Network Working Group                                      S. Hollenbeck
Internet-Draft                                            VeriSign, Inc.
Expires: April 5, 2005                                   October 5, 2004


      Domain Name System (DNS) Security Extensions Mapping for the
                 Extensible Provisioning Protocol (EPP)
                   draft-hollenbeck-epp-secdns-04.txt

Status of this Memo

   This document is an Internet-Draft and is subject to all provisions
   of section 3 of RFC 3667.  By submitting this Internet-Draft, each
   author represents that any applicable patent or other IPR claims of
   which he or she is aware have been or will be disclosed, and any of
   which he or she become aware will be disclosed, in accordance with
   RFC 3668.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as
   Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on April 5, 2005.

Copyright Notice

   Copyright (C) The Internet Society (2004).

Abstract

   This document describes an Extensible Provisioning Protocol (EPP)
   extension mapping for the provisioning and management of Domain Name
   System (DNS) security extensions for domain names stored in a shared
   central repository.  Specified in XML, this mapping extends the EPP
   domain name mapping to provide additional features required for the
   provisioning of DNS security extensions.




Hollenbeck               Expires April 5, 2005                  [Page 1]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1   Conventions Used In This Document  . . . . . . . . . . . .  3
   2.  Object Attributes  . . . . . . . . . . . . . . . . . . . . . .  3
     2.1   Public Key Information . . . . . . . . . . . . . . . . . .  4
     2.2   Signature Information  . . . . . . . . . . . . . . . . . .  4
     2.3   Delegation Signer Information  . . . . . . . . . . . . . .  4
     2.4   Dates and Times  . . . . . . . . . . . . . . . . . . . . .  5
     2.5   Date-Time Durations  . . . . . . . . . . . . . . . . . . .  5
     2.6   Booleans . . . . . . . . . . . . . . . . . . . . . . . . .  5
   3.  EPP Command Mapping  . . . . . . . . . . . . . . . . . . . . .  6
     3.1   EPP Query Commands . . . . . . . . . . . . . . . . . . . .  6
       3.1.1   EPP <check> Command  . . . . . . . . . . . . . . . . .  6
       3.1.2   EPP <info> Command . . . . . . . . . . . . . . . . . .  6
       3.1.3   EPP <transfer> Command . . . . . . . . . . . . . . . . 11
     3.2   EPP Transform Commands . . . . . . . . . . . . . . . . . . 12
       3.2.1   EPP <create> Command . . . . . . . . . . . . . . . . . 12
       3.2.2   EPP <delete> Command . . . . . . . . . . . . . . . . . 14
       3.2.3   EPP <renew> Command  . . . . . . . . . . . . . . . . . 15
       3.2.4   EPP <transfer> Command . . . . . . . . . . . . . . . . 15
       3.2.5   EPP <update> Command . . . . . . . . . . . . . . . . . 15
   4.  Formal Syntax  . . . . . . . . . . . . . . . . . . . . . . . . 19
   5.  Internationalization Considerations  . . . . . . . . . . . . . 22
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 23
   7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 23
   8.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 25
   9.1   Normative References . . . . . . . . . . . . . . . . . . . . 25
   9.2   Informative References . . . . . . . . . . . . . . . . . . . 25
       Author's Address . . . . . . . . . . . . . . . . . . . . . . . 26
       Intellectual Property and Copyright Statements . . . . . . . . 27



















Hollenbeck               Expires April 5, 2005                  [Page 2]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


1.  Introduction

   This document describes an extension mapping for version 1.0 of the
   Extensible Provisioning Protocol (EPP) described in RFC 3730 [1].
   This mapping, an extension of the domain name mapping described in
   RFC 3731 [2], is specified using the Extensible Markup Language (XML)
   1.0 [3] and XML Schema notation ([4], [5]).

   The EPP core protocol specification [1] provides a complete
   description of EPP command and response structures.  A thorough
   understanding of the base protocol specification is necessary to
   understand the mapping described in this document.  Familiarity with
   the DNS described in RFC 1034 [12] and RFC 1035 [13], and DNS
   security extensions described in RFC 3008 [14], RFC 3090 [15], RFC
   TBD1 [6], and RFC TBD2 [7] is required to understand the DNS security
   concepts described in this document.

   The EPP mapping described in this document specifies a mechanism for
   the provisioning and management of DNS security extensions in a
   shared central repository.  Information exchanged via this mapping
   can be extracted from the repository and used to publish DNS resource
   records as described in RFC 3658 [8] and RFC TBD2 [7].

1.1  Conventions Used In This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in BCP 14, RFC 2119 [9].

   In examples, "C:" represents lines sent by a protocol client and "S:"
   represents lines returned by a protocol server.  "////" is used to
   note element values that have been shortened to better fit page
   boundaries.  Indentation and white space in examples is provided only
   to illustrate element relationships and is not a REQUIRED feature of
   this protocol.

   XML is case sensitive.  Unless stated otherwise, XML specifications
   and examples provided in this document MUST be interpreted in the
   character case presented to develop a conforming implementation.

2.  Object Attributes

   This extension adds additional elements to the EPP domain name
   mapping [2].  Only new element descriptions are described here.

