Internet Engineering Task Force                            S. Hollenbeck
Internet-Draft                                            VeriSign, Inc.
June 12, 2002                                 Expires: December 12, 2002

    Extensible Provisioning Protocol DNS Security Extensions Mapping
                  <draft-hollenbeck-epp-secdns-01.txt>

Status of this Memo

  This document is an Internet-Draft and is in full conformance with all
  provisions of Section 10 of RFC2026.

  Internet-Drafts are working documents of the Internet Engineering Task
  Force (IETF), its areas, and its working groups.  Note that other
  groups may also distribute working documents as Internet-Drafts.

  Internet-Drafts are draft documents valid for a maximum of six months
  and may be updated, replaced, or obsoleted by other documents at any
  time.  It is inappropriate to use Internet-Drafts as reference
  material or to cite them other than as "work in progress".

  The list of current Internet-Drafts can be accessed at
  http://www.ietf.org/ietf/1id-abstracts.txt

  The list of Internet-Draft Shadow Directories can be accessed at
  http://www.ietf.org/shadow.html.

Abstract

  This document describes an Extensible Provisioning Protocol (EPP)
  extension mapping for the provisioning and management of DNS security
  extensions for domain names stored in a shared central repository.
  Specified in XML, this mapping extends the EPP domain name mapping to
  provide additional features required for the provisioning of DNS
  security extensions.

Conventions Used In This Document

  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
  "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
  document are to be interpreted as described in [RFC2119].

  In examples, "C:" represents lines sent by a protocol client and "S:"
  represents lines returned by a protocol server.  "////" is used to
  note element values that have been shortened to better fit page
  boundaries.  Indentation and white space in examples is provided only
  to illustrate element relationships and is not a REQUIRED feature of
  this protocol.



Hollenbeck             Expires December 12, 2002                [Page 1]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


Table of Contents

  1. Introduction .................................................    3
  1.1 Revisions From Previous Version .............................    3
  2. Object Attributes ............................................    4
  2.1 Public Key Information ......................................    4
  2.2 Signature Information .......................................    4
  2.3 Delegation Signer Information ...............................    5
  3. EPP Command Mapping ..........................................    6
  3.1 EPP Query Commands ..........................................    6
  3.1.1 EPP <check> Command .......................................    6
  3.1.2 EPP <info> Command ........................................    6
  3.1.3 EPP <transfer> Command ....................................   14
  3.2 EPP Transform Commands ......................................   14
  3.2.1 EPP <create> Command ......................................   14
  3.2.2 EPP <delete> Command ......................................   19
  3.2.3 EPP <renew> Command .......................................   19
  3.2.4 EPP <transfer> Command ....................................   20
  3.2.5 EPP <update> Command ......................................   20
  4. Formal Syntax ................................................   28
  5. Internationalization Considerations ..........................   33
  6. IANA Considerations ..........................................   33
  7. Security Considerations ......................................   34
  8. Acknowledgements .............................................   34
  9. References ...................................................   35
  10. Author's Address ............................................   36
  A. Full Copyright Statement .....................................   37
























Hollenbeck             Expires December 12, 2002                [Page 2]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


1. Introduction

  This document describes a DNS security extension mapping for version
  1.0 of the Extensible Provisioning Protocol (EPP, [EPP]).  This
  mapping, an extension of the domain name mapping described in [EPP-D],
  is specified using the Extensible Markup Language (XML) 1.0 described
  in [XML] and XML Schema notation as described in [XMLS-1] and [XMLS-
  2].

  [EPP] provides a complete description of EPP command and response
  structures.  A thorough understanding of the base protocol
  specification is necessary to understand the mapping described in this
  document.

  Familiarity with the Domain Name System (DNS) described in [RFC1034]
  and [RFC1035] and DNS security extensions described in [RFC2535],
  [RFC3008], and [RFC3090] is required to understand the DNS security
  concepts described in this document.

  The EPP mapping described in this document specifies a mechanism for
  the provisioning and management of DNS security extensions in a shared
  central repository.  Information exchanged via this mapping can be
  extracted from the repository and used to publish DNS resource records
  as described in [RFC2535], [DS], and [OPTIN].

  XML is case sensitive.  Unless stated otherwise, XML specifications
  and examples provided in this document MUST be interpreted in the
  character case presented to develop a conforming implementation.

1.1 Revisions From Previous Version

  (Note to RFC editor: please remove this section completely before
  publication as an RFC.)

  Minor editorial fixes throughout.

  Added descriptions for a client/child to provide DS RR information to
  be signed by the server/parent as a provisioning option.













Hollenbeck             Expires December 12, 2002                [Page 3]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


2. Object Attributes

  This extension adds additional elements to the domain name mapping
  described in [EPP-D].  Only new element descriptions are described
  here.

  This document describes update scenarios in which a client can create
  an initial key set, add new keys to a set, remove keys from a set, and
  replace an existing key set.  Key set replacement vs. adding and
  removing individual keys might be a matter of server policy or the
  subject of another document.  Insights into operational requirements
  are welcome.

2.1 Public Key Information

  Public key information is sent to the server so that the server can
  sign RRs published in a zone managed by the server operator using a
  zone-level key.  A server operator SHOULD NOT sign any key provided by
  a client without cryptographically confirming that the client
  possesses the private key associated with the public key.

  Clients can send information describing multiple keys to a server.
  Each key element MUST be accompanied by a corresponding signature
  element when adding keys to a set.

  Public key information provided by a client maps to the KEY RR fields
  described in [RFC2535].  A KEY RR contains four fields: flags, a
  protocol octet, an algorithm number octet, and a public key.  See
  [RFC2535] for specific field formats.

2.2 Signature Information

  Signature information is sent to the server to prove that the client
  (or an entity for whom the client is acting as agent) has the private
  key corresponding to the public key and that the key has not been
  modified while in transit.  It allows the server to do basic error
  checking as part of the provisioning process.

