domain name extension schema for provisioning
DNS security extensions.
</documentation>
</annotation>
<!--
Child elements found in EPP commands.
-->
<element name="create" type="secDNS:createType"/>
<element name="update" type="secDNS:updateType"/>
<!--
Child elements of the <create> command.
-->
<complexType name="createType">
<choice>
<element name="keyData" type="secDNS:keyDataType"/>
<element name="insecure" type="secDNS:insecureType"/>
</choice>
</complexType>
<complexType name="keyDataType">
<sequence>
<element name="key" type="secDNS:keyType"
maxOccurs="unbounded"/>
<element name="sig" type="secDNS:sigType"
maxOccurs="unbounded"/>
<element name="startDate" type="dateTime"
Hollenbeck Expires August 12, 2002 [Page 22]
Internet-Draft EPP DNS Security Mapping February 12, 2002
minOccurs="0"/>
<element name="endDate" type="dateTime"
minOccurs="0"/>
</sequence>
</complexType>
<complexType name="keyType">
<sequence>
<element name="flags" type="unsignedShort"/>
<element name="protocol" type="unsignedByte"/>
<element name="alg" type="unsignedByte"/>
<element name="pubKey" type="secDNS:keySigType"/>
</sequence>
</complexType>
<complexType name="sigType">
<sequence>
<element name="type" type="secDNS:typeCovType"/>
<element name="alg" type="unsignedByte"/>
<element name="labels" type="unsignedByte"/>
<element name="origTTL" type="unsignedInt"/>
<element name="sigExp" type="dateTime"/>
<element name="sigInc" type="dateTime"/>
<element name="keyTag" type="unsignedShort"/>
<element name="signerName" type="secDNS:nameType"/>
<element name="sigVal" type="secDNS:keySigType"/>
</sequence>
</complexType>
<simpleType name="keySigType">
<restriction base="base64Binary">
<minLength value="1"/>
</restriction>
</simpleType>
<simpleType name="typeCovType">
<restriction base="token">
<enumeration value="KEY"/> <!-- Type 25 -->
</restriction>
</simpleType>
<simpleType name="nameType">
<restriction base="token">
<minLength value="1"/>
<maxLength value="255"/>
</restriction>
</simpleType>
Hollenbeck Expires August 12, 2002 [Page 23]
Internet-Draft EPP DNS Security Mapping February 12, 2002
<complexType name="insecureType">
<attribute name="nxt" type="boolean" use="required"/>
</complexType>
<!--
Child elements of the <update> command.
-->
<complexType name="updateType">
<choice>
<element name="add" type="secDNS:addType"/>
<element name="chg" type="secDNS:createType"/>
<element name="rem" type="secDNS:remType"/>
</choice>
</complexType>
<complexType name="addType">
<sequence>
<element name="keyData" type="secDNS:keyDataType"/>
</sequence>
</complexType>
<complexType name="remType">
<sequence>
<element name="key" type="secDNS:keyRemType"
maxOccurs="unbounded"/>
</sequence>
</complexType>
<complexType name="keyRemType">
<sequence>
<element name="alg" type="unsignedByte"/>
<element name="keyTag" type="unsignedShort"/>
</sequence>
</complexType>
<!--
Child response elements.
-->
<element name="infData" type="secDNS:infDataType"/>
<!--
<info> response elements.
-->
<complexType name="infDataType">
<sequence>
<element name="status" type="secDNS:statusType"/>
<choice>
<element name="keyData" type="secDNS:infoKeyDataType"/>
Hollenbeck Expires August 12, 2002 [Page 24]
Internet-Draft EPP DNS Security Mapping February 12, 2002
<element name="insecure" type="secDNS:insecureType"/>
</choice>
</sequence>
</complexType>
<complexType name="statusType">
<simpleContent>
<extension base="token">
<attribute name="s" type="secDNS:statusValueType"
use="required"/>
</extension>
</simpleContent>
</complexType>
<simpleType name="statusValueType">
<restriction base="token">
<enumeration value="insecure"/>
<enumeration value="secure"/>
</restriction>
</simpleType>
<complexType name="infoKeyDataType">
<sequence>
<element name="key" type="secDNS:infoKeyType"
maxOccurs="unbounded"/>
<element name="startDate" type="dateTime"
minOccurs="0"/>
<element name="endDate" type="dateTime"
minOccurs="0"/>
</sequence>
</complexType>
<complexType name="infoKeyType">
<sequence>
<element name="flags" type="unsignedShort"/>
<element name="protocol" type="unsignedByte"/>
<element name="alg" type="unsignedByte"/>
<element name="pubKey" type="secDNS:keySigType"
minOccurs="0"/>
</sequence>
</complexType>
<!--
End of schema.
-->
</schema>
END
Hollenbeck Expires August 12, 2002 [Page 25]
Internet-Draft EPP DNS Security Mapping February 12, 2002
5. Internationalization Considerations
EPP is represented in XML, which provides native support for encoding
information using the Unicode character set and its more compact
representations including UTF-8. Compliant XML processors are
REQUIRED to understand both UTF-8 and UTF-16. Though XML includes
provisions to identify other character set encodings through use of an
"encoding" attribute in an <?xml?> declaration, EPP use with character
sets other than UTF-8 is NOT RECOMMENDED.