   This document describes update scenarios in which a client can create
   an initial set of key or delegation signer information, add new key
   or delegation signer information to a set, remove key or delegation



Hollenbeck               Expires April 5, 2005                  [Page 3]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   signer information from a set, and replace existing key or delegation
   signer information.  Key or delegation signer set replacement vs.
   adding and removing individual keys might be a matter of server
   operator policy or the subject of another document.

2.1  Public Key Information

   Public key information is sent to the server so that the server can
   sign RRs published in a zone managed by the server operator using a
   zone-level key.  A server operator SHOULD NOT sign any key provided
   by a client without cryptographically confirming that the client
   possesses the private key associated with the public key.

   Clients can send information describing multiple keys to a server.
   Each key element MUST be accompanied by a corresponding signature
   element when adding keys to a set.

   Public key information provided by a client maps to the DNSKEY RR
   presentation field formats described in section 2.2 of RFC TBD2 [7].
   A DNSKEY RR contains four fields: flags, a protocol octet, an
   algorithm number octet, and a public key.

2.2  Signature Information

   Signature information is sent to the server to prove that the client
   (or an entity for whom the client is acting as agent) has the private
   key corresponding to the public key and that the key has not been
   modified while in transit.  It allows the server to do basic error
   checking as part of the provisioning process.

   Clients can send information describing multiple signatures to a
   server.  Each signature element MUST correspond to a key element when
   adding keys to a set.  The signature value in each signature element
   MUST cover all of the keys in the given set.

   Signature information provided by a client maps to the RRSIG RR
   presentation field formats described in section 3.2 of RFC TBD2 [7].
   An RRSIG RR contains nine fields: a "type covered" field, an
   algorithm number octet, a labels octet, an original TTL field, a
   signature expiration field, a signature inception field, a key tag
   field, a signer's name field, and a signature field.

2.3  Delegation Signer Information

   Delegation signer (DS) information is published by the server to
   indicate that a delegated zone is digitally signed and that the
   delegation zone recognizes the indicated key as a valid zone key for
   the delegated zone.  A DS RR contains four fields: a key tag field, a



Hollenbeck               Expires April 5, 2005                  [Page 4]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   KEY algorithm number octet, an octet identifying the digest algorithm
   used, and a digest field.  See RFC 3658 [8] for specific field
   formats.

   This document describes two DS provisioning mechanisms.  The
   RECOMMENDED mechanism is one in which the information needed to
   publish DS RRs is derived by the server from key and signature
   information provided by the client.  This provisioning mechanism
   minimizes client complexity and ensures that there is no DS version
   conflict between the client and server, minimizing or eliminating
   client-server DS errors.

   It is worth noting, though, that there are other DS provisioning
   options.  One option that is supported in this specification is for
   the client to generate and send only DS information to the server.
   This option is the simplest for the server to implement, though more
   complex for the client because the client is responsible for
   generating the DS information.  The server has no means of detecting
   errors in the data provided by the client prior to publishing the DS
   information.  Another option that is not supported in this
   specification is for the client to send DS information, DNSKEY
   information, and RRSIG information to the server.  This option is
   verbose and does nothing to reduce the client-server error rate, but
   it does provide the server with enough information to detect DS
   errors before they appear in a zone.

   A client MUST consistently use one provisioning mechanism.  There are
   no features in this specification to support operation of both of the
   documented provisioning mechanisms at the same time.

2.4  Dates and Times

   Date and time attribute values MUST be represented in Universal
   Coordinated Time (UTC) using the Gregorian calendar.  The extended
   date-time form using upper case "T" and "Z" characters defined in RFC
   3339 [10] MUST be used to represent date-time values as XML Schema
   does not support truncated date-time forms or lower case "T" and "Z"
   characters.

2.5  Date-Time Durations

   Duration attribute values MUST be represented in the XML Schema
   format described in Part 2 of the W3C XML Schema recommendation [5].

2.6  Booleans

   Boolean values MUST be represented in the XML Schema format described
   in Part 2 of the W3C XML Schema recommendation [5].



Hollenbeck               Expires April 5, 2005                  [Page 5]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


3.  EPP Command Mapping

   A detailed description of the EPP syntax and semantics can be found
   in the EPP core protocol specification [1].  The command mappings
   described here are specifically for use in provisioning and managing
   DNS security extensions via EPP.

3.1  EPP Query Commands

   EPP provides three commands to retrieve object information: <check>
   to determine if an object is known to the server, <info> to retrieve
   detailed information associated with an object, and <transfer> to
   retrieve object transfer status information.

3.1.1  EPP <check> Command

   This extension does not add any elements to the EPP <check> command
   or <check> response described in the EPP domain mapping [2].

3.1.2  EPP <info> Command

   This extension does not add any elements to the EPP <info> command
   described in the EPP domain mapping [2].  Additional elements are
   defined for the <info> response.

   When an <info> command has been processed successfully, the EPP
   <resData> element MUST contain child elements as described in the EPP
   domain mapping [2].  In addition, the EPP <extension> element MUST
   contain a child <secDNS:infData> element that identifies the
   extension namespace and the location of the extension schema.  The
   <secDNS:infData> element contains the following child elements:

      A <secDNS:keyData> element or a <secDNS:dsData> element that
      describes the type of data provided by the client for the domain.

