1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
|
<pre>Network Working Group S. Boeyen
Request for Comments: 4386 Entrust Inc.
Category: Experimental P. Hallam-Baker
VeriSign Inc.
February 2006
<span class="h1">Internet X.509 Public Key Infrastructure</span>
<span class="h1">Repository Locator Service</span>
Status of This Memo
This memo defines an Experimental Protocol for the Internet
community. It does not specify an Internet standard of any kind.
Discussion and suggestions for improvement are requested.
Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This document defines a Public Key Infrastructure (PKI) repository
locator service. The service makes use of DNS SRV records defined in
accordance with <a href="./rfc2782">RFC 2782</a>. The service enables certificate-using
systems to locate PKI repositories.
Table of Contents
<a href="#section-1">1</a>. Overview ........................................................<a href="#page-2">2</a>
<a href="#section-1.1">1.1</a>. Conventions Used in This Document ..........................<a href="#page-2">2</a>
<a href="#section-2">2</a>. SRV RR Definition ...............................................<a href="#page-2">2</a>
<a href="#section-2.1">2.1</a>. Assignment of New Protocol Prefixes ........................<a href="#page-3">3</a>
<a href="#section-2.2">2.2</a>. Use of Multiple Repositories ...............................<a href="#page-3">3</a>
<a href="#section-2.3">2.3</a>. SRV RR Example .............................................<a href="#page-3">3</a>
<a href="#section-3">3</a>. Security Considerations .........................................<a href="#page-4">4</a>
<a href="#section-4">4</a>. IANA Considerations .............................................<a href="#page-4">4</a>
<a href="#section-5">5</a>. Informative References ..........................................<a href="#page-4">4</a>
<span class="grey">Boeyen & Hallam-Baker Experimental [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc4386">RFC 4386</a> PKIXREP February 2006</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Overview</span>
A number of RFCs (including [<a href="./rfc2559" title=""Internet X.509 Public Key Infrastructure Operational Protocols - LDAPv2"">RFC2559</a>], [<a href="./rfc2560" title=""X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP"">RFC2560</a>], and [<a href="./rfc2585" title=""Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP"">RFC2585</a>]) have
specified operational protocols for retrieval of PKI data, including
public-key certificates and revocation information, from PKI
repositories. These RFCs assume that a certificate-using system has
the information necessary to identify, locate, and connect to the PKI
repository with a specific protocol. Although some tools are
available in protocol-specific environments for this purpose, such as
knowledge references in directory systems, these are restricted for
use with a single protocol and do not share a common means of
publication. This document provides a solution to this problem
through the use of Service Record (SRV) Resource Records (RRs) in
DNS. This solution is expected to be particularly useful in
environments where only a domain name is available. In other
situations (e.g., where a certificate is available that contains the
required information), such a DNS lookup is not needed.
[<a id="ref-RFC2782">RFC2782</a>] defines a DNS RR for specifying the location of services
(SRV). This document defines SRV records for a PKI repository
locator service to enable PKI clients to obtain the necessary
information to connect to a domain's PKI repository, including
information about each protocol that is supported by that domain for
access to its repository. This document includes the definition of
an SRV RR format for this service and an example of its potential use
in an email environment.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Conventions Used in This Document</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT",
"RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase,
as shown) are to be interpreted as described in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
In examples, "C:" and "S:" indicate lines sent by the client and
server, respectively.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. SRV RR Definition</span>
The format of the SRV RR, whose DNS type code is 33, is:
_Service._Proto.Name TTL Class SRV Priority Weight Port Target
For the PKI repository locator service, this document uses the
symbolic name "PKIXREP". Note that when used in an SRV RR, this name
MUST be prepended with an "_" character.
<span class="grey">Boeyen & Hallam-Baker Experimental [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc4386">RFC 4386</a> PKIXREP February 2006</span>
The protocols that can be included in PKIXREP SRV RRs are:
Protocol SRV Prefix
LDAP _LDAP
HTTP _HTTP
OCSP _OCSP
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. Assignment of New Protocol Prefixes</span>
Protocol prefix assignments for new PKIX repository protocols SHOULD
be defined in the document that specifies the protocol.
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. Use of Multiple Repositories</span>
The existence of multiple repositories MAY be determined by making
separate DNS queries for each of the protocols supported by the
client.
