Network Working Group S. Hollenbeck
Internet-Draft VeriSign, Inc.
Expires: July 22, 2005 January 18, 2005
Domain Name System (DNS) Security Extensions Mapping for the
Extensible Provisioning Protocol (EPP)
draft-hollenbeck-epp-secdns-06.txt
Status of this Memo
This document is an Internet-Draft and is subject to all provisions
of Section 3 of RFC 3667. By submitting this Internet-Draft, each
author represents that any applicable patent or other IPR claims of
which he or she is aware have been or will be disclosed, and any of
which he or she become aware will be disclosed, in accordance with
RFC 3668.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on July 22, 2005.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
This document describes an Extensible Provisioning Protocol (EPP)
extension mapping for the provisioning and management of Domain Name
System (DNS) security extensions for domain names stored in a shared
central repository. Specified in XML, this mapping extends the EPP
domain name mapping to provide additional features required for the
provisioning of DNS security extensions.
Hollenbeck Expires July 22, 2005 [Page 1]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 Conventions Used In This Document . . . . . . . . . . . . 3
2. Object Attributes . . . . . . . . . . . . . . . . . . . . . . 3
2.1 Delegation Signer Information . . . . . . . . . . . . . . 4
2.1.1 Public Key Information . . . . . . . . . . . . . . . . 4
2.2 Dates and Times . . . . . . . . . . . . . . . . . . . . . 4
2.3 Date-Time Durations . . . . . . . . . . . . . . . . . . . 4
2.4 Booleans . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.5 Time to Live Values . . . . . . . . . . . . . . . . . . . 5
3. EPP Command Mapping . . . . . . . . . . . . . . . . . . . . . 5
3.1 EPP Query Commands . . . . . . . . . . . . . . . . . . . . 5
3.1.1 EPP <check> Command . . . . . . . . . . . . . . . . . 5
3.1.2 EPP <info> Command . . . . . . . . . . . . . . . . . . 5
3.1.3 EPP <transfer> Command . . . . . . . . . . . . . . . . 9
3.2 EPP Transform Commands . . . . . . . . . . . . . . . . . . 10
3.2.1 EPP <create> Command . . . . . . . . . . . . . . . . . 10
3.2.2 EPP <delete> Command . . . . . . . . . . . . . . . . . 14
3.2.3 EPP <renew> Command . . . . . . . . . . . . . . . . . 14
3.2.4 EPP <transfer> Command . . . . . . . . . . . . . . . . 14
3.2.5 EPP <update> Command . . . . . . . . . . . . . . . . . 14
4. Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . . 20
5. Internationalization Considerations . . . . . . . . . . . . . 23
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 23
7. Security Considerations . . . . . . . . . . . . . . . . . . . 24
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 25
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 25
9.1 Normative References . . . . . . . . . . . . . . . . . . . 25
9.2 Informative References . . . . . . . . . . . . . . . . . . 26
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 27
Intellectual Property and Copyright Statements . . . . . . . . 28
Hollenbeck Expires July 22, 2005 [Page 2]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
1. Introduction
This document describes an extension mapping for version 1.0 of the
Extensible Provisioning Protocol (EPP) described in RFC 3730 [1].
This mapping, an extension of the domain name mapping described in
RFC 3731 [2], is specified using the Extensible Markup Language (XML)
1.0 [3] and XML Schema notation ([4], [5]).
The EPP core protocol specification [1] provides a complete
description of EPP command and response structures. A thorough
understanding of the base protocol specification is necessary to
understand the mapping described in this document. Familiarity with
the DNS described in RFC 1034 [14] and RFC 1035 [15], and DNS
security extensions described in RFC 3008 [16], RFC 3090 [17], RFC
TBD1 [6], and RFC TBD2 [7] is required to understand the DNS security
concepts described in this document.
The EPP mapping described in this document specifies a mechanism for
the provisioning and management of DNS security extensions in a
shared central repository. Information exchanged via this mapping
can be extracted from the repository and used to publish DNS resource
records as described in RFC 3658 [8] and RFC TBD2 [7].
1.1 Conventions Used In This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in BCP 14, RFC 2119 [9].
In examples, "C:" represents lines sent by a protocol client and "S:"
represents lines returned by a protocol server. "////" is used to
note element values that have been shortened to better fit page
boundaries. Indentation and white space in examples is provided only
to illustrate element relationships and is not a REQUIRED feature of
this protocol.