      The <secDNS:keyData> element contains a subset of the public key
      information originally provided by the client for a secured
      delegation.  Each <secDNS:keyData> element contains one or more
      <secDNS:key> elements.  The <secDNS:key> element contains the
      following child elements:

         A <secDNS:flags> element that contains a flags field value as
         described in sections 2.1.1 and 2.2 of RFC TBD2 [7].

         A <secDNS:protocol> element that contains a protocol field
         value as described in sections 2.1.2 and 2.2 of RFC TBD2 [7].





Hollenbeck               Expires April 5, 2005                  [Page 6]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


         A <secDNS:alg> element that contains an algorithm number field
         value as described in sections 2.1.3 and 2.2 of RFC TBD2 [7].

         A <secDNS:pubKey> element that contains an encoded public key
         field value as described in sections 2.1.4 and 2.2 of RFC TBD2
         [7].

         A <secDNS:sDate> element that indicates a client's preferred
         start date for use of this key to create DNS security extension
         resource records in the zone administered by the server
         operator.

         A <secDNS:eDate> element that indicates a client's preferred
         end date for use of this key to create DNS security extension
         resource records in the zone administered by the server
         operator.

         An OPTIONAL <secDNS:vDuration> element indicates a client's
         preference for the validity duration of the signature to be
         generated by the parent.  If the <secDNS:vDuration> is not
         specified by the client, the default signing policy of the
         server operator (as determined using an out-of-band mechanism)
         applies.

         The <secDNS:sig> element that contains data describing the
         digital signature calculated by the client for the associated
         key.  The <secDNS:sig> element contains the following child
         elements:

            A <secDNS:type> element that contains a "type covered" field
            value as described in sections 3.1.1 and 3.2 of RFC TBD2
            [7].

            A <secDNS:alg> element that contains an algorithm number
            field value as described in sections 3.1.2 and 3.2 of RFC
            TBD2 [7].

            A <secDNS:labels> element that contains a labels field value
            as described in sections 3.1.3 and 3.2 of RFC TBD2 [7].

            A <secDNS:origTTL> element that contains an original TTL
            field value as described in sections 3.1.4 and 3.2 of RFC
            TBD2 [7].

            A <secDNS:sDate> element that contains a date-time value
            describing the start of the signature's validity period as
            described in sections 3.1.5 and 3.2 of RFC TBD2 [7].




Hollenbeck               Expires April 5, 2005                  [Page 7]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


            A <secDNS:eDate> element that contains a date-time value
            describing the end of the signature's validity period as
            described in sections 3.1.5 and 3.2 of RFC TBD2 [7].

            A <secDNS:keyTag> element that contains a key tag field
            value as described in sections 3.1.6 and 3.2 of RFC TBD2
            [7].

            A <secDNS:signerName> element that contains a signer name
            field value as described in sections 3.1.7 and 3.2 of RFC
            TBD2 [7].

            A <secDNS:sigVal> element that contains a signature field
            value as described in sections 3.1.8 and 3.2 of RFC TBD2
            [7].

      The <secDNS:dsData> element contains delegation signer information
      originally provided by the client for a secured delegation.  If
      present, the <secDNS:dsData> element contains the following child
      elements:

         A <secDNS:keyTag> element that contains a key tag value as
         described in section 2.4 of RFC 3658 [8].

         A <secDNS:alg> element that contains an algorithm value as
         described in section 2.4 of RFC 3658 [8].

         A <secDNS:digestType> element that contains a digest type value
         as described in section 2.4 of RFC 3658 [8].

         A <secDNS:digest> element that contains a digest value as
         described in section 2.4 of RFC 3658 [8].

         A <secDNS:sDate> element that indicates a client's preferred
         start date for use of this data to create DNS security
         extension resource records in the zone administered by the
         server operator.

         A <secDNS:eDate> element that indicates a client's preferred
         end date for use of this data to create DNS security extension
         resource records in the zone administered by the server
         operator.

         An OPTIONAL <secDNS:vDuration> element indicates a client's
         preference for the validity duration of the signature to be
         generated by the parent.  If the <secDNS:vDuration> is not
         specified by the client, the default signing policy of the
         server operator (as determined using an out-of-band mechanism)



Hollenbeck               Expires April 5, 2005                  [Page 8]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


         applies.


