Network Working Group                                           J. Gould
Internet-Draft                                             S. Hollenbeck
Obsoletes: 4310 (if approved)                             VeriSign, Inc.
Intended status: Standards Track                         January 1, 2010
Expires: July 5, 2010


Domain Name System (DNS) Security Extensions Mapping for the Extensible
                      Provisioning Protocol (EPP)
                       draft-gould-rfc4310bis-03

Abstract

   This document describes an Extensible Provisioning Protocol (EPP)
   extension mapping for the provisioning and management of Domain Name
   System security extensions (DNSSEC) for domain names stored in a
   shared central repository.  Specified in XML, this mapping extends
   the EPP domain name mapping to provide additional features required
   for the provisioning of DNS security extensions.

   This document incorporates feedback from early implementers on the
   PROVREG mail list and users.

   This document is intended to obsolete RFC 4310.

Status of this Memo

   This Internet-Draft is submitted to IETF in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on July 5, 2010.




Gould & Hollenbeck        Expires July 5, 2010                  [Page 1]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the BSD License.





































Gould & Hollenbeck        Expires July 5, 2010                  [Page 2]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  Conventions Used in This Document  . . . . . . . . . . . .  3
   2.  Object Attributes  . . . . . . . . . . . . . . . . . . . . . .  3
     2.1.  Delegation Signer Information  . . . . . . . . . . . . . .  4
       2.1.1.  Public Key Information . . . . . . . . . . . . . . . .  4
     2.2.  Booleans . . . . . . . . . . . . . . . . . . . . . . . . .  4
     2.3.  Maximum Signature Lifetime Values  . . . . . . . . . . . .  4
   3.  DS Data Interface and Key Data Interface . . . . . . . . . . .  4
     3.1.  DS Data Interface  . . . . . . . . . . . . . . . . . . . .  5
     3.2.  Key Data Interface . . . . . . . . . . . . . . . . . . . .  6
     3.3.  Example DS Data Interface and Key Data Interface . . . . .  6
   4.  EPP Command Mapping  . . . . . . . . . . . . . . . . . . . . .  7
     4.1.  EPP Query Commands . . . . . . . . . . . . . . . . . . . .  7
       4.1.1.  EPP <check> Command  . . . . . . . . . . . . . . . . .  7
       4.1.2.  EPP <info> Command . . . . . . . . . . . . . . . . . .  8
       4.1.3.  EPP <transfer> Command . . . . . . . . . . . . . . . . 12
     4.2.  EPP Transform Commands . . . . . . . . . . . . . . . . . . 12
       4.2.1.  EPP <create> Command . . . . . . . . . . . . . . . . . 12
       4.2.2.  EPP <delete> Command . . . . . . . . . . . . . . . . . 15
       4.2.3.  EPP <renew> Command  . . . . . . . . . . . . . . . . . 16
       4.2.4.  EPP <transfer> Command . . . . . . . . . . . . . . . . 16
       4.2.5.  EPP <update> Command . . . . . . . . . . . . . . . . . 16
   5.  Formal Syntax  . . . . . . . . . . . . . . . . . . . . . . . . 25
   6.  Internationalization Considerations  . . . . . . . . . . . . . 29
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
   8.  Security Considerations  . . . . . . . . . . . . . . . . . . . 30
   9.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 31
   10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 31
     10.1. Normative References . . . . . . . . . . . . . . . . . . . 31
     10.2. Informative References . . . . . . . . . . . . . . . . . . 32
   Appendix A.  Changes from RFC 4310 . . . . . . . . . . . . . . . . 32
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 34

















Gould & Hollenbeck        Expires July 5, 2010                  [Page 3]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


1.  Introduction

   This document describes an extension mapping for version 1.0 of the
   Extensible Provisioning Protocol (EPP) described in RFC 5730 [1].
   This mapping, an extension of the domain name mapping described in
   RFC 5731 [2], is specified using the Extensible Markup Language (XML)
   1.0 [3] and XML Schema notation ([4], [5]).

   The EPP core protocol specification [1] provides a complete
   description of EPP command and response structures.  A thorough
   understanding of the base protocol specification is necessary to
   understand the mapping described in this document.  Familiarity with
   the Domain Name System (DNS) described in RFC 1034 [11] and RFC 1035
   [12] and with DNS security extensions described in RFC 4033 [13], RFC
   4034 [6], and RFC 4035 [7] is required to understand the DNS security
   concepts described in this document.

   The EPP mapping described in this document specifies a mechanism for
   the provisioning and management of DNS security extensions in a
   shared central repository.  Information exchanged via this mapping
   can be extracted from the repository and used to publish DNSSEC
   delegation signer (DS) resource records as described in RFC 4034 [6].

1.1.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in BCP 14, RFC 2119 [8].

   In examples, "C:" represents lines sent by a protocol client, and
   "S:" represents lines returned by a protocol server. "////" is used
   to note element values that have been shortened to better fit page
   boundaries.  Indentation and white space in examples is provided only
   to illustrate element relationships and is not a mandatory feature of
   this protocol.

   XML is case sensitive.  Unless stated otherwise, XML specifications
   and examples provided in this document MUST be interpreted in the
   character case presented in order to develop a conforming
   implementation.


2.  Object Attributes

   This extension adds additional elements to the EPP domain name
   mapping [2].  Only new element descriptions are described here.





