INTERNET-DRAFT                                             D. W. Chadwick
PKIX WG                                                  M. V. Sahalayev
Intended Category: Standards Track                         University of Salford
Expires on 6 August 2003                                   6 February 2003


                 Internet X.509 Public Key Infrastructure
                     LDAP Schema for X.509 CRLs
                <draft-ietf-pkix-ldap-crl-schema-00.txt>


Copyright (C) The Internet Society (2003). All Rights Reserved.

STATUS OF THIS MEMO

This document is an Internet-Draft and is in full conformance with
all the provisions of Section 10 of RFC2026 [1].

Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."

The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.

Comments and suggestions on this document are encouraged. Comments on this
document should be sent to the PKIX working group discussion list
<ietf-pkix@imc.org> or directly to the authors.


ABSTRACT

This document describes an LDAP schema for X.509 CRLs. Each CRL is broken down
into a set of attribute types. These attributes can then be stored in a CRL
entry. An object class is defined for this CRL entry. Each attribute type uses
an existing LDAP syntax, so that new matching rules do not need to be defined.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and  "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [2].

1. Introduction

It currently isn't possible to search LDAP servers for X.509 [6] attributes
(public key certificates, CRLs etc.) as no matching rules have been defined for
them. A couple of Internet Drafts [9,10] have been specified, but implementation
of them is complex.

This document takes an alternative approach. Rather than search for an X.509
attribute in an entry, it suggests the directory user creates an entry (in the
case of pubic key and attribute certificates) or a subtree (in the case of CRLs)
from the X.509 attribute. The attributes of these new entries will be created
from fields of the X.509 attribute (e.g. the issuer field), and if these new
attributes are defined using existing LDAP syntaxes and matching rules, then it
will be possible to use existing LDAP server technology to search for fields in
X.509 attributes.

This document is one of a set comprising:
i)      the LDAP schema for X.509 public key certificates [7]
ii)     the LDAP schema for X.509 attribute certificates [8]
iii)    the LDAP schema for X.509 CRLs (this document)

Schema definitions are provided using LDAPv3 description formats from RFC2252
[3].  Definitions provided here are formatted (line wrapped) for readability.
The specifications use the augmented Backus-Naur Form (ABNF) as described in
RFC2234 [4].

2. DIT Structure and Naming

If the schema presented in this document is used to store information about CRLs
in a directory, each CRL SHOULD be stored as a direct subordinate of the CRL
issuer's entry, unless a crlScope Extension or issuingDistributionPoint
Extension is present in the CRL. In the latter cases the CRL MUST be stored as
indicated in those extensions.  The CRL is named using the x509crlThisUpdate
attribute, using the following name form:

   (1.2.826.0.1.3344810.1.3.0
        NAME "x509CRLNF nameform"
        OC x509CRL
        MUST x509crlThisUpdate )

Subordinate to the entry for the CRL, the user MAY create an entry for each
revoked certificate. Each revoked certificate entry is named with the serial
number of the revoked certificate, unless the CRL is an indirect CRL, in which
case it named with a combination of the serial number and issuer's DN. This is
expressed in the following name forms:

   (1.2.826.0.1.3344810.1.3.1
        NAME "x509CRLentryNF nameform"
        OC x509CRLentry
        MUST x509serial )

   (1.2.826.0.1.3344810.1.3.2
        NAME "x509CRLentryAltNF nameform"
        OC x509CRLentry
        MUST ( x509serialNumber $ x509issuer ) )


3. X.509 schema Object Classes

3.1 X509 Base object class

The x509base object class is the abstract object class that is the superior of
all of the X.509 entry object classes.

(1.2.826.0.1.3344810.1.0.13
        NAME 'x509base'
        ABSTRACT
        MUST (x509signatureAlgorithm $ x509issuer)
        MAY (x509version)

3.2 X.509 CRL object class

The x509CRL object class is the structural object class used for storing
information about CRLs.