   Example <info> Response for a Secure Delegation with Key Data:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   S:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   S:     epp-1.0.xsd">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   S:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   S:       domain-1.0.xsd">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="ok"/>
   S:        <domain:registrant>jd1234</domain:registrant>
   S:        <domain:contact type="admin">sh8013</domain:contact>
   S:        <domain:contact type="tech">sh8013</domain:contact>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns2.example.com</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
   S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <secDNS:infData
   S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   S:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   S:       secDNS-1.0.xsd">



Hollenbeck               Expires April 5, 2005                  [Page 9]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   S:        <secDNS:keyData>
   S:          <secDNS:flags>256</secDNS:flags>
   S:          <secDNS:protocol>3</secDNS:protocol>
   S:          <secDNS:alg>1</secDNS:alg>
   S:          <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   S:          <secDNS:vInterval>P7D</secDNS:vInterval>
   S:          <secDNS:sig>
   S:            <secDNS:type>DNSKEY</secDNS:type>
   S:            <secDNS:alg>1</secDNS:alg>
   S:            <secDNS:labels>2</secDNS:labels>
   S:            <secDNS:origTTL>172800</secDNS:origTTL>
   S:            <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
   S:            <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
   S:            <secDNS:keyTag>14845</secDNS:keyTag>
   S:            <secDNS:signerName>example.com</secDNS:signerName>
   S:            <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
   S:          </secDNS:sig>
   S:        </secDNS:keyData>
   S:      </secDNS:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   Example <info> Response for a Secure Delegation with DS Data:

   S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   S:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   S:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   S:     epp-1.0.xsd">
   S:  <response>
   S:    <result code="1000">
   S:      <msg>Command completed successfully</msg>
   S:    </result>
   S:    <resData>
   S:      <domain:infData
   S:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   S:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   S:       domain-1.0.xsd">
   S:        <domain:name>example.com</domain:name>
   S:        <domain:roid>EXAMPLE1-REP</domain:roid>
   S:        <domain:status s="ok"/>
   S:        <domain:registrant>jd1234</domain:registrant>
   S:        <domain:contact type="admin">sh8013</domain:contact>



Hollenbeck               Expires April 5, 2005                 [Page 10]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   S:        <domain:contact type="tech">sh8013</domain:contact>
   S:        <domain:ns>
   S:          <domain:hostObj>ns1.example.com</domain:hostObj>
   S:          <domain:hostObj>ns2.example.com</domain:hostObj>
   S:        </domain:ns>
   S:        <domain:host>ns1.example.com</domain:host>
   S:        <domain:host>ns2.example.com</domain:host>
   S:        <domain:clID>ClientX</domain:clID>
   S:        <domain:crID>ClientY</domain:crID>
   S:        <domain:crDate>1999-04-03T22:00:00.0Z</domain:crDate>
   S:        <domain:upID>ClientX</domain:upID>
   S:        <domain:upDate>1999-12-03T09:00:00.0Z</domain:upDate>
   S:        <domain:exDate>2005-04-03T22:00:00.0Z</domain:exDate>
   S:        <domain:trDate>2000-04-08T09:00:00.0Z</domain:trDate>
   S:        <domain:authInfo>
   S:          <domain:pw>2fooBAR</domain:pw>
   S:        </domain:authInfo>
   S:      </domain:infData>
   S:    </resData>
   S:    <extension>
   S:      <secDNS:infData
   S:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   S:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   S:       secDNS-1.0.xsd">
   S:        <secDNS:dsData>
   S:          <secDNS:keyTag>12345</secDNS:keyTag>
   S:          <secDNS:alg>3</secDNS:alg>
   S:          <secDNS:digestType>1</secDNS:digestType>
   S:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   S:          <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
   S:          <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
   S:          <secDNS:vInterval>P7D</secDNS:vInterval>
   S:        </secDNS:dsData>
   S:      </secDNS:infData>
   S:    </extension>
   S:    <trID>
   S:      <clTRID>ABC-12345</clTRID>
   S:      <svTRID>54322-XYZ</svTRID>
   S:    </trID>
   S:  </response>
   S:</epp>

   An EPP error response MUST be returned if an <info> command can not
   be processed for any reason.

3.1.3  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer>



Hollenbeck               Expires April 5, 2005                 [Page 11]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   command or <transfer> response described in the EPP domain mapping
   [2].

3.2  EPP Transform Commands

   EPP provides five commands to transform objects: <create> to create
   an instance of an object, <delete> to delete an instance of an
   object, <renew> to extend the validity period of an object,
   <transfer> to manage object sponsorship changes, and <update> to
   change information associated with an object.

3.2.1  EPP <create> Command

   This extension defines additional elements for the EPP <create>
   command described in the EPP domain mapping [2].  No additional
   elements are defined for the EPP <create> response.

   The EPP <create> command provides a transform operation that allows a
   client to create a domain object.  In addition to the EPP command
   elements described in the EPP domain mapping [2], the command MUST
   contain an <extension> element.  The <extension> element MUST contain
   a child <secDNS:create> element that identifies the extension
   namespace and the location of the extension schema.  The
   <secDNS:create> element MUST contain either a <secDNS:keyData>
   element or one or more <secDNS:dsData> elements.  Child elements of
   the <secDNS:dsData> element are described in Section 3.1.2.

   The <secDNS:keyData> element contains key and signature data.  Each
   <secDNS:keyData> element contains one or more <secDNS:key> elements.
   Child elements of the <secDNS:key> element are also described in
   Section 3.1.2.