Gould & Hollenbeck        Expires July 5, 2010                  [Page 4]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


2.1.  Delegation Signer Information

   Delegation signer (DS) information is published by a DNS server to
   indicate that a child zone is digitally signed and that the parent
   zone recognizes the indicated key as a valid zone key for the child
   zone.  A DS resource record (RR) contains four fields: a key tag
   field, a key algorithm number octet, an octet identifying a digest
   algorithm, and a digest field.  See RFC 4034 [6] for specific field
   formats.

2.1.1.  Public Key Information

   Public key information provided by a client maps to the DNSKEY RR
   presentation field formats described in section 2.2 of RFC 4034 [6].
   A DNSKEY RR contains four fields: flags, a protocol octet, an
   algorithm number octet, and a public key.

2.2.  Booleans

   Boolean values MUST be represented in the XML Schema format described
   in Part 2 of the W3C XML Schema recommendation [5].

2.3.  Maximum Signature Lifetime Values

   Maximum signature lifetime values MUST be represented in seconds
   using an extended XML Schema "int" format.  The base "int" format,
   which allows negative numbers, is described in Part 2 of the W3C XML
   Schema recommendation [5].  This format is further restricted to
   enforce a minimum value of one.


3.  DS Data Interface and Key Data Interface

   This document describes operational scenarios in which a client can
   create, add, remove, and replace delegation signer (DS) information
   or key data information for a domain name.  There are two different
   interfaces that a server can support.  The first is called the "DS
   Data Interface," where the client is responsible for the creation of
   the DS information and is required to pass DS information when
   performing adds, removes, and replaces.  The server is required to
   pass DS information for info responses.  The second is the "Key Data
   Interface," where the client is responsible for passing the key data
   information when performing adds, removes, and replaces.  The server
   is responsible to pass key data information for info responses.  The
   server MUST support use of one specification form consistently.






Gould & Hollenbeck        Expires July 5, 2010                  [Page 5]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


3.1.  DS Data Interface

   The DS Data Interface relies uses the <secDNS:dsData> element for
   creates, adds, removes, and replaces, as well as for info responses.
   The key data associated with the DS information MAY be provided by
   the client, but the server is not obligated to use the key data.  The
   server operator MAY also issue out-of-band DNS queries to retrieve
   the key data from the registered domain's apex in order to evaluate
   the received DS information.  It is RECOMMENDED that the child zone
   operator have this key data online in the DNS tree to allow the
   parent zone administrator to validate the data as necessary.  The key
   data SHOULD have the Secure Entry Point (SEP) bit set as described in
   RFC 3757 [9].

   The <secDNS:dsData> element contains the following child elements:


      A <secDNS:keyTag> element that contains a key tag value as
      described in section 5.1.1 of RFC 4034 [6].

      A <secDNS:alg> element that contains an algorithm value as
      described in section 5.1.2 of RFC 4034 [6].

      A <secDNS:digestType> element that contains a digest type value as
      described in section 5.1.3 of RFC 4034 [6].

      A <secDNS:digest> element that contains a digest value as
      described in section 5.1.4 of RFC 4034 [6].

      An OPTIONAL <secDNS:maxSigLife> element that indicates a child's
      preference for the number of seconds after signature generation
      when the parent's signature on the DS information provided by the
      child will expire.  A client SHOULD specify the same <secDNS:
      maxSigLife> value for all <secDNS:dsData> elements associated with
      a domain.  If the <secDNS:maxSigLife> is not present, or if
      multiple <secDNS:maxSigLife> values are requested, the default
      signature expiration policy of the server operator (as determined
      using an out-of-band mechanism) applies.

      An OPTIONAL <secDNS:keyData> element that describes the key data
      used as input in the DS hash calculation for use in server
      validation.  The <secDNS:keyData> element contains the following
      child elements defined in Section 3.2.  The use of the <secDNS:
      maxSigLife> child element of <secDNS:keyData> MUST NOT be used for
      servers supporting the DS Data Interface.






Gould & Hollenbeck        Expires July 5, 2010                  [Page 6]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


3.2.  Key Data Interface

   The Key Data Interface relies on the use of the <secDNS:keyData>
   element for creates, adds, removes, and replaces, as well as for info
   responses.  The DS information is not provided by the client but is
   generated by the server.  The attributes used for DS generation is
   based on server policy, where only key data is passed between the
   client and the server.

   The <secDNS:keyData> element contains the following child elements:


      A <secDNS:flags> element that contains a flags field value as
      described in section 2.1.1 of RFC 4034 [6].

      A <secDNS:protocol> element that contains a protocol field value
      as described in section 2.1.2 of RFC 4034 [6].

      A <secDNS:alg> element that contains an algorithm number field
      value as described in sections 2.1.3 of RFC 4034 [6].

      A <secDNS:pubKey> element that contains an encoded public key
      field value as described in sections 2.1.4 of RFC 4034 [6].

      An OPTIONAL <secDNS:maxSigLife> element that indicates a child's
      preference for the number of seconds after signature generation
      when the parent's signature on the DS information provided by the
      child will expire.  A client SHOULD specify the same <secDNS:
      maxSigLife> value for all <secDNS:dsData> elements associated with
      a domain.  If the <secDNS:maxSigLife> is not present, or if
      multiple <secDNS:maxSigLife> values are requested, the default
      signature expiration policy of the server operator (as determined
      using an out-of-band mechanism) applies.