XML is case sensitive. Unless stated otherwise, XML specifications
and examples provided in this document MUST be interpreted in the
character case presented to develop a conforming implementation.
2. Object Attributes
This extension adds additional elements to the EPP domain name
mapping [2]. Only new element descriptions are described here.
This document describes operational scenarios in which a client can
create delegation signer (DS) information, add delegation signer
information, remove delegation signer information, and replace
Hollenbeck Expires July 22, 2005 [Page 3]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
existing delegation signer information. Key data associated with the
DS information MAY be provided by the client, but the server is not
obligated to use the key data. The server operator MAY also issue
out-of-band DNS queries to retrieve the key data from the registered
domain's apex in order to evaluate the received DS information. It
is RECOMMENDED that the child zone operator have this key data online
in the DNS tree to allow the parent zone administrator to validate
the data as necessary and the key data SHOULD have the Secure Entry
Point (SEP) bit set as described in RFC 3757 [10].
2.1 Delegation Signer Information
Delegation signer (DS) information is published by the server to
indicate that a delegated zone is digitally signed and that the
delegation zone recognizes the indicated key as a valid zone key for
the delegated zone. A DS RR contains four fields: a key tag field, a
KEY algorithm number octet, an octet identifying the digest algorithm
used, and a digest field. See RFC 3658 [8] for specific field
formats.
2.1.1 Public Key Information
Public key information provided by a client maps to the DNSKEY RR
presentation field formats described in section 2.2 of RFC TBD2 [7].
A DNSKEY RR contains four fields: flags, a protocol octet, an
algorithm number octet, and a public key.
2.2 Dates and Times
Date and time attribute values MUST be represented in Universal
Coordinated Time (UTC) using the Gregorian calendar. The extended
date-time form using upper case "T" and "Z" characters defined in RFC
3339 [11] MUST be used to represent date-time values as XML Schema
does not support truncated date-time forms or lower case "T" and "Z"
characters.
2.3 Date-Time Durations
Duration attribute values MUST be represented in the XML Schema
format described in Part 2 of the W3C XML Schema recommendation [5].
2.4 Booleans
Boolean values MUST be represented in the XML Schema format described
in Part 2 of the W3C XML Schema recommendation [5].
Hollenbeck Expires July 22, 2005 [Page 4]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
2.5 Time to Live Values
Time to Live (TTL) values MUST be represented in an extended XML
Schema "int" format. The base "int" format, which allows negative
numbers, is described in Part 2 of the W3C XML Schema recommendation
[5]. This format is further restricted to enforce a minimum value of
zero. Additional information describing TTL validity can be found in
section 8 of RFC 2181 [12].
3. EPP Command Mapping
A detailed description of the EPP syntax and semantics can be found
in the EPP core protocol specification [1]. The command mappings
described here are specifically for use in provisioning and managing
DNS security extensions via EPP.
3.1 EPP Query Commands
EPP provides three commands to retrieve object information: <check>
to determine if an object is known to the server, <info> to retrieve
detailed information associated with an object, and <transfer> to
retrieve object transfer status information.
3.1.1 EPP <check> Command
This extension does not add any elements to the EPP <check> command
or <check> response described in the EPP domain mapping [2].
3.1.2 EPP <info> Command
This extension does not add any elements to the EPP <info> command
described in the EPP domain mapping [2]. Additional elements are
defined for the <info> response.
When an <info> command has been processed successfully, the EPP
<resData> element MUST contain child elements as described in the EPP
domain mapping [2]. In addition, the EPP <extension> element MUST
contain a child <secDNS:infData> element that identifies the
extension namespace and the location of the extension schema. The
<secDNS:infData> element contains the following child elements:
One or more <secDNS:dsData> elements that describe the delegation
signer data provided by the client for the domain. The
<secDNS:dsData> element contains the following child elements:
A <secDNS:keyTag> element that contains a key tag value as
described in section 2.4 of RFC 3658 [8].
Hollenbeck Expires July 22, 2005 [Page 5]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
A <secDNS:alg> element that contains an algorithm value as
described in section 2.4 of RFC 3658 [8].
A <secDNS:digestType> element that contains a digest type value
as described in section 2.4 of RFC 3658 [8].
A <secDNS:digest> element that contains a digest value as
described in section 2.4 of RFC 3658 [8].