  (1.2.826.0.1.3344810.1.0.14
      NAME 'x509CRL'
        SUP x509base
        MUST ( x509crlThisUpdate )
        MAY ( x509crlNextUpdate $
            x509serialNumber  $
            x509authorityKeyIdentifier $
            x509authorityCertIssuer $
            x509authorityCertSerialNumber $
            x509issuerAltNameRfc822Name $
            x509issuerAltNameDnsName $
            x509issuerAltNameDirectoryName $
            x509issuerAltNameUniformResourceIdentifier $
            x509issuerAltNameIpAddress $
            x509issuerAltNameRegisteredID $
            x509crlNumber $
            x509crlDPRfc822Name $
            x509crlDPDnsName $
            x509crlDPDirectoryName $
            x509crlDPURI $
            x509crlDPIpAddress $
            x509crlDPRegisteredID $
            x509crlDPOnlyUserCerts $
            x509crlDPOnlyCACerts $
            x509crlDPOnlySomeReasons $
            x509crlDPOnlyAttCerts $
            x509crlDPindirect $
            x509crlDeltaIndicator $ )
3.3 X.509 revoked certificate object class

The x509CRLentry object class is the structural object class used for storing
information about revoked certificates.

   (1.2.826.0.1.3344810.1.0.15
        NAME 'x509CRLentry'
        SUP x509base
        MUST ( x509serialNumber $
                x509crlCertRevocationDate )
        MAY ( x509crlCertInvalidityDate $
            x509crlCertReasonCode $
            x509crlCertHoldInstructionCode $
            x509crlCertIssuerRfc822Name $
            x509crlCertIssuerDnsName $
                x509crlCertIssuerDirectoryName $
                x509crlCertIssuerURI $
                x509crlCertIssuerIpAddress $
                x509crlCertIssuerRegisteredID )  )

4. Common X.509 attribute types

The following attribute types defined in [7] are used to hold the corresponding
fields of CRLs:

-       x509serialNumber û used to hold the serial number(s) of the revoked
certifictate(s)
-       x509version û used to hold the version of the CRL
-       x509signatureAlgorithm û used to hold the OID of the algorithm used to
sign the CRL
-       x509issuer û used to hold the DN of the CRL issuer
-       x509issuerAltNameRfc822Name û used to hold the email address of the CRL
issuer
-       x509issuerAltNameDnsName û used to hold the DNS name of the CRL issuer
-       x509issuerAltNameDirectoryName û used to hold an alternative DN for the
CRL issuer
-       x509issuerAltNameUniformResourceIdentifier û used to hold a URI for the
CRL issuer
-       x509issuerAltNameIpAddress û used to hold the IP address of the CRL issuer
-       x509issuerAltNameRegisteredID û used to hold a registered OID of the CRL
issuer
-       x509authorityKeyIdentifier û used to hold the identifier of the key used
to sign the CRL
-       x509authorityCertIssuer û used in conjunction with
x509authorityCertSerialNumber to identify the certificate of the issuer
-       x509authorityCertSerialNumber û used in conjunction with
x509authorityCertIssuer to identify the certificate of the issuer

5. Attribute types for CRL specific fields

The following attribute types may be used to store basic fields of a CRL. The
following basic fields are supported:
-       this update
-       next update

5.1 This update

This attribute may be used to hold the thisUpdate field of the CRL.

   (1.2.826.0.1.3344810.1.1.37
        NAME 'x509crlThisUpdate'
        DESC 'Date at which this revocation list was issued - see RFC3280 5.1.2.4'
        EQUALITY generalizedTimeMatch
        ORDERING generalizedTimeOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
        SINGLE-VALUE )

Note that the field in the CRL may be in UTC or GeneralizedTime format. If in
UTC format, the creator of this attribute MUST convert the UTC time into
GeneralisedTime format when creating the attribute value.

5.2     Next update

This attribute may be used to hold the nextUpdate field of the CRL.

   (1.2.826.0.1.3344810.1.1.38
        NAME 'x509crlNextUpdate'
        DESC 'Date by which the next revocation list in this series
                 will be issued, see - RFC3280 5.1.2.5'
        EQUALITY generalizedTimeMatch
        ORDERING generalizedTimeOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
        SINGLE-VALUE )

Note that the field in the CRL may be in UTC or GeneralizedTime format. If in
UTC format, the creator of this attribute MUST convert the UTC time into
GeneralisedTime format when creating the attribute value.

6. Attributes for selected CRL extensions

In line with the CRL profile RFC 3280 [5], the following CRL extensions are
supported:
-       CRL Number (defined here)
-       Issuing Distribution Point (defined here)
-       Authority Key Identifier (defined in [7])
-       Issuer Alternative Name (defined in [7])
-       Delta CRL Indicator (defined here)
The following extension is still to be decided
-       freshest CRL (see 5.2.6 of RFC 3280)

6.1     CRL number extension

This attribute may be used to store the sequence number of the CRL.