3.3.  Example DS Data Interface and Key Data Interface

   Example use of DS Data Interface for a create:



   <secDNS:dsData>
     <secDNS:keyTag>12345</secDNS:keyTag>
     <secDNS:alg>3</secDNS:alg>
     <secDNS:digestType>1</secDNS:digestType>
     <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   </secDNS:dsData>




Gould & Hollenbeck        Expires July 5, 2010                  [Page 7]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example use of DS Data Interface with option key data for a create:



   <secDNS:dsData>
     <secDNS:keyTag>12345</secDNS:keyTag>
     <secDNS:alg>3</secDNS:alg>
     <secDNS:digestType>1</secDNS:digestType>
     <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
     <secDNS:keyData>
       <secDNS:flags>256</secDNS:flags>
       <secDNS:protocol>3</secDNS:protocol>
       <secDNS:alg>1</secDNS:alg>
       <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
     </secDNS:keyData>
    </secDNS:dsData>

   Example use of Key Data Interface for a create:



    <secDNS:keyData>
      <secDNS:flags>256</secDNS:flags>
      <secDNS:protocol>3</secDNS:protocol>
      <secDNS:alg>1</secDNS:alg>
      <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
    </secDNS:keyData>


4.  EPP Command Mapping

   A detailed description of the EPP syntax and semantics can be found
   in the EPP core protocol specification [1].  The command mappings
   described here are specifically for use in provisioning and managing
   DNS security extensions via EPP.

4.1.  EPP Query Commands

   EPP provides three commands to retrieve object information: <check>
   to determine if an object is known to the server, <info> to retrieve
   detailed information associated with an object, and <transfer> to
   retrieve object transfer status information.

4.1.1.  EPP <check> Command

   This extension does not add any elements to the EPP <check> command
   or <check> response described in the EPP domain mapping [2].




Gould & Hollenbeck        Expires July 5, 2010                  [Page 8]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


4.1.2.  EPP <info> Command

   This extension does not add any elements to the EPP <info> command
   described in the EPP domain mapping [2].  However, additional
   elements are defined for the <info> response.

   When an <info> command has been processed successfully, the EPP
   <resData> element MUST contain child elements as described in the EPP
   domain mapping [2].  In addition, the EPP <extension> element SHOULD
   contain a child <secDNS:infData> element that identifies the
   extension namespace if the domain object has data associated with
   this extension and based on server policy.  The <secDNS:infData>
   element contains the following child elements:


      One or more <secDNS:dsData> elements that describe the delegation
      signer data provided by the client for the domain or one or more
      <secDNS:keyData> elements that describe the key data provided by
      the client for the domain.  Child elements of the <secDNS:dsData>
      element are described in Section 3.1.  Child elements of the
      <secDNS:keyData> are described in Section 3.2.

   Example <info> Response for a Secure Delegation
                 using the DS Data Interface:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="ok"/>
   S:        <domain:registrant>jd1234</domain:registrant>
   S:        <domain:contact type="admin">sh8013</domain:contact>
   S:        <domain:contact type="tech">sh8013</domain:contact>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns2.example.com</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>



Gould & Hollenbeck        Expires July 5, 2010                  [Page 9]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
   S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <secDNS:infData
   S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   S:        <secDNS:dsData>
   S:          <secDNS:keyTag>12345</secDNS:keyTag>
   S:          <secDNS:alg>3</secDNS:alg>
   S:          <secDNS:digestType>1</secDNS:digestType>
   S:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   S:        </secDNS:dsData>
   S:      </secDNS:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   Example <info> Response for a Secure Delegation
                 using the DS Data Interface with OPTIONAL Key Data:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="ok"/>
   S:        <domain:registrant>jd1234</domain:registrant>
   S:        <domain:contact type="admin">sh8013</domain:contact>
   S:        <domain:contact type="tech">sh8013</domain:contact>



Gould & Hollenbeck        Expires July 5, 2010                 [Page 10]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns2.example.com</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
   S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <secDNS:infData
   S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   S:        <secDNS:dsData>
   S:          <secDNS:keyTag>12345</secDNS:keyTag>
   S:          <secDNS:alg>3</secDNS:alg>
   S:          <secDNS:digestType>1</secDNS:digestType>
   S:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   S:          <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   S:          <secDNS:keyData>
   S:            <secDNS:flags>256</secDNS:flags>
   S:            <secDNS:protocol>3</secDNS:protocol>
   S:            <secDNS:alg>1</secDNS:alg>
   S:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   S:          </secDNS:keyData>
   S:        </secDNS:dsData>
   S:      </secDNS:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   Example <info> Response for a Secure Delegation
                 using the Key Data Interface:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"



Gould & Hollenbeck        Expires July 5, 2010                 [Page 11]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="ok"/>
   S:        <domain:registrant>jd1234</domain:registrant>
   S:        <domain:contact type="admin">sh8013</domain:contact>
   S:        <domain:contact type="tech">sh8013</domain:contact>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns2.example.com</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
   S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <secDNS:infData
   S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   S:        <secDNS:keyData>
   S:          <secDNS:flags>256</secDNS:flags>
   S:          <secDNS:protocol>3</secDNS:protocol>
   S:          <secDNS:alg>1</secDNS:alg>
   S:          <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   S:        </secDNS:keyData>
   S:      </secDNS:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>



Gould & Hollenbeck        Expires July 5, 2010                 [Page 12]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   S:</epp>

   An EPP error response MUST be returned if an <info> command can not
   be processed for any reason.