   Example <create> Command for a Secure Delegation with Key Data:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <create>
   C:      <domain:create
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>



Hollenbeck               Expires April 5, 2005                 [Page 12]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   C:          <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          <domain:hostObj>ns2.example.com</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:registrant>jd1234</domain:registrant>
   C:        <domain:contact type="admin">sh8013</domain:contact>
   C:        <domain:contact type="tech">sh8013</domain:contact>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <secDNS:create
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:keyData>
   C:          <secDNS:flags>256</secDNS:flags>
   C:          <secDNS:protocol>3</secDNS:protocol>
   C:          <secDNS:alg>1</secDNS:alg>
   C:          <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:          <secDNS:vInterval>P7D</secDNS:vInterval>
   C:          <secDNS:sig>
   C:            <secDNS:type>DNSKEY</secDNS:type>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:labels>2</secDNS:labels>
   C:            <secDNS:origTTL>172800</secDNS:origTTL>
   C:            <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
   C:            <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
   C:            <secDNS:keyTag>14845</secDNS:keyTag>
   C:            <secDNS:signerName>example.com</secDNS:signerName>
   C:            <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
   C:          </secDNS:sig>
   C:        </secDNS:keyData>
   C:      </secDNS:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example <create> Command for a Secure Delegation with DS Data:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>



Hollenbeck               Expires April 5, 2005                 [Page 13]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   C:    <create>
   C:      <domain:create
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:        <domain:period unit="y">2</domain:period>
   C:        <domain:ns>
   C:          <domain:hostObj>ns1.example.com</domain:hostObj>
   C:          <domain:hostObj>ns2.example.com</domain:hostObj>
   C:        </domain:ns>
   C:        <domain:registrant>jd1234</domain:registrant>
   C:        <domain:contact type="admin">sh8013</domain:contact>
   C:        <domain:contact type="tech">sh8013</domain:contact>
   C:        <domain:authInfo>
   C:          <domain:pw>2fooBAR</domain:pw>
   C:        </domain:authInfo>
   C:      </domain:create>
   C:    </create>
   C:    <extension>
   C:      <secDNS:create
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:dsData>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:          <secDNS:alg>3</secDNS:alg>
   C:          <secDNS:digestType>1</secDNS:digestType>
   C:          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:          <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
   C:          <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
   C:          <secDNS:vInterval>P7D</secDNS:vInterval>
   C:        </secDNS:dsData>
   C:      </secDNS:create>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   When a <create> command has been processed successfully, the EPP
   response is as described in the EPP domain mapping [2].

3.2.2  EPP <delete> Command

   This extension does not add any elements to the EPP <delete> command
   or <delete> response described in the EPP domain mapping [2].





Hollenbeck               Expires April 5, 2005                 [Page 14]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


3.2.3  EPP <renew> Command

   This extension does not add any elements to the EPP <renew> command
   or <renew> response described in the EPP domain mapping [2].

3.2.4  EPP <transfer> Command

   This extension does not add any elements to the EPP <transfer>
   command or <transfer> response described in the EPP domain mapping
   [2].

3.2.5  EPP <update> Command

   This extension defines additional elements for the EPP <update>
   command described in the EPP domain mapping [2].  No additional
   elements are defined for the EPP <update> response.

   The EPP <update> command provides a transform operation that allows a
   client to modify the attributes of a domain object.  In addition to
   the EPP command elements described in the EPP domain mapping, the
   command MUST contain an <extension> element.  The <extension> element
   MUST contain a child <secDNS:update> element that identifies the
   extension namespace and the location of the extension schema.  The
   <secDNS:update> element contains a <secDNS:add> element to add
   security information to a delegation, a <secDNS:rem> element to
   remove security information from a delegation, or a <secDNS:chg>
   element to replace (possibly empty) security information with new
   security information.

   The <secDNS:update> element also contaions an OPTIONAL "urgent"
   attribute that can be used by a client to ask the server operator to
   complete and implement the update request with high priority.  This
   attribute accepts boolean values as described in Section 2.6; the
   default value is boolean false.  "High priority" is relative to
   standard server operator policies that are determined using an
   out-of-band mechanism.

   The <secDNS:add> element is used to add keys to an existing set.  The
   <secDNS:add> element contains a <secDNS:keyData> element whose child
   elements are the same as those listed in the description of the EPP
   <create> command.  The <secDNS:add> element MUST only be used to add
   keys to an existing set; it MUST NOT be used to replace DS data with
   key data, for example.

   The <secDNS:rem> element contains one or more <secDNS:keyTag>
   elements that are used to remove keys from an existing set or DS data
   from a delegation.  The <secDNS:keyTag> element contains a key tag
   value as described in section 2.4 of RFC 3658 [8].  Removing all keys



Hollenbeck               Expires April 5, 2005                 [Page 15]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   or DS data MUST change the status of the delegation to "not secured".

   The <secDNS:chg> element is used to replace an existing key set with
   a new key set and to remove a key set completely.  The <secDNS:chg>
   element MUST contain either a <secDNS:keyData> element or one or more
   <secDNS:dsData> elements as described in Section 3.2.1 and Section
   3.1.2.