   (1.2.826.0.1.3344810.1.1.49
        NAME 'x509crlNumber'
        DESC 'sequence number of issued CRL - see RFC3280 5.2.3'
        EQUALITY integerMatch
        ORDERING integerOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE )

6.2     Issuing Distribution Point

The issuing distribution point comprises the general name of the issuing CA,
plus some codes that indicate the contents of this CRL. Separate attribute types
are defined for all choices of the ASN.1 type "GeneralName" except for
"otherName", "x400Address" and "ediPartyName".

6.2.1 Issuing distribution point RFC 822 name

   (1.2.826.0.1.3344810.1.1.48
        NAME 'x509crlDPRfc822Name'
        DESC 'Internet electronic mail address of the issuing
distribution point, see RFC3280 5.2.5'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded according to the syntax given in RFC
822 [11].

6.2.2 Issuing distribution point DNS name

   (1.2.826.0.1.3344810.1.1.49
        NAME 'x509crlDPDnsName'
        DESC 'Internet domain name of the issuing distribution point, see
              RFC3280 5.2.5'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded as Internet domain names in accordance
with RFC1035 [12].

6.2.3 Issuing distribution point directory name

   (1.2.826.0.1.3344810.1.1.50
        NAME 'x509crlDPDirectoryName'
        DESC 'Distinguished name of the issuing distribution point, see
              RFC3280 5.2.5'
        EQUALITY distinguishedNameMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )

Values of this attribute type must be encoded according to the syntax given in
RFC2253 [13].

6.2.4 Issuing distribution point Uniform Resource Identifier

   (1.2.826.0.1.3344810.1.1.51
        NAME  'x509crlDPURI'
        DESC 'Uniform Resource Identifier of the issuing distribution
point, see RFC3280 5.2.5'
        EQUALITY caseExactMatch
        SUBSTR caseExactSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded according to the syntax given in
RFC2396 [14].

6.2.5 Issuing distribution point IP address

   (1.2.826.0.1.3344810.1.1.52
        NAME 'x509crlDPIpAddress'
        DESC 'Internet Protocol address, of the issuing distribution point, see
              RFC3280 5.2.5'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute type must be stored in the syntax given in Appendix B
of RFC2373 [16].

6.2.6 Issuing distribution point registered ID

   (1.2.826.0.1.3344810.1.1.53
        NAME 'x509crlDPRegisteredID'
        DESC 'Any registered OID of the certificate issuer, see
              RFC3280 5.2.5'
        EQUALITY objectIdentifierMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )

registeredID is an identifier of any registered object assigned in accordance
with ITU-T Rec. X.660. [17]

6.2.7 Issuing distribution point only contains user certs

This attribute may be used to indicate if the CRL only contains revocations for
end-entity certificates.

   (1.2.826.0.1.3344810.1.1.54
        NAME 'x509crlDPOnlyUserCerts'
        DESC 'If true, the CRL only contains revocations for end-entity certs, see
              RFC3280 5.2.5'
        EQUALITY booleanMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )

6.2.8 Issuing distribution point only contains CA certs

This attribute may be used to indicate if the CRL only contains revocations for
CA certificates.

   (1.2.826.0.1.3344810.1.1.55
        NAME 'x509crlDPOnlyCACerts'
        DESC 'If true, the CRL only contains revocations for CA certs, see
              RFC3280 5.2.5'
        EQUALITY booleanMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )

6.2.9 Issuing distribution point only contains some reasons

This attribute may be used to indicate if the CRL only contains some revocation
reason codes.

   (1.2.826.0.1.3344810.1.1.56
        NAME 'x509crlDPOnlySomeReasons'
        DESC 'If true, the CRL only contains some revocation reason codes, see
              RFC3280 5.2.5'
        EQUALITY bitstringMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )

6.2.10 Issuing distribution point only contains attribute certs

This attribute may be used to indicate if the CRL only contains revocations for
attribute certificates.