4.1.3.  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer>
   command or <transfer> response described in the EPP domain mapping
   [2].

4.2.  EPP Transform Commands

   EPP provides five commands to transform objects: <create> to create
   an instance of an object, <delete> to delete an instance of an
   object, <renew> to extend the validity period of an object,
   <transfer> to manage object sponsorship changes, and <update> to
   change information associated with an object.

4.2.1.  EPP <create> Command

   This extension defines additional elements for the EPP <create>
   command described in the EPP domain mapping [2].  No additional
   elements are defined for the EPP <create> response.

   The EPP <create> command provides a transform operation that allows a
   client to create a domain object.  In addition to the EPP command
   elements described in the EPP domain mapping [2], the command MUST
   contain an <extension> element.  The <extension> element MUST contain
   a child <secDNS:create> element that identifies the extension
   namespace if the client wants to associate data defined in this
   extension to the domain object.  The <secDNS:create> element MUST
   contain one or more <secDNS:dsData> elements or <secDNS:keyData>
   elements.  Child elements of the <secDNS:dsData> element are
   described in Section 3.1.  Child elements of the <secDNS:keyData> are
   described in Section 3.2.

   The <secDNS:dsData> element and the <secDNS:keyData> element contains
   an OPTIONAL <secDNS:maxSigLife> element.  The server MUST abort
   command processing and respond with an appropriate EPP error if the
   values provided by the client can not be accepted for syntax or
   policy reasons.









Gould & Hollenbeck        Expires July 5, 2010                 [Page 13]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <create> Command for a Secure Delegation
                 using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          <domain:hostObj>ns2.example.com</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:registrant>jd1234</domain:registrant>
   C:        <domain:contact type="admin">sh8013</domain:contact>
   C:        <domain:contact type="tech">sh8013</domain:contact>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <secDNS:create
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:dsData>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:          <secDNS:alg>3</secDNS:alg>
   C:          <secDNS:digestType>1</secDNS:digestType>
   C:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:          <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:        </secDNS:dsData>
   C:      </secDNS:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>












Gould & Hollenbeck        Expires July 5, 2010                 [Page 14]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <create> Command for a Secure Delegation
                 using the DS Data Interface with OPTIONAL key data:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          <domain:hostObj>ns2.example.com</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:registrant>jd1234</domain:registrant>
   C:        <domain:contact type="admin">sh8013</domain:contact>
   C:        <domain:contact type="tech">sh8013</domain:contact>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <secDNS:create
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:dsData>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:          <secDNS:alg>3</secDNS:alg>
   C:          <secDNS:digestType>1</secDNS:digestType>
   C:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:          <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:          </secDNS:keyData>
   C:        </secDNS:dsData>
   C:      </secDNS:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>






Gould & Hollenbeck        Expires July 5, 2010                 [Page 15]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <create> Command for a Secure Delegation
                 using the Key Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          <domain:hostObj>ns2.example.com</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:registrant>jd1234</domain:registrant>
   C:        <domain:contact type="admin">sh8013</domain:contact>
   C:        <domain:contact type="tech">sh8013</domain:contact>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <secDNS:create
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:keyData>
   C:          <secDNS:flags>256</secDNS:flags>
   C:          <secDNS:protocol>3</secDNS:protocol>
   C:          <secDNS:alg>1</secDNS:alg>
   C:          <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:        </secDNS:keyData>
   C:      </secDNS:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   When a <create> command has been processed successfully, the EPP
   response is as described in the EPP domain mapping [2].

4.2.2.  EPP <delete> Command

   This extension does not add any elements to the EPP <delete> command
   or <delete> response described in the EPP domain mapping [2].





Gould & Hollenbeck        Expires July 5, 2010                 [Page 16]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


4.2.3.  EPP <renew> Command

   This extension does not add any elements to the EPP <renew> command
   or <renew> response described in the EPP domain mapping [2].

4.2.4.  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer>
   command or <transfer> response described in the EPP domain mapping
   [2].

4.2.5.  EPP <update> Command

   This extension defines additional elements for the EPP <update>
   command described in the EPP domain mapping [2].  No additional
   elements are defined for the EPP <update> response.

   The EPP <update> command provides a transform operation that allows a
   client to modify the attributes of a domain object.  In addition to
   the EPP command elements described in the EPP domain mapping, the
   command MUST contain an <extension> element.  The <extension> element
   MUST contain a child <secDNS:update> element that identifies the
   extension namespace if the client wants to update the domain object
   with data defined in this extension.  The <secDNS:update> element
   contains a <secDNS:add> element to add security information to a
   delegation, a <secDNS:rem> element to remove security information
   from a delegation, or a <secDNS:chg> element to replace all security
   information with new security information.  The <secDNS:add> and
   <secDNS:rem> can be used together to add and remove security
   information at the same time. <secDNS:chg> can not be used with
   either <secDNS:add> or <secDNS:rem>

   The <secDNS:update> element also contains an OPTIONAL "urgent"
   attribute that a client can use to ask the server operator to
   complete and implement the update request with high priority.  This
   attribute accepts boolean values as described in Section 2.2; the
   default value is boolean false.  "High priority" is relative to
   standard server operator policies that are determined using an out-
   of-band mechanism.