   Example <update> Command, Adding a Key:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:add>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:            <secDNS:vInterval>P7D</secDNS:vInterval>
   C:            <secDNS:sig>
   C:              <secDNS:type>DNSKEY</secDNS:type>
   C:              <secDNS:alg>1</secDNS:alg>
   C:              <secDNS:labels>2</secDNS:labels>
   C:              <secDNS:origTTL>172800</secDNS:origTTL>
   C:              <secDNS:sDate>2004-09-14T09:00:00.0Z</secDNS:sDate>
   C:              <secDNS:eDate>2004-10-12T09:00:00.0Z</secDNS:eDate>
   C:              <secDNS:keyTag>14845</secDNS:keyTag>
   C:              <secDNS:signerName>example.com</secDNS:signerName>
   C:              <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
   C:            </secDNS:sig>
   C:          </secDNS:keyData>



Hollenbeck               Expires April 5, 2005                 [Page 16]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   C:        </secDNS:add>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example <update> Command, Replacing a Key Set:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:chg>
   C:          <secDNS:keyData>
   C:            <secDNS:flags>256</secDNS:flags>
   C:            <secDNS:protocol>3</secDNS:protocol>
   C:            <secDNS:alg>1</secDNS:alg>
   C:            <secDNS:pubKey>AQPJ////4Q==</secDNS:pubKey>
   C:            <secDNS:vInterval>P14D</secDNS:vInterval>
   C:            <secDNS:sig>
   C:              <secDNS:type>DNSKEY</secDNS:type>
   C:              <secDNS:alg>1</secDNS:alg>
   C:              <secDNS:labels>2</secDNS:labels>
   C:              <secDNS:origTTL>172800</secDNS:origTTL>
   C:              <secDNS:sDate>2004-09-21T09:00:00.0Z</secDNS:sDate>
   C:              <secDNS:eDate>2004-10-19T09:00:00.0Z</secDNS:eDate>
   C:              <secDNS:keyTag>14845</secDNS:keyTag>
   C:              <secDNS:signerName>example.com</secDNS:signerName>
   C:              <secDNS:sigVal>AzHp////hp4=</secDNS:sigVal>
   C:            </secDNS:sig>
   C:          </secDNS:keyData>
   C:        </secDNS:chg>



Hollenbeck               Expires April 5, 2005                 [Page 17]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example <update> Command, Removing a Key or DS Data:

   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:rem>
   C:          <secDNS:keyTag>12345</secDNS:keyTag>
   C:        </secDNS:rem>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   Example <update> Command, Changing DS Data:














Hollenbeck               Expires April 5, 2005                 [Page 18]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
   C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
   C:     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   C:     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
   C:     epp-1.0.xsd">
   C:  <command>
   C:    <update>
   C:      <domain:update
   C:       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
   C:       domain-1.0.xsd">
   C:        <domain:name>example.com</domain:name>
   C:      </domain:update>
   C:    </update>
   C:    <extension>
   C:      <secDNS:update
   C:       xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
   C:       xsi:schemaLocation="urn:ietf:params:xml:ns:secDNS-1.0
   C:       secDNS-1.0.xsd">
   C:        <secDNS:chg>
   C:          <secDNS:dsData>
   C:            <secDNS:keyTag>12345</secDNS:keyTag>
   C:            <secDNS:alg>3</secDNS:alg>
   C:            <secDNS:digestType>1</secDNS:digestType>
   C:            <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
   C:            <secDNS:sDate>2004-09-21T09:00:00.0Z</secDNS:sDate>
   C:            <secDNS:eDate>2004-10-19T09:00:00.0Z</secDNS:eDate>
   C:            <secDNS:vInterval>P14D</secDNS:vInterval>
   C:          </secDNS:dsData>
   C:        </secDNS:chg>
   C:      </secDNS:update>
   C:    </extension>
   C:    <clTRID>ABC-12345</clTRID>
   C:  </command>
   C:</epp>

   When an extended <update> command has been processed successfully,
   the EPP response is as described in the EPP domain mapping [2].  A
   server operator MUST return an EPP error result code of 2306 if an
   urgent update (noted with an "urgent" attribute value of boolean
   true) can not be completed with high priority.

4.  Formal Syntax

   An EPP object mapping is specified in XML Schema notation.  The
   formal syntax presented here is a complete schema representation of
   the object mapping suitable for automated validation of EPP XML
   instances.  The BEGIN and END tags are not part of the schema; they



Hollenbeck               Expires April 5, 2005                 [Page 19]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   are used to note the beginning and ending of the schema for URI
   registration purposes.

   BEGIN
   <?xml version="1.0" encoding="UTF-8"?>

   <schema targetNamespace="urn:ietf:params:xml:ns:secDNS-1.0"
           xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.0"
           xmlns="http://www.w3.org/2001/XMLSchema"
           elementFormDefault="qualified">

     <annotation>
       <documentation>
         Extensible Provisioning Protocol v1.0
         domain name extension schema for provisioning
         DNS security extensions.
       </documentation>
     </annotation>

   <!--
   Child elements found in EPP commands.
   -->
     <element name="create" type="secDNS:keyOrDSType"/>
     <element name="update" type="secDNS:updateType"/>

   <!--
   Child elements of the <create> command.
   -->
     <complexType name="keyOrDSType">
       <choice>
         <element name="keyData" type="secDNS:keyDataType"
          maxOccurs="unbounded"/>
         <element name="dsData" type="secDNS:dsDataType"
          maxOccurs="unbounded"/>
       </choice>
     </complexType>