A <secDNS:sDate> element that indicates a client's preferred
start date for use of this data to create DNS security
extension resource records in the zone administered by the
server operator.
A <secDNS:eDate> element that indicates a client's preferred
end date for use of this data to create DNS security extension
resource records in the zone administered by the server
operator.
An OPTIONAL <secDNS:vInterval> element indicates a client's
preference to have the RRSIG(DS) regenerated by the parent at
the specified rate. If the <secDNS:vInterval> is not specified
by the client, the default signing policy of the server
operator (as determined using an out-of-band mechanism)
applies.
An OPTIONAL <secDNS:ttl> element that indicates a client's
preference for the DS RR Time to Live to be published by the
parent. If the <secDNS:ttl> is not specified by the client,
the default TTL of the server operator (as determined using an
out-of-band mechanism) applies. The server operator is not
obligated to honor the requested TTL.
An OPTIONAL <secDNS:keyData> element that describes the key
data used as input in the DS hash calculation. The
<secDNS:keyData> element contains the following child elements:
A <secDNS:flags> element that contains a flags field value
as described in sections 2.1.1 and 2.2 of RFC TBD2 [7].
A <secDNS:protocol> element that contains a protocol field
value as described in sections 2.1.2 and 2.2 of RFC TBD2
[7].
A <secDNS:alg> element that contains an algorithm number
field value as described in sections 2.1.3 and 2.2 of RFC
TBD2 [7].
Hollenbeck Expires July 22, 2005 [Page 6]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
A <secDNS:pubKey> element that contains an encoded public
key field value as described in sections 2.1.4 and 2.2 of
RFC TBD2 [7].
Example <info> Response for a Secure Delegation:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.com</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>
S: <domain:hostObj>ns1.example.com</domain:hostObj>
S: <domain:hostObj>ns2.example.com</domain:hostObj>
S: </domain:ns>
S: <domain:host>ns1.example.com</domain:host>
S: <domain:host>ns2.example.com</domain:host>
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo>
S: <domain:pw>2fooBAR</domain:pw>
S: </domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
Hollenbeck Expires July 22, 2005 [Page 7]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:dsData>
S: <secDNS:keyTag>12345</secDNS:keyTag>
S: <secDNS:alg>3</secDNS:alg>
S: <secDNS:digestType>1</secDNS:digestType>
S: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
S: <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
S: <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
S: <secDNS:vInterval>P7D</secDNS:vInterval>
S: </secDNS:dsData>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Example <info> Response for a Secure Delegation with OPTIONAL Data:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:infData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.com</domain:name>
S: <domain:roid>EXAMPLE1-REP</domain:roid>
S: <domain:status s="ok"/>
S: <domain:registrant>jd1234</domain:registrant>
S: <domain:contact type="admin">sh8013</domain:contact>
S: <domain:contact type="tech">sh8013</domain:contact>
S: <domain:ns>
S: <domain:hostObj>ns1.example.com</domain:hostObj>
S: <domain:hostObj>ns2.example.com</domain:hostObj>
S: </domain:ns>
S: <domain:host>ns1.example.com</domain:host>
S: <domain:host>ns2.example.com</domain:host>
Hollenbeck Expires July 22, 2005 [Page 8]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
S: <domain:clID>ClientX</domain:clID>
S: <domain:crID>ClientY</domain:crID>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:upID>ClientX</domain:upID>
S: <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
S: <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
S: <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
S: <domain:authInfo>
S: <domain:pw>2fooBAR</domain:pw>
S: </domain:authInfo>
S: </domain:infData>
S: </resData>
S: <extension>
S: <secDNS:infData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:dsData>
S: <secDNS:keyTag>12345</secDNS:keyTag>
S: <secDNS:alg>3</secDNS:alg>
S: <secDNS:digestType>1</secDNS:digestType>
S: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
S: <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
S: <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
S: <secDNS:vInterval>P7D</secDNS:vInterval>
S: <secDNS:ttl>604800</secDNS:ttl>
S: <secDNS:keyData>
S: <secDNS:flags>256</secDNS:flags>
S: <secDNS:protocol>3</secDNS:protocol>
S: <secDNS:alg>1</secDNS:alg>
S: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
S: </secDNS:keyData>
S: </secDNS:dsData>
S: </secDNS:infData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54322-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
An EPP error response MUST be returned if an <info> command can not
be processed for any reason.
3.1.3 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer>
Hollenbeck Expires July 22, 2005 [Page 9]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
command or <transfer> response described in the EPP domain mapping
[2].