   (1.2.826.0.1.3344810.1.1.57
        NAME 'x509crlDPOnlyAttCerts'
        DESC 'If true, the CRL only contains revocations for attribute certs, see
              RFC3280 5.2.5'
        EQUALITY booleanMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )

6.2.11 Issuing distribution point is indirect

This attribute may be used to indicate if the CRL is an indirect CRL and holds
revocations of certificates issued by authorities other than the CRL issuer.

   (1.2.826.0.1.3344810.1.1.58
        NAME 'x509crlDPindirect'
        DESC 'If true, the CRL is an indirect CRL, see
              RFC3280 5.2.5'
        EQUALITY booleanMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )

6.3     Delta CRL Indicator

This attribute may be used to indicate if the CRL is a delta CRL.

   (1.2.826.0.1.3344810.1.1.59
        NAME 'x509crlDeltaIndicator'
        DESC 'Indicates this is a delta CRL, and the value points to the
sequence number of the issued base CRL to which this is a delta
- see RFC3280 5.2.4'
        EQUALITY integerMatch
        ORDERING integerOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE )

7. Attributes for CRL revoked certificate fields

The serial number attribute is as defined in [7].

7.1     Revocation date

This attribute may be used to hold the revocationDate field of a CRL entry.

   (1.2.826.0.1.3344810.1.1.39
        NAME 'x509crlCertRevocationDate'
        DESC 'Date/time the CA actually revoked the certificate, see û
RFC3280 5.1.2.6'
        EQUALITY generalizedTimeMatch
        ORDERING generalizedTimeOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
        SINGLE-VALUE )

Note that the field in the CRL may be in UTC or GeneralizedTime format. If in
UTC format, the creator of this attribute MUST convert the UTC time into
GeneralisedTime format when creating the attribute value.

8. Attributes for selected CRL entry extensions

In line with the CRL profile RFC 3280 [5], the following CRL entry extensions
are supported:
-       Invalidity date (defined here)
-       Certificate issuer (defined here)
-       Reason code (defined here)
-       Hold instruction code (defined here)

8.1 Invalidity date extension

This attribute may be used to hold the invalidity date of a certificate.

   (1.2.826.0.1.3344810.1.1.40
        NAME 'x509crlCertInvalidityDate'
        DESC 'date at which it is known or suspected that the private
              key was compromised, see RFC3280 5.3.3'
        EQUALITY generalizedTimeMatch
        ORDERING generalizedTimeOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
        SINGLE-VALUE )

8.2  Certificate Issuer extension

The certificate issuer extension is used in indirect CRLs to identify the issuer
of the certificate that is revoked. Separate attribute types are defined for all
choices of the ASN.1 type "GeneralName" except for "otherName", "x400Address"
and "ediPartyName".

8.2.1 Certificate Issuer RFC 822 name

   (1.2.826.0.1.3344810.1.1.41
        NAME 'x509crlCertIssuerRfc822Name'
        DESC 'Internet electronic mail address of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded according to the syntax given in RFC
822 [11].

8.2.2 Certificate Issuer DNS name

   (1.2.826.0.1.3344810.1.1.42
        NAME 'x509crlCertIssuerDnsName'
        DESC 'Internet domain name of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded as Internet domain names in accordance
with RFC1035 [12].

8.2.3 Certificate Issuer directory name

   (1.2.826.0.1.3344810.1.1.43
        NAME 'x509crlCertIssuerDirectoryName'
        DESC 'Distinguished name of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY distinguishedNameMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )

Values of this attribute type must be encoded according to the syntax given in
RFC2253 [13].

8.2.4 Certificate Issuer Uniform Resource Identifier

   (1.2.826.0.1.3344810.1.1.44
        NAME  'x509crlCertIssuerURI'
        DESC 'Uniform Resource Identifier of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY caseExactMatch
        SUBSTR caseExactSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute must be encoded according to the syntax given in
RFC2396 [14].

8.2.5 Certificate Issuer IP address

   (1.2.826.0.1.3344810.1.1.45
        NAME 'x509crlCertIssuerIpAddress'
        DESC 'Internet Protocol address, of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY caseIgnoreMatch
        SUBSTR caseIgnoreSubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )

Values of this attribute type must be stored in the syntax given in Appendix B
of RFC2373 [16].