     <complexType name="dsDataType">
       <sequence>
         <element name="keyTag" type="unsignedShort"/>
         <element name="alg" type="unsignedByte"/>
         <element name="digestType" type="unsignedByte"/>
         <element name="digest" type="hexBinary"/>
         <element name="sDate" type="dateTime"/>
         <element name="eDate" type="dateTime"/>
         <element name="vInterval" type="duration"
          minOccurs="0"/>
       </sequence>



Hollenbeck               Expires April 5, 2005                 [Page 20]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


     </complexType>

     <complexType name="keyDataType">
       <sequence>
         <element name="flags" type="unsignedShort"/>
         <element name="protocol" type="unsignedByte"/>
         <element name="alg" type="unsignedByte"/>
         <element name="pubKey" type="secDNS:keySigType"/>
         <element name="vInterval" type="duration"
          minOccurs="0"/>
         <element name="sig" type="secDNS:sigType"/>
       </sequence>
     </complexType>

     <complexType name="sigType">
       <sequence>
         <element name="type" type="secDNS:typeCovType"/>
         <element name="alg" type="unsignedByte"/>
         <element name="labels" type="unsignedByte"/>
         <element name="origTTL" type="unsignedInt"/>
         <element name="sDate" type="dateTime"/>
         <element name="eDate" type="dateTime"/>
         <element name="keyTag" type="unsignedShort"/>
         <element name="signerName" type="secDNS:nameType"/>
         <element name="sigVal" type="secDNS:keySigType"/>
       </sequence>
     </complexType>

     <simpleType name="keySigType">
       <restriction base="base64Binary">
         <minLength value="1"/>
       </restriction>
     </simpleType>

     <simpleType name="typeCovType">
       <restriction base="token">
         <enumeration value="DNSKEY"/> <!-- Type 48 -->
       </restriction>
     </simpleType>

     <simpleType name="nameType">
       <restriction base="token">
         <minLength value="1"/>
         <maxLength value="255"/>
       </restriction>
     </simpleType>

   <!--



Hollenbeck               Expires April 5, 2005                 [Page 21]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   Child elements of the <update> command.
   -->
     <complexType name="updateType">
       <choice>
         <element name="add" type="secDNS:addType"/>
         <element name="chg" type="secDNS:keyOrDSType"/>
         <element name="rem" type="secDNS:remType"/>
       </choice>
       <attribute name="urgent" type="boolean" default="false"/>
     </complexType>

     <complexType name="addType">
       <sequence>
         <element name="keyData" type="secDNS:keyDataType"/>
       </sequence>
     </complexType>

     <complexType name="remType">
       <sequence>
         <element name="keyTag" type="unsignedShort"
          maxOccurs="unbounded"/>
       </sequence>
     </complexType>

   <!--
   Child response elements.
   -->
     <element name="infData" type="secDNS:keyOrDSType"/>

   <!--
   End of schema.
   -->
   </schema>
   END

5.  Internationalization Considerations

   EPP is represented in XML, which provides native support for encoding
   information using the Unicode character set and its more compact
   representations including UTF-8 [16].  Conformant XML processors
   recognize both UTF-8 and UTF-16 [17].  Though XML includes provisions
   to identify and use other character encodings through use of an
   "encoding" attribute in an <?xml?> declaration, use of UTF-8 is
   RECOMMENDED in environments where parser encoding support
   incompatibility exists.

   As an extension of the EPP domain mapping [2], the elements, element
   content, attributes, and attribute values described in this document



Hollenbeck               Expires April 5, 2005                 [Page 22]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   MUST inherit the internationalization conventions used to represent
   higher-layer domain and core protocol structures present in an XML
   instance that includes this extension.

6.  IANA Considerations

   This document uses URNs to describe XML namespaces and XML schemas
   conforming to a registry mechanism described in RFC 3688 [11].  Two
   URI assignments are requested.

   Registration request for the extension namespace:

   URI: urn:ietf:params:xml:ns:secDNS-1.0

   Registrant Contact: See the "Author's Address" section of this
   document.

   XML: None.  Namespace URIs do not represent an XML specification.

   Registration request for the extension XML schema:

   URI: uurn:ietf:params:xml:schema:secDNS-1.0

   Registrant Contact: See the "Author's Address" section of this
   document.

   XML: See the "Formal Syntax" section of this document.

7.  Security Considerations

   The mapping extensions described in this document do not provide any
   security services beyond those described by EPP [1], the EPP domain
   name mapping [2], and protocol layers used by EPP.  The security
   considerations described in these other specifications apply to this
   specification as well.

   As with other domain object transforms, the EPP transform operations
   described in this document MUST be restricted to the sponsoring
   client as authenticated using the mechanisms described in sections
   2.9.1.1 and 7 of RFC 3730 [1].  Any attempt to perform a transform
   operation on a domain object by any client other than the sponsoring
   client MUST be rejected with an appropriate EPP authorization error.

   The provisioning service described in this document involves the
   exchange of information that can have an operational impact on the
   DNS.  A trust relationship MUST exist between the EPP client and
   server, and provisioning of public key information MUST only be done
   after the identities of both parties have been confirmed using a



Hollenbeck               Expires April 5, 2005                 [Page 23]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   strong authentication mechanism.