3.2 EPP Transform Commands
EPP provides five commands to transform objects: <create> to create
an instance of an object, <delete> to delete an instance of an
object, <renew> to extend the validity period of an object,
<transfer> to manage object sponsorship changes, and <update> to
change information associated with an object.
3.2.1 EPP <create> Command
This extension defines additional elements for the EPP <create>
command described in the EPP domain mapping [2]. An additional
element is also defined for the EPP <create> response.
The EPP <create> command provides a transform operation that allows a
client to create a domain object. In addition to the EPP command
elements described in the EPP domain mapping [2], the command MUST
contain an <extension> element. The <extension> element MUST contain
a child <secDNS:create> element that identifies the extension
namespace and the location of the extension schema. The
<secDNS:create> element MUST contain one or more <secDNS:dsData>
elements. Child elements of the <secDNS:dsData> element are
described in Section 3.1.2.
Example <create> Command for a Secure Delegation:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <create>
C: <domain:create
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: <domain:period unit="y">2</domain:period>
C: <domain:ns>
C: <domain:hostObj>ns1.example.com</domain:hostObj>
C: <domain:hostObj>ns2.example.com</domain:hostObj>
C: </domain:ns>
C: <domain:registrant>jd1234</domain:registrant>
C: <domain:contact type="admin">sh8013</domain:contact>
Hollenbeck Expires July 22, 2005 [Page 10]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
C: <domain:contact type="tech">sh8013</domain:contact>
C: <domain:authInfo>
C: <domain:pw>2fooBAR</domain:pw>
C: </domain:authInfo>
C: </domain:create>
C: </create>
C: <extension>
C: <secDNS:create
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
C: <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
C: </secDNS:dsData>
C: </secDNS:create>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Example <create> Command for a Secure Delegation with OPTIONAL data:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <create>
C: <domain:create
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: <domain:period unit="y">2</domain:period>
C: <domain:ns>
C: <domain:hostObj>ns1.example.com</domain:hostObj>
C: <domain:hostObj>ns2.example.com</domain:hostObj>
C: </domain:ns>
C: <domain:registrant>jd1234</domain:registrant>
C: <domain:contact type="admin">sh8013</domain:contact>
C: <domain:contact type="tech">sh8013</domain:contact>
C: <domain:authInfo>
Hollenbeck Expires July 22, 2005 [Page 11]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
C: <domain:pw>2fooBAR</domain:pw>
C: </domain:authInfo>
C: </domain:create>
C: </create>
C: <extension>
C: <secDNS:create
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
C: <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
C: <secDNS:vInterval>P7D</secDNS:vInterval>
C: <secDNS:ttl>604800</secDNS:ttl>
C: <secDNS:keyData>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:keyData>
C: </secDNS:dsData>
C: </secDNS:create>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
When a <create> command has been processed successfully, the EPP
response is typically as described in the EPP domain mapping [2]. A
server MAY return an OPTIONAL <extension> element to describe how the
the OPTIONAL <secDNS:vInterval>, <secDNS:ttl>, and <secDNS:keyData>
elements were processed. If present, the <extension> element MUST
contain a child <secDNS:statusData> element. The <secDNS:statusData>
element MUST contain one or more of the following child elements:
A <secDNS:vInterval> element.
A <secDNS:ttl> element.
A <secDNS:keyData> element.
The <secDNS:vInterval>, <secDNS:ttl>, and <secDNS:keyData> elements
contain no content. If present, they MUST contain a "status"
attribute that describes server use of the data provided by the
Hollenbeck Expires July 22, 2005 [Page 12]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
client. Valid values are "accepted" (the value provided by the
client will be honored), "ignored" (the value provided by the client
will not be honored), and "missing" (the server expected a value, but
none was provided). The "accepted" and "ignored" conditions MUST NOT
cause an error response. The "missing" condition MUST cause an error
response. A server operator MUST return an EPP error result code of
2306 if an OPTIONAL protocol element is needed but not provided.