  Clients can send information describing multiple signatures to a
  server.  Each signature element MUST correspond to a key element when
  adding keys to a set.  The signature value in each signature element
  MUST cover all of the keys in the given set.

  Signature information provided by a client maps to the SIG RR fields
  described in [RFC2535].  A SIG RR contains nine fields: a "type
  covered" field, an algorithm number octet, a labels octet, an original
  TTL field, a signature expiration field, a signature inception field,
  a key tag field, a signer's name field, and a signature field. See



Hollenbeck             Expires December 12, 2002                [Page 4]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  [RFC2535] for specific field formats.

2.3 Delegation Signer Information

  Delegation signer (DS) information is published by the server to
  indicate that a delegated zone is digitally signed and that the
  delegation zone recognizes the indicated key as a valid zone key for
  the delegated zone.  A DS RR contains four fields: a key tag field, a
  KEY algorithm number octet, an octet identifying the digest algorithm
  used, and a digest field.  See [DS] for specific field formats.

  This document describes multiple DS provisioning mechanisms.  The
  RECOMMENDED mechanism is one in which the information needed to
  publish DS RRs is derived by the server from key and signature
  information provided by the client.  This provisioning mechanism
  minimizes client complexity and ensures that there is no DS version
  conflict between the client and server, minimizing or eliminating
  client-server DS errors.

  It is worth noting, though, that there are other DS provisioning
  options.  One option that is supported in this specification is for
  the client to generate and send only DS information to the server.
  This option is the simplest for the server to implement, though more
  complex for the client because the client is responsible for
  generating the DS information.  The server has no means of detecting
  errors in the data provided by the client prior to publishing the DS
  information.  Another option that is not supported in this
  specification is for the client to send DS information, KEY
  information, and SIG(DS) information to the server.  This option is
  verbose and does nothing to reduce the client-server error rate, but
  it does provide the server with enough information to detect DS errors
  before they appear in a zone.



















Hollenbeck             Expires December 12, 2002                [Page 5]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


3. EPP Command Mapping

  A detailed description of the EPP syntax and semantics can be found in
  [EPP].  The command mappings described here are specifically for use
  in provisioning and managing DNS security extensions via EPP.

3.1 EPP Query Commands

  EPP provides three commands to retrieve object information: <check> to
  determine if an object can be provisioned, <info> to retrieve detailed
  information associated with an object, and <transfer> to retrieve
  object transfer status information.

3.1.1 EPP <check> Command

  This extension does not add any elements to the EPP <check> command or
  <check> response described in [EPP-D].

3.1.2 EPP <info> Command

  This extension does not add any elements to the EPP <info> command
  described in [EPP-D].  Additional elements are defined for the <info>
  response.

  When an <info> command has been processed successfully, the EPP
  <resData> element MUST contain child elements as described in [EPP-D].
  In addition, the EPP <extension> element MUST contain a child
  <secDNS:infData> element that identifies the secDNS namespace and the
  location of the secDNS schema.  The <secDNS:infData> element contains
  the following child elements:

  - A <secDNS:status> element that describes extension status for the
  domain.  This element contains an attribute named "s" whose value is
  either "secure" or "insecure".  Domains that have been provisioned
  with security extensions are represented with "secure" status. Domains
  that have not been provisioned with security extensions are
  represented with "insecure" status.

  The <secDNS:status> element is followed by either a <secDNS:insecure>
  element, a <secDNS:keyData> element, or a <secDNS:dsData> element
  depending on the status of the delegation.  A <secDNS:keyData> element
  or a <secDNS:dsData> element MUST be present if the status of the
  delegation is "secure".  A <secDNS:insecure> element MUST be present
  if the status of the delegation is "insecure".

  The <secDNS:insecure> element contains no child elements.  It does
  contain a REQUIRED "nxt" attribute that notes if the delegation is
  included in the parent zone's chain of NXT records.  A value of "1" or



Hollenbeck             Expires December 12, 2002                [Page 6]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  "true" indicates that the delegation is insecure, but is included in
  the parent zone's chain of NXT records.  A value of "0" or "false"
  indicates that the delegation is insecure and is not included in the
  parent zone's chain of NXT records.

  The <secDNS:keyData> element contains a subset of the public key
  information originally provided by the client for a secured
  delegation.  Each <secDNS:keyData> element contains a <secDNS:key>
  element, an OPTIONAL <secDNS:startDate> element, and an OPTIONAL
  <secDNS:endDate> element.  The <secDNS:startDate> and <secDNS:endDate>
  elements indicate a client's preferences for the start and end date of
  DNS security extension resource record publication in the zone
  administered by the server operator.  The <secDNS:key> element
  contains the following child elements:

    - A <secDNS:flags> element that contains a flags field value as
    described in [RFC2535] sections 3.1 and 3.1.2.

    - A <secDNS:protocol> element that contains a protocol field value
    as described in [RFC2535] sections 3.1 and 3.1.3.

    - A <secDNS:alg> element that contains an algorithm number field
    value as described in [RFC2535] sections 3.1 and 3.2.

    - An OPTIONAL <secDNS:pubKey> element that contains an encoded
    public key field value as described in [RFC2535] section 3.1.  The
    format of the public key is algorithm dependent.  This value will be
    provided only if server policy supports retention of client-provided
    keys.

  The <secDNS:dsData> element contains delegation signer information
  originally provided by the client for a secured delegation.  If
  present, the <secDNS:dsData> element contains the following child
  elements:

    - A <secDNS:keyTag> element that contains a key tag value as
    described in [DS] section 2.4.

    - A <secDNS:alg> element that contains an algorithm value as
    described in [DS] section 2.4.