   The <secDNS:add> element is used to add security information to an
   existing set.  The <secDNS:add> element MUST contain one or more
   <secDNS:dsData> or <secDNS:keyData> elements.  Child elements of the
   <secDNS:dsData> element are described in Section 3.1.  Child elements
   of the <secDNS:keyData> are described in Section 3.2.

   The <secDNS:dsData> element and the <secDNS:keyData> element contains
   an OPTIONAL <secDNS:maxSigLife> element.



Gould & Hollenbeck        Expires July 5, 2010                 [Page 17]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   The <secDNS:rem> element contains one or more <secDNS:keyTag>,
   <secDNS:dsData>, or <secDNS:keyData> elements that are used to remove
   security data from a delegation. <secDNS:keyTag> and <secDNS:dsData>
   are part of the DS Data Interface and <secDNS:keyData> is part of the
   Key Data Interface.

   <secDNS:keyTag> element MUST contain a key tag value as described in
   section 5.1.1 of RFC 4034 [6].  Removing all DS information can
   remove the ability of the parent to secure the delegation to the
   child zone.  The server SHOULD return an EPP error result code of
   2305 if more then one DS record matches the <secDNS:keyTag>. <secDNS:
   dsData> should be used by the client if there is more then one DS
   record with the same <secDNS:keyTag>.

   <secDNS:dsData> element is used to uniquely define the DS record to
   remove by using all four elements <secDNS:keyTag>, <secDNS:alg>,
   <secDNS:digestType>, and <secDNS:digest> that is guaranteed to be
   unique.

   <secDNS:keyData> element is used to uniquely define the key data to
   remove by using all four elements <secDNS:flags>, <secDNS:protocol>,
   <secDNS:alg>, and <secDNS:pubKey>; that is guaranteed to be unique.
   There can be more then one DS record created for each key, so
   removing a key could remove more then one DS record.

   The <secDNS:chg> element is used to replace all existing security
   information with new security information.  The <secDNS:chg> element
   MUST contain zero or more <secDNS:dsData> or <secDNS:keyData>
   elements.  Child elements of the <secDNS:dsData> element are
   described in Section 3.1.  Child elements of the <secDNS:keyData> are
   described in Section 3.2 The data in these elements is used to
   replace whatever other data is currently archived for the delegation.

   The <secDNS:update> element contains an OPTIONAL "urgent" attribute.
   The <secDNS:dsData> element contains OPTIONAL <secDNS:maxSigLife> and
   <secDNS:keyData> elements.  In addition the <secDNS:keyData> element
   contains an OPTIONAL <secDNS:maxSigLife> element.  The server MUST
   abort command processing and respond with an appropriate EPP error if
   the values provided by the client can not be accepted for syntax or
   policy reasons.

   If the OPTIONAL <secDNS:maxSigLife> is supported by the server, the
   server SHOULD support the <secDNS:add> and <secDNS:rem> of the same
   <secDNS:dsData> or <secDNS:keyData> for the client to change the
   <secDNS:maxSigLife>.  The new <secDNS:maxSigLife> value is included
   in the <secDNS:dsData> or <secDNS:keyData> elements of the <secDNS:
   add>.




Gould & Hollenbeck        Expires July 5, 2010                 [Page 18]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Adding and Removing DS
                 Data using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:add>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12346</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
   C:          </secDNS:dsData>
   C:        </secDNS:add>
   C:        <secDNS:rem>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>



















Gould & Hollenbeck        Expires July 5, 2010                 [Page 19]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command,
                 Adding and Removing DS Data using the DS Data Interface
                 to update the <secDNS:maxSigLife>:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:add>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12346</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
   C:            <secDNS:maxSigLife>605900</secDNS:maxSigLife>
   C:          </secDNS:dsData>
   C:        </secDNS:add>
   C:        <secDNS:rem>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12346</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
   C:          </secDNS:dsData>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>












Gould & Hollenbeck        Expires July 5, 2010                 [Page 20]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Adding and Removing Key
                 Data using the Key Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:add>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:            <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:          </secDNS:keyData>
   C:        </secDNS:add>
   C:        <secDNS:rem>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>APPJ////1R==</secDNS:pubKey>
   C:            <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:          </secDNS:keyData>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>












Gould & Hollenbeck        Expires July 5, 2010                 [Page 21]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Removing DS Data with
                  <secDNS:dsData> using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:rem>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12346</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
   C:          </secDNS:dsData>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>






















Gould & Hollenbeck        Expires July 5, 2010                 [Page 22]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Removing DS Data with
                  <secDNS:keyTag> using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:rem>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:          <secDNS:keyTag>12346</secDNS:keyTag>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example <update> Command,
                 Removing all DS or Key Data using <secDNS:chg/>:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update urgent="1"
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:chg/>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>



Gould & Hollenbeck        Expires July 5, 2010                 [Page 23]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example Urgent <update> Command,
                 Changing DS Data using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update urgent="1"
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:chg>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12345</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:          </secDNS:dsData>
   C:        </secDNS:chg>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>






















Gould & Hollenbeck        Expires July 5, 2010                 [Page 24]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Changing DS Data with
                 OPTIONAL Key Data using the DS Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:chg>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12345</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:            <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:            <secDNS:keyData>
   C:              <secDNS:flags>256</secDNS:flags>
   C:              <secDNS:protocol>3</secDNS:protocol>
   C:              <secDNS:alg>1</secDNS:alg>
   C:              <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:            </secDNS:keyData>
   C:          </secDNS:dsData>
   C:        </secDNS:chg>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>















Gould & Hollenbeck        Expires July 5, 2010                 [Page 25]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Example <update> Command, Changing Key Data using
                 the Key Data Interface:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0">
   C:        <secDNS:chg>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:            <secDNS:maxSigLife>604800</secDNS:maxSigLife>
   C:          </secDNS:keyData>
   C:        </secDNS:chg>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   When an extended <update> command has been processed successfully,
   the EPP response is as described in the EPP domain mapping [2].  A
   server operator MUST return an EPP error result code of 2306 if an
   urgent update (noted with an "urgent" attribute value of boolean
   true) can not be completed with high priority.