Example <create> Response for a Secure Delegation with OPTIONAL data:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg>Command completed successfully</msg>
S: </result>
S: <resData>
S: <domain:creData
S: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S: domain-1.0.xsd">
S: <domain:name>example.com</domain:name>
S: <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
S: <domain:exDate>2001-04-03T22:00:00.0Z</domain:exDate>
S: </domain:creData>
S: </resData>
S: <extension>
S: <secDNS:statusData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:vInterval status="accepted"/>
S: <secDNS:ttl status="ignored"/>
S: <secDNS:keyData status="ignored"/>
S: </secDNS:statusData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54321-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Hollenbeck Expires July 22, 2005 [Page 13]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
3.2.2 EPP <delete> Command
This extension does not add any elements to the EPP <delete> command
or <delete> response described in the EPP domain mapping [2].
3.2.3 EPP <renew> Command
This extension does not add any elements to the EPP <renew> command
or <renew> response described in the EPP domain mapping [2].
3.2.4 EPP <transfer> Command
This extension does not add any elements to the EPP <transfer>
command or <transfer> response described in the EPP domain mapping
[2].
3.2.5 EPP <update> Command
This extension defines additional elements for the EPP <update>
command described in the EPP domain mapping [2]. An additional
element is also defined for the EPP <update> response.
The EPP <update> command provides a transform operation that allows a
client to modify the attributes of a domain object. In addition to
the EPP command elements described in the EPP domain mapping, the
command MUST contain an <extension> element. The <extension> element
MUST contain a child <secDNS:update> element that identifies the
extension namespace and the location of the extension schema. The
<secDNS:update> element contains a <secDNS:add> element to add
security information to a delegation, a <secDNS:rem> element to
remove security information from a delegation, or a <secDNS:chg>
element to replace security information with new security
information.
The <secDNS:update> element also contains an OPTIONAL "urgent"
attribute that can be used by a client to ask the server operator to
complete and implement the update request with high priority. This
attribute accepts boolean values as described in Section 2.4; the
default value is boolean false. "High priority" is relative to
standard server operator policies that are determined using an
out-of-band mechanism.
The <secDNS:add> element is used to add DS information to an existing
set. The <secDNS:add> element MUST contain one or more
<secDNS:dsData> elements as described in Section 3.1.2.
The <secDNS:rem> element contains one or more <secDNS:keyTag>
elements that are used to remove DS data from a delegation. The
Hollenbeck Expires July 22, 2005 [Page 14]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
<secDNS:keyTag> element MUST contain a key tag value as described in
section 2.4 of RFC 3658 [8]. Removing all DS information can remove
the ability of the parent to secure the delegation to the child
zone.
The <secDNS:chg> element is used to replace existing DS information
with new DS information. The <secDNS:chg> element MUST contain one
or more <secDNS:dsData> elements as described in Section 3.1.2. The
data in these elements is used to replace whatever other data is
currently archived for the delegation.
Example <update> Command, Adding DS Data:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:add>
C: <secDNS:dsData>
C: <secDNS:keyTag>12346</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
C: <secDNS:sDate>2004-09-21T09:00:00.0Z</secDNS:sDate>
C: <secDNS:eDate>2004-10-19T09:00:00.0Z</secDNS:eDate>
C: <secDNS:vInterval>P7D</secDNS:vInterval>
C: </secDNS:dsData>
C: </secDNS:add>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires July 22, 2005 [Page 15]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Example <update> Command, Removing DS Data:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:rem>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: </secDNS:rem>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Hollenbeck Expires July 22, 2005 [Page 16]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Example Urgent <update> Command, Changing DS Data:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update urgent="1"
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: <secDNS:sDate>2004-09-21T09:00:00.0Z</secDNS:sDate>
C: <secDNS:eDate>2004-10-19T09:00:00.0Z</secDNS:eDate>
C: <secDNS:vInterval>P14D</secDNS:vInterval>
C: </secDNS:dsData>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
Example <update> Command, Changing Data to Include OPTIONAL Data:
C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
C: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
C: epp-1.0.xsd">
C: <command>
C: <update>
C: <domain:update
Hollenbeck Expires July 22, 2005 [Page 17]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
C: xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
C: domain-1.0.xsd">
C: <domain:name>example.com</domain:name>
C: </domain:update>
C: </update>
C: <extension>
C: <secDNS:update
C: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
C: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
C: secDNS-1.0.xsd">
C: <secDNS:chg>
C: <secDNS:dsData>
C: <secDNS:keyTag>12345</secDNS:keyTag>
C: <secDNS:alg>3</secDNS:alg>
C: <secDNS:digestType>1</secDNS:digestType>
C: <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
C: <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
C: <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
C: <secDNS:vInterval>P7D</secDNS:vInterval>
C: <secDNS:ttl>604800</secDNS:ttl>
C: <secDNS:keyData>
C: <secDNS:flags>256</secDNS:flags>
C: <secDNS:protocol>3</secDNS:protocol>
C: <secDNS:alg>1</secDNS:alg>
C: <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
C: </secDNS:keyData>
C: </secDNS:dsData>
C: </secDNS:chg>
C: </secDNS:update>
C: </extension>
C: <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>
When an extended <update> command has been processed successfully,
the EPP response is typically as described in the EPP domain mapping
[2]. A server MAY return an OPTIONAL <extension> element to describe
how the the OPTIONAL <secDNS:vInterval>, <secDNS:ttl>, and
<secDNS:keyData> elements and the OPTIONAL "urgent" attribute were
processed. If present, the <extension> element MUST contain a child
<secDNS:statusData> element. The <secDNS:statusData> element MUST
contain one or more of the following child elements:
A <secDNS:vInterval> element.