    - A <secDNS:digestType> element that contains a digest type value as
    described in [DS] section 2.4.

    - A <secDNS:digest> element that contains a digest value as
    described in [DS] section 2.4.

    - An OPTIONAL <secDNS:startDate> element and an OPTIONAL



Hollenbeck             Expires December 12, 2002                [Page 7]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


    <secDNS:endDate> element.  The <secDNS:startDate> and
    <secDNS:endDate> elements indicate a client's preferences for the
    start and end date of DNS security extension resource record
    publication in the zone administered by the server operator.















































Hollenbeck             Expires December 12, 2002                [Page 8]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.1.2.1 Example <info> Response for a Secure Delegation with Key Data

  S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  S:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  S:     epp-1.0.xsd">
  S:  <response>
  S:    <result code="1000">
  S:      <msg>Command completed successfully</msg>
  S:    </result>
  S:    <resData>
  S:      <domain:infData
  S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  S:       domain-1.0.xsd">
  S:        <domain:name>example.tld</domain:name>
  S:        <domain:roid>EXAMPLE1-REP</domain:roid>
  S:        <domain:status s="ok"/>
  S:        <domain:registrant>jd1234</domain:registrant>
  S:        <domain:contact type="admin">sh8013</domain:contact>
  S:        <domain:contact type="tech">sh8013</domain:contact>
  S:        <domain:ns>ns1.example.tld</domain:ns>
  S:        <domain:ns>ns2.example.tld</domain:ns>
  S:        <domain:host>ns1.example.tld</domain:host>
  S:        <domain:host>ns2.example.tld</domain:host>
  S:        <domain:clID>ClientX</domain:clID>
  S:        <domain:crID>ClientY</domain:crID>
  S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
  S:        <domain:upID>ClientX</domain:upID>
  S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
  S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
  S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
  S:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  S:      </domain:infData>
  S:    </resData>
  S:    <extension>
  S:      <secDNS:infData
  S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  S:       secDNS-1.0.xsd">
  S:        <secDNS:status s="secure"/>
  S:        <secDNS:keyData>
  S:          <secDNS:key>
  S:            <secDNS:flags>256</secDNS:flags>
  S:            <secDNS:protocol>3</secDNS:protocol>
  S:            <secDNS:alg>1</secDNS:alg>



Hollenbeck             Expires December 12, 2002                [Page 9]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  S:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
  S:          </secDNS:key>
  S:        </secDNS:keyData>
  S:      </secDNS:infData>
  S:    </extension>
  S:    <trID>
  S:      <clTRID>ABC-12345</clTRID>
  S:      <svTRID>54322-XYZ</svTRID>
  S:    </trID>
  S:  </response>
  S:</epp>








































Hollenbeck             Expires December 12, 2002               [Page 10]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.1.2.2 Example <info> Response for a Secure Delegation with DS Data

  S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  S:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  S:     epp-1.0.xsd">
  S:  <response>
  S:    <result code="1000">
  S:      <msg>Command completed successfully</msg>
  S:    </result>
  S:    <resData>
  S:      <domain:infData
  S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  S:       domain-1.0.xsd">
  S:        <domain:name>example.tld</domain:name>
  S:        <domain:roid>EXAMPLE1-REP</domain:roid>
  S:        <domain:status s="ok"/>
  S:        <domain:registrant>jd1234</domain:registrant>
  S:        <domain:contact type="admin">sh8013</domain:contact>
  S:        <domain:contact type="tech">sh8013</domain:contact>
  S:        <domain:ns>ns1.example.tld</domain:ns>
  S:        <domain:ns>ns2.example.tld</domain:ns>
  S:        <domain:host>ns1.example.tld</domain:host>
  S:        <domain:host>ns2.example.tld</domain:host>
  S:        <domain:clID>ClientX</domain:clID>
  S:        <domain:crID>ClientY</domain:crID>
  S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
  S:        <domain:upID>ClientX</domain:upID>
  S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
  S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
  S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
  S:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  S:      </domain:infData>
  S:    </resData>
  S:    <extension>
  S:      <secDNS:infData
  S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  S:       secDNS-1.0.xsd">
  S:        <secDNS:status s="secure"/>
  S:        <secDNS:dsData>
  S:          <secDNS:keyTag>12345</secDNS:keyTag>
  S:          <secDNS:alg>3</secDNS:alg>
  S:          <secDNS:digestType>1</secDNS:digestType>
  S:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>



Hollenbeck             Expires December 12, 2002               [Page 11]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  S:        </secDNS:dsData>
  S:      </secDNS:infData>
  S:    </extension>
  S:    <trID>
  S:      <clTRID>ABC-12345</clTRID>
  S:      <svTRID>54322-XYZ</svTRID>
  S:    </trID>
  S:  </response>
  S:</epp>










































Hollenbeck             Expires December 12, 2002               [Page 12]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.1.2.3 Example <info> Response for an Insecure Delegation

  S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  S:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  S:     epp-1.0.xsd">
  S:  <response>
  S:    <result code="1000">
  S:      <msg>Command completed successfully</msg>
  S:    </result>
  S:    <resData>
  S:      <domain:infData
  S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  S:       domain-1.0.xsd">
  S:        <domain:name>example.tld</domain:name>
  S:        <domain:roid>EXAMPLE1-REP</domain:roid>
  S:        <domain:status s="ok"/>
  S:        <domain:registrant>jd1234</domain:registrant>
  S:        <domain:contact type="admin">sh8013</domain:contact>
  S:        <domain:contact type="tech">sh8013</domain:contact>
  S:        <domain:ns>ns1.example.tld</domain:ns>
  S:        <domain:ns>ns2.example.tld</domain:ns>
  S:        <domain:host>ns1.example.tld</domain:host>
  S:        <domain:host>ns2.example.tld</domain:host>
  S:        <domain:clID>ClientX</domain:clID>
  S:        <domain:crID>ClientY</domain:crID>
  S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
  S:        <domain:upID>ClientX</domain:upID>
  S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
  S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
  S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
  S:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  S:      </domain:infData>
  S:    </resData>
  S:    <extension>
  S:      <secDNS:infData
  S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  S:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  S:       secDNS-1.0.xsd">
  S:        <secDNS:status s="insecure"/>
  S:        <secDNS:insecure nxt="0"/>
  S:      </secDNS:infData>
  S:    </extension>
  S:    <trID>
  S:      <clTRID>ABC-12345</clTRID>