5.  Formal Syntax

   An EPP object mapping is specified in XML Schema notation.  The
   formal syntax presented here is a complete schema representation of
   the object mapping suitable for automated validation of EPP XML
   instances.  The BEGIN and END tags are not part of the schema; they
   are used to note the beginning and ending of the schema for URI
   registration purposes.

   Copyright (c) 2009 IETF Trust and the persons identified as authors



Gould & Hollenbeck        Expires July 5, 2010                 [Page 26]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   of the code.  All rights reserved.

   Redistribution and use in source and binary forms, with or without
   modification, are permitted provided that the following conditions
   are met:

   o  Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
   o  Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in
      the documentation and/or other materials provided with the
      distribution.
   o  Neither the name of Internet Society, IETF or IETF Trust, nor the
      names of specific contributors, may be used to endorse or promote
      products derived from this software without specific prior written
      permission.

   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


   BEGIN
   <?xml version="1.0" encoding="UTF-8"?>
   <schema
     targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
     xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
     xmlns="http://www.w3.org/2001/XMLSchema"
     elementFormDefault="qualified">

     <annotation>
       <documentation>
         Extensible Provisioning Protocol v1.0
         domain name extension schema
         for provisioning DNS security (DNSSEC) extensions.
       </documentation>
     </annotation>

     <!-- Child elements found in EPP commands.  -->
     <element name="create" type="secDNS:dsOrKeyType"/>



Gould & Hollenbeck        Expires July 5, 2010                 [Page 27]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


     <element name="update" type="secDNS:updateType"/>

     <!-- Child elements supporting either
     the dsData or the keyData interface.  -->
     <complexType name="dsOrKeyType">
       <choice>
         <element name="dsData" type="secDNS:dsDataType"
         maxOccurs="unbounded"/>
         <element name="keyData" type="secDNS:keyDataType"
         maxOccurs="unbounded"/>
       </choice>
     </complexType>

     <!-- Child elements supporting the
     chg element.  -->
     <complexType name="chgType">
       <choice minOccurs="0">
         <element name="dsData" type="secDNS:dsDataType"
         maxOccurs="unbounded"/>
         <element name="keyData" type="secDNS:keyDataType"
         maxOccurs="unbounded"/>
       </choice>
     </complexType>


     <!-- Definition for the maximum
     signature life (maxSigLife) -->
     <simpleType name="maxSigLifeType">
       <restriction base="int">
         <minInclusive value="1"/>
       </restriction>
     </simpleType>


     <!-- Child elements of dsData used for
     dsData interface -->
     <complexType name="dsDataType">
       <sequence>
         <element name="keyTag" type="unsignedShort"/>
         <element name="alg" type="unsignedByte"/>
         <element name="digestType" type="unsignedByte"/>
         <element name="digest" type="hexBinary"/>
         <element name="maxSigLife" type="secDNS:maxSigLifeType"
         minOccurs="0"/>
         <element name="keyData" type="secDNS:keyDataType"
         minOccurs="0"/>
       </sequence>
     </complexType>



Gould & Hollenbeck        Expires July 5, 2010                 [Page 28]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


     <!-- Child elements of keyData used for keyData interface
     and optionally with dsData interface -->
     <complexType name="keyDataType">
       <sequence>
         <element name="flags" type="unsignedShort"/>
         <element name="protocol" type="unsignedByte"/>
         <element name="alg" type="unsignedByte"/>
         <element name="pubKey" type="secDNS:keyType"/>
         <element name="maxSigLife" type="secDNS:maxSigLifeType"
         minOccurs="0"/>
       </sequence>
     </complexType>

     <!-- Definition for the public key   -->
     <simpleType name="keyType">
       <restriction base="base64Binary">
         <minLength value="1"/>
       </restriction>
     </simpleType>

     <!-- Child elements of the <update> command.  -->
     <complexType name="updateType">
           <choice>
             <element name="chg" type="secDNS:chgType"/>
             <sequence>
               <element name="add" type="secDNS:dsOrKeyType"
               minOccurs="0"/>
               <element name="rem" type="secDNS:remType"
               minOccurs="0"/>
             </sequence>
           </choice>
       <attribute name="urgent" type="boolean" default="false"/>
     </complexType>


     <!-- Child elements of the <rem> command.  -->
     <complexType name="remType">
           <choice>
             <element name="keyTag" type="unsignedShort"
             maxOccurs="unbounded"/>
             <element name="dsData" type="secDNS:dsDataType"
             maxOccurs="unbounded"/>
             <element name="keyData" type="secDNS:keyDataType"
             maxOccurs="unbounded"/>
           </choice>
     </complexType>





Gould & Hollenbeck        Expires July 5, 2010                 [Page 29]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


     <!-- Child response elements.  -->
     <element name="infData" type="secDNS:dsOrKeyType"/>

   <!--
   End of schema.
   -->
   </schema>
   END


6.  Internationalization Considerations

   EPP is represented in XML, which provides native support for encoding
   information using the Unicode character set and its more compact
   representations including UTF-8 [14].  Conformant XML processors
   recognize both UTF-8 and UTF-16 [15].  Though XML includes provisions
   to identify and use other character encodings through use of an
   "encoding" attribute in an <?xml?> declaration, use of UTF-8 is
   RECOMMENDED in environments where parser encoding support
   incompatibility exists.