A <secDNS:ttl> element.
Hollenbeck Expires July 22, 2005 [Page 18]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
A <secDNS:keyData> element.
A <secDNS:urgent> element.
The <secDNS:vInterval>, <secDNS:ttl>, <secDNS:keyData>, and
<secDNS:urgent> elements contain no content. If present, they MUST
contain a "status" attribute that describes server use of the data
provided by the client. Valid values are "accepted" (the value
provided by the client will be honored), "ignored" (the value
provided by the client will not be honored), and "missing" (the
server expected a value, but none was provided). The "accepted"
condition MUST NOT cause an error response. The "missing" condition
MUST cause an error response. The "ignored" condition MUST NOT cause
an error response when used with the <secDNS:vInterval>,
<secDNS:ttl>, and <secDNS:keyData> elements, but it MUST cause an
error response when used with the <secDNS:urgent> element. A server
operator MUST return an EPP error result code of 2306 if an urgent
update (noted with an "urgent" attribute value of boolean true) can
not be completed with high priority or if an OPTIONAL protocol
element is needed but not provided.
Example Urgent <update> Response, No Error:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="1000">
S: <msg lang="en">Command completed successfully</msg>
S: </result>
S: <extension>
S: <secDNS:statusData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:urgent status="accepted"/>
S: </secDNS:statusData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54321-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
Hollenbeck Expires July 22, 2005 [Page 19]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Example Urgent <update> Response, With Error:
S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S: xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
S: epp-1.0.xsd">
S: <response>
S: <result code="2306">
S: <msg>Parameter value policy error</msg>
S: </result>
S: <extension>
S: <secDNS:statusData
S: xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
S: xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
S: secDNS-1.0.xsd">
S: <secDNS:urgent status="ignored"/>
S: </secDNS:statusData>
S: </extension>
S: <trID>
S: <clTRID>ABC-12345</clTRID>
S: <svTRID>54321-XYZ</svTRID>
S: </trID>
S: </response>
S:</epp>
4. Formal Syntax
An EPP object mapping is specified in XML Schema notation. The
formal syntax presented here is a complete schema representation of
the object mapping suitable for automated validation of EPP XML
instances. The BEGIN and END tags are not part of the schema; they
are used to note the beginning and ending of the schema for URI
registration purposes.
BEGIN
<?xml version="1.0" encoding="UTF-8"?>
<schema targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
xmlns="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified">
<annotation>
<documentation>
Extensible Provisioning Protocol v1.0
domain name extension schema for provisioning
DNS security extensions.
Hollenbeck Expires July 22, 2005 [Page 20]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
</documentation>
</annotation>
<!--
Child elements found in EPP commands.
-->
<element name="create" type="secDNS:dsType"/>
<element name="update" type="secDNS:updateType"/>
<!--
Child elements of the <create> command.