Hollenbeck             Expires December 12, 2002               [Page 13]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  S:      <svTRID>54322-XYZ</svTRID>
  S:    </trID>
  S:  </response>
  S:</epp>

  An EPP error response MUST be returned if an <info> command can not be
  processed for any reason.

3.1.3 EPP <transfer> Command

  This extension does not add any elements to the EPP <transfer> command
  or <transfer> response described in [EPP-D].

3.2 EPP Transform Commands

  EPP provides five commands to transform objects: <create> to create an
  instance of an object, <delete> to delete an instance of an object,
  <renew> to extend the validity period of an object, <transfer> to
  manage object sponsorship changes, and <update> to change information
  associated with an object.

3.2.1 EPP <create> Command

  This extension defines additional elements for the EPP <create>
  command described in [EPP-D].  No additional elements are defined for
  the EPP <create> response.

  The EPP <create> command provides a transform operation that allows a
  client to create a domain object.  In addition to the EPP command
  elements described in [EPP-D], the command MUST contain an <extension>
  element.  The <extension> element MUST contain a child <secDNS:create>
  element that identifies the secDNS namespace and the location of the
  secDNS schema.  The <secDNS:create> element MUST contain one of the
  following child elements:

  - A <secDNS:insecure> element that contains no child elements, but
  does contain a REQUIRED "nxt" attribute that notes if the delegation
  is to be included in the parent zone's chain of NXT records.  A value
  of "1" or "true" indicates that the delegation is insecure, but is to
  be included in the parent zone's chain of NXT records.  A value of "0"
  or "false" indicates that the delegation is insecure and is not to be
  included in the parent zone's chain of NXT records.  Server policy and
  further discussion around [OPTIN] might have an impact on the
  necessity of this element.

  - A <secDNS:keyData> element that contains key and signature data.
  Each <secDNS:keyData> element contains one or more <secDNS:key>
  elements, one or more corresponding <secDNS:sig> elements, an OPTIONAL



Hollenbeck             Expires December 12, 2002               [Page 14]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  <secDNS:startDate> element, and an OPTIONAL <secDNS:endDate> element.
  The <secDNS:startDate> and <secDNS:endDate> elements MAY be used to
  indicate a client's preferences for the start and end date of DNS
  security extension resource record publication in the zone
  administered by the server operator.  If not provided, the server
  operator's standard resource record publication policies apply.

  The <secDNS:key> element contains the following child elements:

    - A <secDNS:flags> element that contains a flags field value as
    described in [RFC2535] sections 3.1 and 3.1.2.

    - A <secDNS:protocol> element that contains a protocol field value
    as described in [RFC2535] sections 3.1 and 3.1.3.

    - A <secDNS:alg> element that contains an algorithm number field
    value as described in [RFC2535] sections 3.1 and 3.2.

    - A <secDNS:pubKey> element that contains an encoded public key
    field value as described in [RFC2535] section 3.1.  The format of
    the public key is algorithm dependent.

  The <secDNS:sig> element contains the following child elements:

    - A <secDNS:type> element that contains a "type covered" field value
    as described in [RFC2535] sections 4.1 and 4.1.1.

    - A <secDNS:alg> element that contains an algorithm number field
    value as described in [RFC2535] sections 4.1 and 4.1.2.

    - A <secDNS:labels> element that contains a labels field value as
    described in [RFC2535] sections 4.1 and 4.1.3.

    - A <secDNS:origTTL> element that contains an original TTL field
    value as described in [RFC2535] sections 4.1 and 4.1.4.

    - A <secDNS:sigExp> element that contains a date-time value
    describing the end of the signature's validity period as described
    in [RFC2535] sections 4.1 and 4.1.5.

    - A <secDNS:sigInc> element that contains a date-time value
    describing the start of the signature's validity period as described
    in [RFC2535] sections 4.1 and 4.1.5.

    - A <secDNS:keyTag> element that contains a key tag field value as
    described in [RFC2535] sections 4.1 and 4.1.6.

    - A <secDNS:signerName> element that contains a signer name field



Hollenbeck             Expires December 12, 2002               [Page 15]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


    value as described in [RFC2535] sections 4.1 and 4.1.7.

    - A <secDNS:sigVal> element that contains a signature field value as
    described in [RFC2535] sections 4.1 and 4.1.8.

  - A <secDNS:dsData> element that contains delegation signer
  information calculated and provided by the client for a secured
  delegation.  The <secDNS:dsData> element contains the following child
  elements:

    - A <secDNS:keyTag> element that contains a key tag value as
    described in [DS] section 2.4.

    - A <secDNS:alg> element that contains an algorithm value as
    described in [DS] section 2.4.

    - A <secDNS:digestType> element that contains a digest type value as
    described in [DS] section 2.4.

    - A <secDNS:digest> element that contains a digest value as
    described in [DS] section 2.4.

    - An OPTIONAL <secDNS:startDate> element and an OPTIONAL
    <secDNS:endDate> element.  The <secDNS:startDate> and
    <secDNS:endDate> elements indicate a client's preferences for the
    start and end date of DNS security extension resource record
    publication in the zone administered by the server operator.  If not
    provided, the server operator's standard resource record publication
    policies apply.






