   As an extension of the EPP domain mapping [2], the elements, element
   content, attributes, and attribute values described in this document
   MUST inherit the internationalization conventions used to represent
   higher-layer domain and core protocol structures present in an XML
   instance that includes this extension.


7.  IANA Considerations

   This document uses URNs to describe XML namespaces and XML schemas
   conforming to a registry mechanism described in RFC 3688 [10].  Two
   URI assignments have been completed by the IANA.

   Registration request for the extension namespace:

   URI: urn:ietf:params:xml:ns:secDNS-1.0

   Registrant Contact: IESG

   XML: None.  Namespace URIs do not represent an XML specification.

   Registration request for the extension XML schema:

   URI: urn:ietf:params:xml:schema:secDNS-1.0

   Registrant Contact: IESG




Gould & Hollenbeck        Expires July 5, 2010                 [Page 30]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   XML: See the "Formal Syntax" section of this document.


8.  Security Considerations

   The mapping extensions described in this document do not provide any
   security services beyond those described by EPP [1], the EPP domain
   name mapping [2], and protocol layers used by EPP.  The security
   considerations described in these other specifications apply to this
   specification as well.

   As with other domain object transforms, the EPP transform operations
   described in this document MUST be restricted to the sponsoring
   client as authenticated using the mechanisms described in sections
   2.9.1.1 and 7 of RFC 5730 [1].  Any attempt to perform a transform
   operation on a domain object by any client other than the sponsoring
   client MUST be rejected with an appropriate EPP authorization error.

   The provisioning service described in this document involves the
   exchange of information that can have an operational impact on the
   DNS.  A trust relationship MUST exist between the EPP client and
   server, and provisioning of public key information MUST only be done
   after the identities of both parties have been confirmed using a
   strong authentication mechanism.

   An EPP client might be acting as an agent for a zone administrator
   who wants to send delegation information to be signed and published
   by the server operator.  Man-in-the-middle attacks are thus possible
   as a result of direct client activity or inadvertent client data
   manipulation.

   Acceptance of a false key by a server operator can produce
   significant operational consequences.  The child and parent zones
   MUST be consistent to secure the delegation properly.  In the absence
   of consistent signatures, the delegation will not appear in the
   secure name space, yielding untrustworthy query responses.  If a key
   is compromised, a client can either remove the compromised
   information or update the delegation information via EPP commands
   using the "urgent" attribute.

   Operational scenarios requiring quick removal of a secure domain
   delegation can be implemented using a two-step process.  First,
   security credentials can be removed using an "urgent" update as just
   described.  The domain can then be removed from the parent zone by
   changing the status of the domain to either of the EPP "clientHold"
   or "serverHold" domain status values.  The domain can also be removed
   from the zone using the EPP <delete> command, but this is a more
   drastic step that needs to be considered carefully before use.



Gould & Hollenbeck        Expires July 5, 2010                 [Page 31]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   Data validity checking at the server requires computational
   resources.  A purposeful or inadvertent denial-of-service attack is
   possible if a client requests some number of update operations that
   exceed a server's processing capabilities.  Server operators SHOULD
   take steps to manage command load and command processing requirements
   to minimize the risk of a denial-of-service attack.

   The signature lifetime values provided by clients are requests that
   can be rejected.  Blind acceptance by a server operator can have an
   adverse impact on a server's processing capabilities.  Server
   operators SHOULD seriously consider adopting implementation rules to
   limit the range of acceptable signature lifetime values to counter
   potential adverse situations.


9.  Acknowledgements

   The author would like to thank the following people who have provided
   significant contributions to the development of this document:

   David Blacka, Howard Eland, Patrik Faltstrom, Ed Lewis, Klaus
   Malorny, Patrick Mevzek, David Smith, Andrew Sullivan, Srikanth
   Veeramachaneni.


10.  References

10.1.  Normative References

   [1]   Hollenbeck, S., "Extensible Provisioning Protocol (EPP)",
         STD 69, RFC 5730, August 2009.

   [2]   Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain
         Name Mapping", STD 69, RFC 5731, August 2009.

   [3]   Sperberg-McQueen, C., Paoli, J., Maler, E., and T. Bray,
         "Extensible Markup Language (XML) 1.0 (Second Edition)", World
         Wide Web Consortium FirstEdition REC-xml-20001006,
         October 2000, <http://www.w3.org/TR/2000/REC-xml-20001006>.

   [4]   Mendelsohn, N., Thompson, H., Maloney, M., and D. Beech, "XML
         Schema Part 1: Structures", World Wide Web Consortium
         FirstEdition REC-xmlschema-1-20010502, May 2001,
         <http://www.w3.org/TR/2001/REC-xmlschema-1-20010502>.