-->
<complexType name="dsType">
<sequence>
<element name="dsData" type="secDNS:dsDataType"
maxOccurs="unbounded"/>
</sequence>
</complexType>
<complexType name="dsDataType">
<sequence>
<element name="keyTag" type="unsignedShort"/>
<element name="alg" type="unsignedByte"/>
<element name="digestType" type="unsignedByte"/>
<element name="digest" type="hexBinary"/>
<element name="sDate" type="dateTime"/>
<element name="eDate" type="dateTime"/>
<element name="vInterval" type="duration"
minOccurs="0"/>
<element name="ttl" type="secDNS:ttlType"
minOccurs="0"/>
<element name="keyData" type="secDNS:keyDataType"
minOccurs="0"/>
</sequence>
</complexType>
<simpleType name="ttlType">
<restriction base="int">
<minInclusive value="0"/>
</restriction>
</simpleType>
<complexType name="keyDataType">
<sequence>
<element name="flags" type="unsignedShort"/>
<element name="protocol" type="unsignedByte"/>
<element name="alg" type="unsignedByte"/>
<element name="pubKey" type="secDNS:keyType"/>
Hollenbeck Expires July 22, 2005 [Page 21]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
</sequence>
</complexType>
<simpleType name="keyType">
<restriction base="base64Binary">
<minLength value="1"/>
</restriction>
</simpleType>
<!--
Child elements of the <update> command.
-->
<complexType name="updateType">
<choice>
<element name="add" type="secDNS:dsType"/>
<element name="chg" type="secDNS:dsType"/>
<element name="rem" type="secDNS:remType"/>
</choice>
<attribute name="urgent" type="boolean" default="false"/>
</complexType>
<complexType name="remType">
<sequence>
<element name="keyTag" type="unsignedShort"
maxOccurs="unbounded"/>
</sequence>
</complexType>
<!--
Child response elements.
-->
<element name="infData" type="secDNS:dsType"/>
<element name="statusData" type="secDNS:statusDataType"/>
<complexType name="statusDataType">
<choice minOccurs="0" maxOccurs="4">
<element name="vInterval" type="secDNS:statusType"/>
<element name="ttl" type="secDNS:statusType"/>
<element name="keyData" type="secDNS:statusType"/>
<element name="urgent" type="secDNS:statusType"/>
</choice>
</complexType>
<simpleType name="statusAttrType">
<restriction base="token">
<enumeration value="accepted"/>
<enumeration value="ignored"/>
<enumeration value="missing"/>
Hollenbeck Expires July 22, 2005 [Page 22]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
</restriction>
</simpleType>
<complexType name="statusType">
<attribute name="status" type="secDNS:statusAttrType"/>
</complexType>
<!--
End of schema.
-->
</schema>
END
5. Internationalization Considerations
EPP is represented in XML, which provides native support for encoding
information using the Unicode character set and its more compact
representations including UTF-8 [18]. Conformant XML processors
recognize both UTF-8 and UTF-16 [19]. Though XML includes provisions
to identify and use other character encodings through use of an
"encoding" attribute in an <?xml?> declaration, use of UTF-8 is
RECOMMENDED in environments where parser encoding support
incompatibility exists.
As an extension of the EPP domain mapping [2], the elements, element
content, attributes, and attribute values described in this document
MUST inherit the internationalization conventions used to represent
higher-layer domain and core protocol structures present in an XML
instance that includes this extension.
6. IANA Considerations
This document uses URNs to describe XML namespaces and XML schemas
conforming to a registry mechanism described in RFC 3688 [13]. Two
URI assignments are requested.
Registration request for the extension namespace:
URI: urn:ietf:params:xml:ns:secDNS-1.0
Registrant Contact: IESG
XML: None. Namespace URIs do not represent an XML specification.
Registration request for the extension XML schema:
URI: uurn:ietf:params:xml:schema:secDNS-1.0
Hollenbeck Expires July 22, 2005 [Page 23]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Registrant Contact: IESG
XML: See the "Formal Syntax" section of this document.
7. Security Considerations
The mapping extensions described in this document do not provide any
security services beyond those described by EPP [1], the EPP domain
name mapping [2], and protocol layers used by EPP. The security
considerations described in these other specifications apply to this
specification as well.
As with other domain object transforms, the EPP transform operations
described in this document MUST be restricted to the sponsoring
client as authenticated using the mechanisms described in sections
2.9.1.1 and 7 of RFC 3730 [1]. Any attempt to perform a transform
operation on a domain object by any client other than the sponsoring
client MUST be rejected with an appropriate EPP authorization error.
The provisioning service described in this document involves the
exchange of information that can have an operational impact on the
DNS. A trust relationship MUST exist between the EPP client and
server, and provisioning of public key information MUST only be done
after the identities of both parties have been confirmed using a
strong authentication mechanism.
An EPP client might be acting as an agent for a zone administrator
who wants to send key information to be signed and published by the
server operator. Man-in-the-middle attacks are thus possible as a
result of direct client activity or inadvertent client data
manipulation.