Hollenbeck             Expires December 12, 2002               [Page 16]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.1.1 Example <create> Command for a Secure Delegation with Key Data

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <create>
  C:      <domain:create
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:        <domain:period unit="y">2</domain:period>
  C:        <domain:ns>ns1.example.tld</domain:ns>
  C:        <domain:ns>ns2.example.tld</domain:ns>
  C:        <domain:registrant>jd1234</domain:registrant>
  C:        <domain:contact type="admin">sh8013</domain:contact>
  C:        <domain:contact type="tech">sh8013</domain:contact>
  C:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  C:      </domain:create>
  C:    </create>
  C:    <extension>
  C:      <secDNS:create
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:keyData>
  C:          <secDNS:key>
  C:            <secDNS:flags>256</secDNS:flags>
  C:            <secDNS:protocol>3</secDNS:protocol>
  C:            <secDNS:alg>1</secDNS:alg>
  C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
  C:          </secDNS:key>
  C:          <secDNS:sig>
  C:            <secDNS:type>KEY</secDNS:type>
  C:            <secDNS:alg>1</secDNS:alg>
  C:            <secDNS:labels>2</secDNS:labels>
  C:            <secDNS:origTTL>172800</secDNS:origTTL>
  C:            <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
  C:            <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
  C:            <secDNS:keyTag>14845</secDNS:keyTag>
  C:            <secDNS:signerName>example.tld</secDNS:signerName>
  C:            <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
  C:          </secDNS:sig>
  C:        </secDNS:keyData>



Hollenbeck             Expires December 12, 2002               [Page 17]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  C:      </secDNS:create>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>


3.2.1.2 Example <create> Command for a Secure Delegation with DS Data

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <create>
  C:      <domain:create
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:        <domain:period unit="y">2</domain:period>
  C:        <domain:ns>ns1.example.tld</domain:ns>
  C:        <domain:ns>ns2.example.tld</domain:ns>
  C:        <domain:registrant>jd1234</domain:registrant>
  C:        <domain:contact type="admin">sh8013</domain:contact>
  C:        <domain:contact type="tech">sh8013</domain:contact>
  C:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  C:      </domain:create>
  C:    </create>
  C:    <extension>
  C:      <secDNS:create
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:dsData>
  C:          <secDNS:keyTag>12345</secDNS:keyTag>
  C:          <secDNS:alg>3</secDNS:alg>
  C:          <secDNS:digestType>1</secDNS:digestType>
  C:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
  C:        </secDNS:dsData>
  C:      </secDNS:create>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>





Hollenbeck             Expires December 12, 2002               [Page 18]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.1.3 Example <create> Command for an Insecure Delegation

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <create>
  C:      <domain:create
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:        <domain:period unit="y">2</domain:period>
  C:        <domain:ns>ns1.example.tld</domain:ns>
  C:        <domain:ns>ns2.example.tld</domain:ns>
  C:        <domain:registrant>jd1234</domain:registrant>
  C:        <domain:contact type="admin">sh8013</domain:contact>
  C:        <domain:contact type="tech">sh8013</domain:contact>
  C:        <domain:authInfo type="pw">2fooBAR</domain:authInfo>
  C:      </domain:create>
  C:    </create>
  C:    <extension>
  C:      <secDNS:create
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:insecure nxt="0"/>
  C:      </secDNS:create>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>

  When a <create> command has been processed successfully, the EPP
  response is as described in [EPP-D].

3.2.2 EPP <delete> Command

  This extension does not add any elements to the EPP <delete> command
  or <delete> response described in [EPP-D].

3.2.3 EPP <renew> Command

  This extension does not add any elements to the EPP <renew> command or
  <renew> response described in [EPP-D].



Hollenbeck             Expires December 12, 2002               [Page 19]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


3.2.4 EPP <transfer> Command

  This extension does not add any elements to the EPP <transfer> command
  or <transfer> response described in [EPP-D].

3.2.5 EPP <update> Command

  This extension defines additional elements for the EPP <update>
  command described in [EPP-D].  No additional elements are defined for
  the EPP <update> response.

  The EPP <update> command provides a transform operation that allows a
  client to modify the attributes of a domain object.  In addition to
  the EPP command elements descried in [EPP-D], the command MUST contain
  an <extension> element.  The <extension> element MUST contain a child
  <secDNS:update> element that identifies the secDNS namespace and the
  location of the secDNS schema.  The <secDNS:update> element contains a
  <secDNS:add> element to add security information to a delegation, a
  <secDNS:rem> element to remove security information from a delegation,
  or a <secDNS:chg> element to replace (possibly empty) security
  information with new security information.

  The <secDNS:add> element is used to add keys to an existing set.  The
  <secDNS:add> element contains a <secDNS:keyData> element whose child
  elements are the same as those listed in the description of the EPP
  <create> command.  The <secDNS:add> element MAY only be used to add
  keys to an existing set; it MUST NOT be used to replace DS data with
  key data, for example.

  The <secDNS:rem> element contains either a <secDNS:key> element that
  is used to remove keys from an existing set, or a <secDNS:dsData>
  element that is used to remove DS data from a delegation.  Removing
  all keys or DS data MUST change the status of the delegation to
  "notSecured".  The <secDNS:key> element contains the following child
  elements used to identify the key to be removed:

    - A <secDNS:alg> element that contains an algorithm number field
    value as described in [RFC2535] sections 3.1 and 3.2.

    - A <secDNS:keyTag> element that contains a key tag field value as
    described in [RFC2535] sections 4.1 and 4.1.6.

  The <secDNS:rem> element MAY contain a <secDNS:dsData> element whose
  child elements are the same as those listed in the description of the
  EPP <create> command.