   An EPP client might be acting as an agent for a zone administrator
   who wants to send key information to be signed and published by the
   server operator.  Man-in-the-middle attacks are thus possible as a
   result of direct client activity or inadvertent client data
   manipulation.

   The signature information provided by a client allows a server to
   confirm that the corresponding key is usable and has not been
   modified while in transit, but the server generally does not have
   enough information to confirm that the key was generated and provided
   by the child zone administrator.  Authentication and integrity
   services MUST be provided on a hop-by-hop basis to ensure that data
   is not modified while in transit between entities.

   Acceptance of a false key by a server operator can produce
   significant operational consequences.  The child and parent zones
   MUST be consistent to properly secure the delegation.  In the absence
   of consistent signatures the delegation will not appear in the secure
   name space, yielding untrustworthy query responses.

   If a key is compromised, a client should either remove the
   compromised key or update the DNSKEY/DS information via EPP commands
   using the "urgent" attribute.  The server operator can then remove
   either the DNSSIG of the DS or the DS record itself until the new
   information is propogated to the parent zone.

   Operational scenarios requiring quick removal of a secure domain
   delegation can be implemented using a two-step process.  First,
   security credentials can be removed using an "urgent" update as just
   described.  The domain can then be removed from the parent zone by
   changing the status of the domain to either of the EPP "clientHold"
   or "serverHold" domain status values.  The domain can also be removed
   from the zone using the EPP <delete> command, but this is a more
   drastic step that needs to be considered carefully before use.

   Signature checking at the server requires computational resources.  A
   purposeful or inadvertent denial of service attack is possible if a
   client requests some number of update operations that exceed a
   server's processing capabilities.  Server operators SHOULD take steps
   to manage command load and command processing requirements to
   minimize the risk of a denial of service attack.

8.  Acknowledgements

   The author would like to thank the following people who have provided
   significant contributions to the development of this document:



Hollenbeck               Expires April 5, 2005                 [Page 24]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   David Blacka, Olafur Gudmundsson, Mark Kosters, Dan Massey, and Sam
   Weiler.

9.  References

9.1  Normative References

   [1]   Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", RFC
         3730, March 2004.

   [2]   Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain
         Name Mapping", RFC 3731, March 2004.

   [3]   Paoli, J., Sperberg-McQueen, C., Bray, T. and E. Maler,
         "Extensible Markup Language (XML) 1.0 (Second Edition)", W3C
         REC REC-xml-20001006, October 2000.

   [4]   Maloney, M., Beech, D., Mendelsohn, N. and H. Thompson, "XML
         Schema Part 1: Structures", W3C REC REC-xmlschema-1-20010502,
         May 2001.

   [5]   Malhotra, A. and P. Biron, "XML Schema Part 2: Datatypes", W3C
         REC REC-xmlschema-2-20010502, May 2001.

   [6]   Arends, R., "Protocol Modifications for the DNS Security
         Extensions", draft-ietf-dnsext-dnssec-protocol-08 (work in
         progress), September 2004.

   [7]   Arends, R., "Resource Records for the DNS Security Extensions",
         draft-ietf-dnsext-dnssec-records-10 (work in progress),
         September 2004.

   [8]   Gudmundsson, O., "Delegation Signer (DS) Resource Record (RR)",
         RFC 3658, December 2003.

   [9]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
         Levels", BCP 14, RFC 2119, March 1997.

   [10]  Klyne, G. and C. Newman, "Date and Time on the Internet:
         Timestamps", RFC 3339, July 2002.

   [11]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
         January 2004.

9.2  Informative References

   [12]  Mockapetris, P., "Domain names - concepts and facilities", STD
         13, RFC 1034, November 1987.



Hollenbeck               Expires April 5, 2005                 [Page 25]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


   [13]  Mockapetris, P., "Domain names - implementation and
         specification", STD 13, RFC 1035, November 1987.

   [14]  Wellington, B., "Domain Name System Security (DNSSEC) Signing
         Authority", RFC 3008, November 2000.

   [15]  Lewis, E., "DNS Security Extension Clarification on Zone
         Status", RFC 3090, March 2001.

   [16]  Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD
         63, RFC 3629, November 2003.

   [17]  Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646",
         RFC 2781, February 2000.


Author's Address

   Scott Hollenbeck
   VeriSign, Inc.
   21345 Ridgetop Circle
   Dulles, VA  20166-6503
   US

   EMail: shollenbeck@verisign.com


























Hollenbeck               Expires April 5, 2005                 [Page 26]

Internet-Draft    EPP DNS Security Extensions Mapping       October 2004


Intellectual Property Statement

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.


Disclaimer of Validity

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Copyright Statement

   Copyright (C) The Internet Society (2004).  This document is subject
   to the rights, licenses and restrictions contained in BCP 78, and
   except as set forth therein, the authors retain all their rights.


Acknowledgment

   Funding for the RFC Editor function is currently provided by the
   Internet Society.




Hollenbeck               Expires April 5, 2005                 [Page 27]