8.2.6 Certificate Issuer registered ID

   (1.2.826.0.1.3344810.1.1.46
        NAME 'x509crlCertIssuerRegisteredID'
        DESC 'Any registered OID of the certificate issuer, see
              RFC3280 5.3.4'
        EQUALITY objectIdentifierMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )

registeredID is an identifier of any registered object assigned in accordance
with ITU-T Rec. X.660. [17]

8.3 Revocation Reason Code

This field may be used to hold the coded reason for the revocation

   (1.2.826.0.1.3344810.1.1.47
        NAME 'x509crlCertReasonCode'
        DESC 'An integer code indicating the reason for the revocation, see
              RFC3280 5.3.1'
        EQUALITY integerMatch
      ORDERING integerOrderingMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )

8.4 Hold Instruction Code

This attribute may be used to store the hold instruction code for the
certificate on the CRL.

   (1.2.826.0.1.3344810.1.1.48
        NAME 'x509crlCertHoldInstructionCode'
        DESC 'Any registered OID indicating a hold instruction, see
              RFC3280 5.3.2'
        EQUALITY objectIdentifierMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )

Security Considerations

This [Internet Draft/Standard] describes the subschema for the storage
and matching of PKI attributes derived from CRLs. It does not address the
protocol for the storage and retrieval of this information.

LDAP servers SHOULD use authentication and access control mechanisms to protect
the information during its storage and retrieval.

References

Normative

[1] Bradner, S. The Internet Standards Process -- Revision 3. RFC
2026  October 1996.

[2] S.Bradner. "Key words for use in RFCs to Indicate Requirement
Levels", RFC 2119, March 1997.

[3] Wahl, M., Coulbeck, A., Howes, T. and S. Kille, "Lightweight Directory
Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.

[4] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF",
RFC 2234, November 1997.

[5] Housley, R., Polk, T., Ford, W. and D. Solo, "Internet X.509 Public Key
Infrastructure Certificate and CRL Profile", RFC 3280, April 2002.

[6] ITU, "Information  Technology - Open Systems Interconnection - The
Directory: Public-key and attribute certificate frameworks", ITU-T
Recommendation X.509, March 2000.

[7] Klasen, N., Gietz, P. "An LDAPv3 Schema for X.509 Certificates",<draft-
klasen-ldap-x509certificate-schema-00.txt>, February, 2002

[11] Crocker, D., "Standard for the format of ARPA Internet text messages", STD
11, RFC 822, August 1982.

[12] Mockapetris, P., "Domain names - implementation and specification", STD 13,
RFC 1035, November 1987.

[13] Wahl, M., Kille, S. and T. Howes, "Lightweight Directory Access Protocol
(v3): UTF-8 String Representation of Distinguished Names", RFC 2253, December
1997.

[14] Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform Resource
Identifiers (URI): Generic Syntax", RFC 2396, August 1998.

[15] Hodges, J. and RL. Morgan, "Lightweight Directory Access Protocol (v3):
Technical Specification", RFC 3377, September 2002.

[16] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC
2373, July 1998.

[17] CCITT Recommendation X.660 (1992) | ISO/IEC 9834-1:1993, Information
technology û Open Systems Interconnection û Procedures for the operation of OSI
Registration Authorities: General procedures.


Informative

[8] Chadwick, D.W., Sahalayev, M. V. "Internet X.509 Public Key Infrastructure
LDAP Schema for X.509 Attribute Certificates", <draft-ietf-sahalayev-pkix-ldap-
ac-schema-00.txt>, February 2003

[9] Chadwick, D.W., Legg, S. "Internet X.509 Public Key Infrastructure - LDAP
Schema for PKIs " <draft-ietf-pkix-ldap-pki-schema-00.txt>, July 2002

[10] Chadwick, D.W., Legg, S. "Internet X.509 Public Key Infrastructure - LDAP
Schema for PMIs" <draft-ietf-pkix-ldap-pmi-schema-00.txt>, July 2002


Intellectual Property Notice

The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it has
made any effort to identify any such rights.
Information on the
IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. [BCP-11]
Copies of claims of rights made available for publication and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementors or users of this specification
can be obtained from the IETF Secretariat.

The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard.
Please address the information to the IETF Executive
Director.


11. Copyright

Copyright (C) The Internet Society (2001). All Rights Reserved.

This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.

The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


12. Authors' Addresses

David Chadwick, Mikhail Sahalayev
IS Institute
University of Salford
Salford
England
M5 4WT

Email: d.w.chadwick@salford.ac.uk
       M.Sahalayev@pgr.salford.ac.uk