  The <secDNS:chg> element is used to replace an existing key set with a
  new key set and to remove a key set completely.  The <secDNS:chg>



Hollenbeck             Expires December 12, 2002               [Page 20]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  element contains child elements that are the same as those presented
  in the description of the <secDNS:create> element as part of the EPP
  <create> command.
















































Hollenbeck             Expires December 12, 2002               [Page 21]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.1 Example <update> Command, Adding a Key

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:add>
  C:          <secDNS:keyData>
  C:            <secDNS:key>
  C:              <secDNS:flags>256</secDNS:flags>
  C:              <secDNS:protocol>3</secDNS:protocol>
  C:              <secDNS:alg>1</secDNS:alg>
  C:              <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
  C:            </secDNS:key>
  C:            <secDNS:sig>
  C:              <secDNS:type>KEY</secDNS:type>
  C:              <secDNS:alg>1</secDNS:alg>
  C:              <secDNS:labels>2</secDNS:labels>
  C:              <secDNS:origTTL>172800</secDNS:origTTL>
  C:              <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
  C:              <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
  C:              <secDNS:keyTag>14845</secDNS:keyTag>
  C:              <secDNS:signerName>example.tld</secDNS:signerName>
  C:              <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
  C:            </secDNS:sig>
  C:          </secDNS:keyData>
  C:        </secDNS:add>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>



Hollenbeck             Expires December 12, 2002               [Page 22]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.2 Example <update> Command, Replacing a Key Set

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:chg>
  C:          <secDNS:keyData>
  C:            <secDNS:key>
  C:              <secDNS:flags>256</secDNS:flags>
  C:              <secDNS:protocol>3</secDNS:protocol>
  C:              <secDNS:alg>1</secDNS:alg>
  C:              <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
  C:            </secDNS:key>
  C:            <secDNS:sig>
  C:              <secDNS:type>KEY</secDNS:type>
  C:              <secDNS:alg>1</secDNS:alg>
  C:              <secDNS:labels>2</secDNS:labels>
  C:              <secDNS:origTTL>172800</secDNS:origTTL>
  C:              <secDNS:sigExp>2001-11-05T22:00:00.0Z</secDNS:sigExp>
  C:              <secDNS:sigInc>2001-10-05T22:00:00.0Z</secDNS:sigInc>
  C:              <secDNS:keyTag>14845</secDNS:keyTag>
  C:              <secDNS:signerName>example.tld</secDNS:signerName>
  C:              <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
  C:            </secDNS:sig>
  C:          </secDNS:keyData>
  C:        </secDNS:chg>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>



Hollenbeck             Expires December 12, 2002               [Page 23]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.3 Example <update> Command, Removing a Key Set

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:chg>
  C:          <secDNS:insecure nxt="0"/>
  C:        </secDNS:chg>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>





















Hollenbeck             Expires December 12, 2002               [Page 24]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.4 Example <update> Command, Removing a Key

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:rem>
  C:          <secDNS:key>
  C:            <secDNS:alg>1</secDNS:alg>
  C:            <secDNS:keyTag>14845</secDNS:keyTag>
  C:          </secDNS:key>
  C:        </secDNS:rem>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>


















Hollenbeck             Expires December 12, 2002               [Page 25]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.5 Example <update> Command, Changing DS Data

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:chg>
  C:          <secDNS:dsData>
  C:            <secDNS:keyTag>12345</secDNS:keyTag>
  C:            <secDNS:alg>3</secDNS:alg>
  C:            <secDNS:digestType>1</secDNS:digestType>
  C:            <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
  C:          </secDNS:dsData>
  C:        </secDNS:chg>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>
















Hollenbeck             Expires December 12, 2002               [Page 26]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002



3.2.5.6 Example <update> Command, Removing DS Data

  C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
  C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  C:     epp-1.0.xsd">
  C:  <command>
  C:    <update>
  C:      <domain:update
  C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
  C:       domain-1.0.xsd">
  C:        <domain:name>example.tld</domain:name>
  C:      </domain:update>
  C:    </update>
  C:    <extension>
  C:      <secDNS:update
  C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
  C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
  C:       secDNS-1.0.xsd">
  C:        <secDNS:rem>
  C:          <secDNS:dsData>
  C:            <secDNS:keyTag>12345</secDNS:keyTag>
  C:            <secDNS:alg>3</secDNS:alg>
  C:            <secDNS:digestType>1</secDNS:digestType>
  C:            <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
  C:          </secDNS:dsData>
  C:        </secDNS:rem>
  C:      </secDNS:update>
  C:    </extension>
  C:    <clTRID>ABC-12345</clTRID>
  C:  </command>
  C:</epp>

  When an <update> command has been processed successfully, the EPP
  response is as described in [EPP-D].













Hollenbeck             Expires December 12, 2002               [Page 27]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


4. Formal Syntax

  An EPP object mapping is specified in XML Schema notation.  The formal
  syntax presented here is a complete schema representation of the
  object mapping suitable for automated validation of EPP XML instances.
  The BEGIN and END tags are not part of the schema; they are used to
  note the beginning and ending of the schema for URI registration
  purposes.