If this approach is found to be unacceptably inefficient due to a
proliferation of repository protocols at a future date, the service
discovery protocol could be extended to allow the repository to
advertise the protocols supported.
<span class="h3"><a class="selflink" id="section-2.3" href="#section-2.3">2.3</a>. SRV RR Example</span>
This example uses the fictional domain "example.com" as an aid in
understanding the use of SRV records by a certificate-using system.
Assume that Alice is an email client that needs a certificate for a
recipient. Alice's client system supports LDAP for certificate
retrieval. Assume the message recipient is Bob and that Bob's email
address is bob@example.com. Assume that example.test maintains a
"border directory" PKI repository and that Bob's certificate is
available from that directory, "border.example.com", via LDAP.
Alice's client system retrieves, via DNS, the SRV record for
_PKIXREP._LDAP.example.com.
- The QNAME of the DNS query is _PKIXREP._LDAP.example.com.
- The QCLASS of the DNS query is IN.
- The QTYPE of the DNS query is SRV.
The result SHOULD include the host address for example.com's border
directory system.
<span class="grey">Boeyen & Hallam-Baker Experimental [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc4386">RFC 4386</a> PKIXREP February 2006</span>
Note that if example.com operated its service on a number of hosts,
more than one SRV RR would be returned. In this case, <a href="./rfc2782">RFC 2782</a>
defines the procedure to be followed in determining which of these
should be accessed first.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Security Considerations</span>
Security issues regarding PKI repositories themselves are outside the
scope of this document. For LDAP repositories, for example, specific
security considerations are addressed in <a href="./rfc2559">RFC 2559</a>.
Security issues with respect to the use of SRV records in general are
addressed in <a href="./rfc2782">RFC 2782</a>, and these issues apply to the use of SRV
records in the context of the PKIXREP service defined here.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. IANA Considerations</span>
This document reserves the use of "_PKIXREP" service label. Since
this relates to a service that may pass messages over a number of
different message transports, each message must be associated with a
specific transport.
In order to ensure that the association between "_PKIXREP" and their
respective underlying services is deterministic, the IANA has created
a new registry: PKIX SRV Protocol Labels.
For this registry, an entry shall consist of a label name and a
pointer to a specification describing how the protocol named in the
label uses SRV. Specifications should conform to the requirements
listed in [<a href="./rfc2434" title="">RFC2434</a>] for "specification required".
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Informative References</span>
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC2434">RFC2434</a>] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", <a href="https://www.rfc-editor.org/bcp/bcp26">BCP 26</a>, <a href="./rfc2434">RFC 2434</a>,
October 1998.
[<a id="ref-RFC2559">RFC2559</a>] Boeyen, S., Howes, T., and P. Richard, "Internet X.509
Public Key Infrastructure Operational Protocols - LDAPv2",
<a href="./rfc2559">RFC 2559</a>, April 1999.
[<a id="ref-RFC2560">RFC2560</a>] Myers, M., Ankney, R., Malpani, A., Galperin, S., and C.
Adams, "X.509 Internet Public Key Infrastructure Online
Certificate Status Protocol - OCSP", <a href="./rfc2560">RFC 2560</a>, June 1999.
<span class="grey">Boeyen & Hallam-Baker Experimental [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc4386">RFC 4386</a> PKIXREP February 2006</span>
[<a id="ref-RFC2585">RFC2585</a>] Housley, R. and P. Hoffman, "Internet X.509 Public Key
Infrastructure Operational Protocols: FTP and HTTP", <a href="./rfc2585">RFC</a>
<a href="./rfc2585">2585</a>, May 1999.
[<a id="ref-RFC2782">RFC2782</a>] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
specifying the location of services (DNS SRV)", <a href="./rfc2782">RFC 2782</a>,
February 2000.
Authors' Addresses
Sharon Boeyen
Entrust
1000 Innovation Drive
Ottawa, Ontario
Canada K2K 3E7
EMail: sharon.boeyen@entrust.com
Phillip M. Hallam-Baker
VeriSign Inc.
401 Edgewater Place, Suite 280
Wakefield MA 01880
EMail: pbaker@VeriSign.com
<span class="grey">Boeyen & Hallam-Baker Experimental [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc4386">RFC 4386</a> PKIXREP February 2006</span>
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
Boeyen & Hallam-Baker Experimental [Page 6]
</pre>
|