Acceptance of a false key by a server operator can produce
significant operational consequences. The child and parent zones
MUST be consistent to properly secure the delegation. In the absence
of consistent signatures the delegation will not appear in the secure
name space, yielding untrustworthy query responses.
If a key is compromised, a client should either remove the
compromised key or update the DNSKEY/DS information via EPP commands
using the "urgent" attribute. The server operator can then remove
either the DNSSIG of the DS or the DS record itself until the new
information is propagated to the parent zone.
Operational scenarios requiring quick removal of a secure domain
delegation can be implemented using a two-step process. First,
security credentials can be removed using an "urgent" update as just
described. The domain can then be removed from the parent zone by
Hollenbeck Expires July 22, 2005 [Page 24]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
changing the status of the domain to either of the EPP "clientHold"
or "serverHold" domain status values. The domain can also be removed
from the zone using the EPP <delete> command, but this is a more
drastic step that needs to be considered carefully before use.
Data validity checking at the server requires computational
resources. A purposeful or inadvertent denial of service attack is
possible if a client requests some number of update operations that
exceed a server's processing capabilities. Server operators SHOULD
take steps to manage command load and command processing requirements
to minimize the risk of a denial of service attack.
While the TTL values that might be provided by clients are purely
advisory, blind acceptance by a server operator can have an adverse
impact on a server's processing capabilities. Server operators
SHOULD seriously consider adopting implementation rules to limit the
range of TTL values accepted to counter potential adverse situations.
8. Acknowledgements
The author would like to thank the following people who have provided
significant contributions to the development of this document:
David Blacka, Olafur Gudmundsson, Mark Kosters, Ed Lewis, Dan Massey,
Marcos Sanz, Sam Weiler, and Ning Zhang.
9. References
9.1 Normative References
[1] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)",
RFC 3730, March 2004.
[2] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain
Name Mapping", RFC 3731, March 2004.
[3] Paoli, J., Sperberg-McQueen, C., Bray, T. and E. Maler,
"Extensible Markup Language (XML) 1.0 (Second Edition)", W3C
FirstEdition REC-xml-20001006, October 2000.
[4] Maloney, M., Beech, D., Mendelsohn, N. and H. Thompson, "XML
Schema Part 1: Structures", W3C REC REC-xmlschema-1-20010502,
May 2001.
[5] Malhotra, A. and P. Biron, "XML Schema Part 2: Datatypes", W3C
REC REC-xmlschema-2-20010502, May 2001.
[6] Arends, R., "Protocol Modifications for the DNS Security
Hollenbeck Expires July 22, 2005 [Page 25]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Extensions",
Internet-Draft draft-ietf-dnsext-dnssec-protocol-09, October
2004.
[7] Arends, R., "Resource Records for the DNS Security Extensions",
Internet-Draft draft-ietf-dnsext-dnssec-records-11, October
2004.
[8] Gudmundsson, O., "Delegation Signer (DS) Resource Record (RR)",
RFC 3658, December 2003.
[9] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[10] Kolkman, O., Schlyter, J. and E. Lewis, "Domain Name System KEY
(DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag",
RFC 3757, May 2004.
[11] Klyne, G. and C. Newman, "Date and Time on the Internet:
Timestamps", RFC 3339, July 2002.
[12] Elz, R. and R. Bush, "Clarifications to the DNS Specification",
RFC 2181, July 1997.
[13] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
January 2004.
9.2 Informative References
[14] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, November 1987.
[15] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[16] Wellington, B., "Domain Name System Security (DNSSEC) Signing
Authority", RFC 3008, November 2000.
[17] Lewis, E., "DNS Security Extension Clarification on Zone
Status", RFC 3090, March 2001.
[18] Yergeau, F., "UTF-8, a transformation format of ISO 10646",
STD 63, RFC 3629, November 2003.
[19] Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646",
RFC 2781, February 2000.
Hollenbeck Expires July 22, 2005 [Page 26]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Author's Address
Scott Hollenbeck
VeriSign, Inc.
21345 Ridgetop Circle
Dulles, VA 20166-6503
US
Email: shollenbeck@verisign.com
Hollenbeck Expires July 22, 2005 [Page 27]
Internet-Draft EPP DNS Security Extensions Mapping January 2005
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2005). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society.
Hollenbeck Expires July 22, 2005 [Page 28]