  BEGIN
  <?xml version="1.0" encoding="UTF-8"?>

  <schema targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
          xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
          xmlns="http://www.w3.org/2001/XMLSchema"
          elementFormDefault="qualified">

    <annotation>
      <documentation>
        Extensible Provisioning Protocol v1.0
        domain name extension schema for provisioning
        DNS security extensions.
      </documentation>
    </annotation>

  <!--
  Child elements found in EPP commands.
  -->
    <element name="create" type="secDNS:createType"/>
    <element name="update" type="secDNS:updateType"/>

  <!--
  Child elements of the <create> command.
  -->
    <complexType name="createType">
      <choice>
        <element name="dsData" type="secDNS:dsDataType"/>
        <element name="insecure" type="secDNS:insecureType"/>
        <element name="keyData" type="secDNS:keyDataType"/>
      </choice>
    </complexType>

    <complexType name="dsDataType">
      <sequence>
        <element name="keyTag" type="unsignedShort"/>
        <element name="alg" type="unsignedByte"/>
        <element name="digestType" type="unsignedByte"/>
        <element name="digest" type="hexBinary"/>



Hollenbeck             Expires December 12, 2002               [Page 28]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


        <element name="startDate" type="dateTime"
         minOccurs="0"/>
        <element name="endDate" type="dateTime"
         minOccurs="0"/>
      </sequence>
    </complexType>

    <complexType name="keyDataType">
      <sequence>
        <element name="key" type="secDNS:keyType"
         maxOccurs="unbounded"/>
        <element name="sig" type="secDNS:sigType"
         maxOccurs="unbounded"/>
        <element name="startDate" type="dateTime"
         minOccurs="0"/>
        <element name="endDate" type="dateTime"
         minOccurs="0"/>
      </sequence>
    </complexType>

    <complexType name="keyType">
      <sequence>
        <element name="flags" type="unsignedShort"/>
        <element name="protocol" type="unsignedByte"/>
        <element name="alg" type="unsignedByte"/>
        <element name="pubKey" type="secDNS:keySigType"/>
      </sequence>
    </complexType>

    <complexType name="sigType">
      <sequence>
        <element name="type" type="secDNS:typeCovType"/>
        <element name="alg" type="unsignedByte"/>
        <element name="labels" type="unsignedByte"/>
        <element name="origTTL" type="unsignedInt"/>
        <element name="sigExp" type="dateTime"/>
        <element name="sigInc" type="dateTime"/>
        <element name="keyTag" type="unsignedShort"/>
        <element name="signerName" type="secDNS:nameType"/>
        <element name="sigVal" type="secDNS:keySigType"/>
      </sequence>
    </complexType>

    <simpleType name="keySigType">
      <restriction base="base64Binary">
        <minLength value="1"/>
      </restriction>
    </simpleType>



Hollenbeck             Expires December 12, 2002               [Page 29]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


    <simpleType name="typeCovType">
      <restriction base="token">
        <enumeration value="KEY"/> <!-- Type 25 -->
      </restriction>
    </simpleType>

    <simpleType name="nameType">
      <restriction base="token">
        <minLength value="1"/>
        <maxLength value="255"/>
      </restriction>
    </simpleType>

    <complexType name="insecureType">
      <attribute name="nxt" type="boolean" use="required"/>
    </complexType>

  <!--
  Child elements of the <update> command.
  -->
    <complexType name="updateType">
      <choice>
        <element name="add" type="secDNS:addType"/>
        <element name="chg" type="secDNS:createType"/>
        <element name="rem" type="secDNS:remType"/>
      </choice>
    </complexType>

    <complexType name="addType">
      <sequence>
        <element name="keyData" type="secDNS:keyDataType"/>
      </sequence>
    </complexType>

    <complexType name="remType">
      <choice>
        <element name="key" type="secDNS:keyRemType"
         maxOccurs="unbounded"/>
        <element name="dsData" type="secDNS:dsDataType"/>
      </choice>
    </complexType>

    <complexType name="keyRemType">
      <sequence>
        <element name="alg" type="unsignedByte"/>
        <element name="keyTag" type="unsignedShort"/>
      </sequence>
    </complexType>



Hollenbeck             Expires December 12, 2002               [Page 30]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  <!--
  Child response elements.
  -->
    <element name="infData" type="secDNS:infDataType"/>

  <!--
  <info> response elements.
  -->
    <complexType name="infDataType">
      <sequence>
        <element name="status" type="secDNS:statusType"/>
        <choice>
          <element name="dsData" type="secDNS:dsDataType"/>
          <element name="insecure" type="secDNS:insecureType"/>
          <element name="keyData" type="secDNS:infoKeyDataType"/>
         </choice>
      </sequence>
    </complexType>

    <complexType name="statusType">
      <simpleContent>
        <extension base="token">
          <attribute name="s" type="secDNS:statusValueType"
           use="required"/>
        </extension>
      </simpleContent>
    </complexType>

    <simpleType name="statusValueType">
      <restriction base="token">
        <enumeration value="insecure"/>
        <enumeration value="secure"/>
      </restriction>
    </simpleType>

    <complexType name="infoKeyDataType">
      <sequence>
        <element name="key" type="secDNS:infoKeyType"
         maxOccurs="unbounded"/>
        <element name="startDate" type="dateTime"
         minOccurs="0"/>
        <element name="endDate" type="dateTime"
         minOccurs="0"/>
      </sequence>
    </complexType>

    <complexType name="infoKeyType">
      <sequence>



Hollenbeck             Expires December 12, 2002               [Page 31]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


        <element name="flags" type="unsignedShort"/>
        <element name="protocol" type="unsignedByte"/>
        <element name="alg" type="unsignedByte"/>
        <element name="pubKey" type="secDNS:keySigType"
         minOccurs="0"/>
      </sequence>
    </complexType>

  <!--
  End of schema.
  -->
  </schema>
  END






































Hollenbeck             Expires December 12, 2002               [Page 32]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


5. Internationalization Considerations

  EPP is represented in XML, which requires conforming parsers to
  support both UTF-8 [RFC2279] and UTF-16 [RFC2781]; support for other
  character encodings is also possible.  Implementations of this
  specification MUST follow IETF policy on the use of character sets and
  languages as described in [RFC2277].

6. IANA Considerations

  This document uses URNs to describe XML namespaces and XML schemas
  conforming to a registry mechanism described in [IETF-XML].  Two URI
  assignments are requested.