6. IANA Considerations
This document uses URNs to describe XML namespaces and XML schemas
conforming to a registry mechanism described in [IETF-XML]. Two URI
assignments are requested.
Registration request for the secDNS namespace:
URI: urn:ietf:params:xml:ns:secDNS-1.0
Registrant Contact: See the "Author's Address" section of this
document.
XML: None. Namespace URIs do not represent an XML specification.
Registration request for the secDNS XML schema:
URI: urn:ietf:params:xml:schema:secDNS-1.0
Registrant Contact: See the "Author's Address" section of this
document.
XML: See the "Formal Syntax" section of this document.
Hollenbeck Expires August 12, 2002 [Page 26]
Internet-Draft EPP DNS Security Mapping February 12, 2002
7. Security Considerations
The provisioning service described in this document involves the
exchange of information that can have an operational impact on the
DNS. A trust relationship MUST exist between the EPP client and
server, and provisioning of public key information MUST only be done
after the identities of both parties have been confirmed using a
strong authentication mechanism.
An EPP client might be acting as an agent for a zone administrator who
wants to send key information to be signed and published by the server
operator. Man-in-the-middle attacks are thus possible as a result of
direct client activity or inadvertent client data manipulation.
The signature information provided by a client allows a server to
confirm that the corresponding key is usable and has not been modified
while in transit, but the server generally does not have enough
information to confirm that the key was generated and provided by the
child zone administrator. Authentication and integrity services MUST
be provided on a hop-by-hop basis to ensure that data is not modified
while in transit between entities.
Acceptance of a false key by a server operator can produce significant
operational consequences. The child and parent zones MUST be
consistent to properly secure the delegation. In the absence of
consistent signatures the delegation will not appear in the secure
name space, yielding untrustworthy query responses.
Signature checking at the server requires computational resources. A
purposeful or inadvertent denial of service attack is possible if a
client requests some number of update operations that exceed a
server's processing capabilities. Server operators SHOULD take steps
to manage command load and command processing requirements to minimize
the risk of a denial of service attack.
8. Acknowledgements
The author gratefully acknowledges the contributions to this document
provided by David Blacka, Olafur Gudmundsson, and Mark Kosters.
Hollenbeck Expires August 12, 2002 [Page 27]
Internet-Draft EPP DNS Security Mapping February 12, 2002
9. References
Normative References:
[EPP] S. Hollenbeck: "Extensible Provisioning Protocol", work in
progress.
[EPP-D] S. Hollenbeck: "Extensible Provisioning Protocol Domain Name
Mapping", work in progress.
[IETF-DS] O. Gudmundsson: "Delegation Signer Resource Record", work in
progress.
[IETF-OPTIN] R. Arends et al.: "DNSSEC Opt-In", work in progress.
[IETF-XML] M. Mealling: "The IETF XML Registry", work in progress.
[RFC1034] P. Mockapetris: "DOMAIN NAMES - CONCEPTS AND FACILITIES",
STD 13, RFC 1034, November 1987.
[RFC1035] P. Mockapetris: "DOMAIN NAMES - IMPLEMENTATION AND
SPECIFICATION", STD 13, RFC 1035, November 1987.
[RFC2119] S. Bradner: "Key Words for Use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2535] D. Eastlake: "Domain Name System Security Extensions", RFC
2535, March 1999.
[RFC3008] B. Wellington: "Domain Name System Security (DNSSEC) Signing
Authority", RFC 3008, November 2000.
[RFC3090] E. Lewis: "DNS Security Extension Clarification on Zone
Status", RFC 3090, March 2001.
Informative References:
[XML] Editors T. Bray et al.: "Extensible Markup Language (XML) 1.0
(Second Edition)", W3C Recommendation 6 October 2000.
[XMLS-1] Editors H. Thompson et al.: "XML Schema Part 1: Structures",
W3C Recommendation 2 May 2001.
[XMLS-2] Editors P. Biron, A. Malhotra: "XML Schema Part 2:
Datatypes", W3C Recommendation 2 May 2001.
Hollenbeck Expires August 12, 2002 [Page 28]
Internet-Draft EPP DNS Security Mapping February 12, 2002
10. Author's Address
Scott Hollenbeck
VeriSign Global Registry Services
21345 Ridgetop Circle
Dulles, VA 20166-6503
USA
shollenbeck@verisign.com
A. Revisions From Previous Version
(Note to RFC editor: please remove this section completely before
publication as an RFC.)
None, this is the initial version.
Hollenbeck Expires August 12, 2002 [Page 29]
Internet-Draft EPP DNS Security Mapping February 12, 2002
B. Full Copyright Statement
Copyright (C) The Internet Society 2002. All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published and
distributed, in whole or in part, without restriction of any kind,
provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of developing
Internet standards in which case the procedures for copyrights defined
in the Internet Standards process must be followed, or as required to
translate it into languages other than English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT
NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN
WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Hollenbeck Expires August 12, 2002 [Page 30]