   [5]   Malhotra, A. and P. Biron, "XML Schema Part 2: Datatypes",
         World Wide Web Consortium FirstEdition REC-xmlschema-2-
         20010502, May 2001,



Gould & Hollenbeck        Expires July 5, 2010                 [Page 32]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


         <http://www.w3.org/TR/2001/REC-xmlschema-2-20010502>.

   [6]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
         "Resource Records for the DNS Security Extensions", RFC 4034,
         March 2005.

   [7]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
         "Protocol Modifications for the DNS Security Extensions",
         RFC 4035, March 2005.

   [8]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
         Levels", BCP 14, RFC 2119, March 1997.

   [9]   Kolkman, O., Schlyter, J., and E. Lewis, "Domain Name System
         KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP)
         Flag", RFC 3757, April 2004.

   [10]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
         January 2004.

10.2.  Informative References

   [11]  Mockapetris, P., "Domain names - concepts and facilities",
         STD 13, RFC 1034, November 1987.

   [12]  Mockapetris, P., "Domain names - implementation and
         specification", STD 13, RFC 1035, November 1987.

   [13]  Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
         "DNS Security Introduction and Requirements", RFC 4033,
         March 2005.

   [14]  Yergeau, F., "UTF-8, a transformation format of ISO 10646",
         STD 63, RFC 3629, November 2003.

   [15]  Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646",
         RFC 2781, February 2000.

Appendix A.  Changes from RFC 4310

   1.   Added "This document incorporates feedback from early
        implementers on the PROVREG mail list and users." as well as
        "This document is intended to obsolete RFC 4310" in the Abstract
   2.   Removed all references to xsi:schemaLocation to be consistent
        with the other EPP RFCs.
   3.   Added "DS Data Interface and Key Data Interface" section.





Gould & Hollenbeck        Expires July 5, 2010                 [Page 33]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   4.   Moved the "create, add, remove, and replace delegation signer
        (DS) information" paragraph from the "Object Attributes" section
        to the "DS Data Interface" section.
   5.   Replaced the element descriptions in the "EPP <info> Command"
        section with a reference to the <secDNS:dsData> and <secDNS:
        keyData> elements described in the "DS Data Interface" and "Key
        Data Interface" sections, respectively.
   6.   Updated the "EPP <info> Command" section examples to include
        both the DS Data Interface and the Key Data Interface.
   7.   Updated the "EPP <create> Command" section to refer to both the
        use of <secDNS:dsData> and <secDNS:keyData> described in the "DS
        Data Interface" and "Key Data Interface" sections, respectively.
   8.   Updated the "EPP <create> Command" section to describe the use
        of <secDNS:maxSigLife> for both <secDNS:dsData> and <secDNS:
        keyData>.
   9.   Updated the "EPP <create> Command" section examples to include
        both the DS Data Interface and the Key Data Interface.
   10.  Updated the "EPP <update> Command" section to describe the use
        of <secDNS:add> and <secDNS:add> together but not with <secDNS:
        chg&gtl;.
   11.  Changed "<secDNS:chg> element to replace security information
        with new security information" to "<secDNS:chg> element to
        replace all security information with new security information"
        in the "EPP <update> Command" section.
   12.  Added that the server SHOULD return an EPP error result of 2305
        if more than one DS record matches" when using the <secDNS:
        keyTag> with a <secDNS:rem>.
   13.  Updated the "EPP <update> Command" section examples to include
        both the DS Data Interface and the Key Data Interface.  Also
        included additional examples of adding and removing DS data or
        key data.
   14.  Updated the "Formal Syntax" section with the updated XML schema.
   15.  Updated the Acknowledgements section with a new list of
        contributors.
   16.  Replaced references to RFC 3730 with references to RFC 5730.
   17.  Replaced references to RFC 3731 with references to RFC 5731.
   18.  Changed "The <secDNS:chg> element MUST contain one or more
        <secDNS:dsData>" to ""The <secDNS:chg> element MUST contain zero
        or more <secDNS:dsData>".
   19.  Added example of removing all DS or Key Data using <secDNS:
        chg/>.
   20.  Added the references to the <secDNS:keyData> elements <secDNS:
        flags>, <secDNS:protocol>, <secDNS:alg>, and <secDNS:pubKey>
        using the <secDNS:rem>.
   21.  Added paragraph in Section 4.2.5 in supporting the <secDNS:add>
        and <secDNS:rem> of the same <secDNS:dsData> or <secDNS:keyData>
        for updating the <secDNS:maxSigLife>.




Gould & Hollenbeck        Expires July 5, 2010                 [Page 34]

Internet-Draft     EPP DNS Security Extensions Mapping      January 2010


   22.  Added clarify on when the extension MUST be included for each of
        the commands and responds (<secDNS:create>, <secDNS:update>,
        <secDNS:infData>).
   23.  Changed "In addition, the EPP <extension> element MUST contain a
        child <secDNS:infData> element" to "In addition, the EPP
        <extension> element SHOULD contain a child <secDNS:infData>
        element" and added "and based on server policy".

Authors' Addresses

   James Gould
   VeriSign, Inc.
   21345 Ridgetop Circle
   Dulles, VA  20166-6503
   US

   EMail: jgould@verisign.com


   Scott Hollenbeck
   VeriSign, Inc.
   21345 Ridgetop Circle
   Dulles, VA  20166-6503
   US

   EMail: shollenbeck@verisign.com

























Gould & Hollenbeck        Expires July 5, 2010                 [Page 35]