  Registration request for the secDNS namespace:

  URI: urn:ietf:params:xml:ns:secDNS-1.0

  Registrant Contact: See the "Author's Address" section of this
  document.

  XML: None.  Namespace URIs do not represent an XML specification.

  Registration request for the secDNS XML schema:

  URI: urn:ietf:params:xml:schema:secDNS-1.0

  Registrant Contact: See the "Author's Address" section of this
  document.

  XML: See the "Formal Syntax" section of this document.




















Hollenbeck             Expires December 12, 2002               [Page 33]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


7. Security Considerations

  The provisioning service described in this document involves the
  exchange of information that can have an operational impact on the
  DNS.  A trust relationship MUST exist between the EPP client and
  server, and provisioning of public key information MUST only be done
  after the identities of both parties have been confirmed using a
  strong authentication mechanism.

  An EPP client might be acting as an agent for a zone administrator who
  wants to send key information to be signed and published by the server
  operator.  Man-in-the-middle attacks are thus possible as a result of
  direct client activity or inadvertent client data manipulation.

  The signature information provided by a client allows a server to
  confirm that the corresponding key is usable and has not been modified
  while in transit, but the server generally does not have enough
  information to confirm that the key was generated and provided by the
  child zone administrator.  Authentication and integrity services MUST
  be provided on a hop-by-hop basis to ensure that data is not modified
  while in transit between entities.

  Acceptance of a false key by a server operator can produce significant
  operational consequences.  The child and parent zones MUST be
  consistent to properly secure the delegation.  In the absence of
  consistent signatures the delegation will not appear in the secure
  name space, yielding untrustworthy query responses.

  Signature checking at the server requires computational resources.  A
  purposeful or inadvertent denial of service attack is possible if a
  client requests some number of update operations that exceed a
  server's processing capabilities.  Server operators SHOULD take steps
  to manage command load and command processing requirements to minimize
  the risk of a denial of service attack.

8. Acknowledgements

  The author gratefully acknowledges the contributions to this document
  provided by David Blacka, Olafur Gudmundsson, Mark Kosters, and Dan
  Massey.











Hollenbeck             Expires December 12, 2002               [Page 34]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


9. References

  Normative References:

  [DS] O. Gudmundsson: "Delegation Signer Resource Record", work in
  progress.

  [EPP] S. Hollenbeck: "Extensible Provisioning Protocol", work in
  progress.

  [EPP-D] S. Hollenbeck: "Extensible Provisioning Protocol Domain Name
  Mapping", work in progress.

  [OPTIN] R. Arends et al.: "DNSSEC Opt-In", work in progress.

  [IETF-XML] M. Mealling: "The IETF XML Registry", work in progress.

  [RFC2119] S. Bradner: "Key Words for Use in RFCs to Indicate
  Requirement Levels", BCP 14, RFC 2119, March 1997.

  [RFC2277] H. Alvestrand: "IETF Policy on Character Sets and
  Languages", BCP 18, RFC 2277, January 1998.

  [RFC2535] D. Eastlake: "Domain Name System Security Extensions", RFC
  2535, March 1999.

  [XML] Editors T. Bray et al.: "Extensible Markup Language (XML) 1.0
  (Second Edition)", W3C Recommendation 6 October 2000.

  [XMLS-1] Editors H. Thompson et al.: "XML Schema Part 1: Structures",
  W3C Recommendation 2 May 2001.

  [XMLS-2] Editors P. Biron, A. Malhotra: "XML Schema Part 2:
  Datatypes", W3C Recommendation 2 May 2001.

















Hollenbeck             Expires December 12, 2002               [Page 35]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


  Informative References:

  [RFC1034] P. Mockapetris: "DOMAIN NAMES - CONCEPTS AND FACILITIES",
  STD 13, RFC 1034, November 1987.

  [RFC1035] P. Mockapetris: "DOMAIN NAMES - IMPLEMENTATION AND
  SPECIFICATION", STD 13, RFC 1035, November 1987.

  [RFC2279] F. Yergeau: "UTF-8, a transformation format of ISO 10646",
  RFC 2279, January 1998.

  [RFC2781] P. Hoffman and F. Yergeau: "UTF-16, an encoding of ISO
  10646", RFC 2781, February 2000.

  [RFC3008] B. Wellington: "Domain Name System Security (DNSSEC) Signing
  Authority", RFC 3008, November 2000.

  [RFC3090] E. Lewis: "DNS Security Extension Clarification on Zone
  Status", RFC 3090, March 2001.

10. Author's Address

  Scott Hollenbeck
  VeriSign Global Registry Services
  21345 Ridgetop Circle
  Dulles, VA 20166-6503
  USA
  shollenbeck@verisign.com























Hollenbeck             Expires December 12, 2002               [Page 36]

Internet-Draft          EPP DNS Security Mapping           June 12, 2002


A. Full Copyright Statement

  Copyright (C) The Internet Society 2002.  All Rights Reserved.

  This document and translations of it may be copied and furnished to
  others, and derivative works that comment on or otherwise explain it
  or assist in its implementation may be prepared, copied, published and
  distributed, in whole or in part, without restriction of any kind,
  provided that the above copyright notice and this paragraph are
  included on all such copies and derivative works.  However, this
  document itself may not be modified in any way, such as by removing
  the copyright notice or references to the Internet Society or other
  Internet organizations, except as needed for the purpose of developing
  Internet standards in which case the procedures for copyrights defined
  in the Internet Standards process must be followed, or as required to
  translate it into languages other than English.

  The limited permissions granted above are perpetual and will not be
  revoked by the Internet Society or its successors or assigns.

  This document and the information contained herein is provided on an
  "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
  TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT
  NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN
  WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
  MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

  Funding for the RFC Editor function is currently provided by the
  Internet Society.




















Hollenbeck             Expires December 12, 2002               [Page 37]