You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6834 lines
320 KiB
6834 lines
320 KiB
<?xml version="1.0" encoding="iso-8859-1"?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>XML Key Management Specification (XKMS)</title>
|
|
<meta name="SectionLabel" content="XKMS_2_0_LC2_" />
|
|
<style type="text/css">
|
|
<!--
|
|
p.Code { font-size: 9pt; background-color: #00ffa7; background-repeat: repeat;
|
|
background-attachment: scroll; font-family: Courier;
|
|
margin-left: 0.5in; margin-right: 0.5in; margin-top: 0in;
|
|
margin-bottom: 0pt }
|
|
a.markParagraph { font-size: 8pt }
|
|
p.toc1 { text-align: left; font-size: 14pt; margin-left: 1pt; margin-top: 6pt;
|
|
margin-bottom: 1pt }
|
|
p.toc2 { line-height: 100%; font-size: 12pt; margin-top: 4pt; margin-bottom: 0pt }
|
|
p.toc3 { line-height: 100%; margin-top: 2pt; margin-bottom: 10pt }
|
|
span.ID { font-family: Courier }
|
|
pre.Code { font-size: 9pt; background-color: #ffffa7; background-repeat: repeat;
|
|
background-attachment: scroll; font-family: Courier;
|
|
margin-left: 0in; margin-right: 0in; margin-top: 0in;
|
|
margin-bottom: 0pt }
|
|
pre.Example { font-size: 9pt; background-color: #d2e9ff; background-repeat: repeat;
|
|
background-attachment: scroll; font-family: Courier;
|
|
margin-left: 0in; margin-right: 0in; margin-top: 0in;
|
|
margin-bottom: 0pt }
|
|
p.Comment { font-size: 8pt; color: #d2e9ff; background-repeat: repeat;
|
|
background-attachment: scroll; font-family: Courier; color:
|
|
#0000FF; font-style: italic; margin-left: 0.5in; margin-right:
|
|
0.5in }
|
|
th.ID { font-family: Courier }
|
|
c2 td.ID { font-family: Courier }
|
|
p.center { text-align: center }
|
|
p.caption { text-align: center }
|
|
p.warning { font-weight: bold }
|
|
h1.appendix { page-break-before: always }
|
|
div.center { text-align: center }
|
|
:link { color: #0000FF }
|
|
:visited { color: #800080 }
|
|
span.c32 { background-color: #FFFF00 }
|
|
span.c25 { color: red }
|
|
span.c13 { font-family: Arial }
|
|
-->
|
|
|
|
|
|
</style>
|
|
<link rel="stylesheet" type="text/css"
|
|
href="http://www.w3.org/StyleSheets/TR/W3C-WD.css" />
|
|
</head>
|
|
|
|
<body xml:lang="EN-US" lang="EN-US">
|
|
|
|
<div class="head">
|
|
<a href="http://www.w3.org/"><img src="http://www.w3.org/Icons/w3c_home"
|
|
alt="W3C" height="48" width="72" /></a>
|
|
|
|
<h1 id="title"><a name="XKMS_2_0_LC2_Section_Marker_1"></a>XML Key Management
|
|
Specification (XKMS)</h1>
|
|
|
|
<h2 id="version"><a name="XKMS_2_0_LC2_Section_Marker_2"></a>Version 2.0</h2>
|
|
|
|
<h2 id="W3C-doctype"><a name="XKMS_2_0_LC2_Section_Marker_3"></a> <a
|
|
name="Masthead" id="Masthead">W3C Working Draft 18 April 2003</a></h2>
|
|
<dl>
|
|
<dt>This version:</dt>
|
|
<dd><a
|
|
href="http://www.w3.org/TR/2003/WD-xkms2-20030418/">http://www.w3.org/TR/2003/WD-xkms2-20030418/</a> </dd>
|
|
<dt>Latest version:</dt>
|
|
<dd><a
|
|
href="http://www.w3.org/TR/xkms2/">http://www.w3.org/TR/xkms2/</a> </dd>
|
|
<dt>Previous version:</dt>
|
|
<dd><a
|
|
href="http://www.w3.org/TR/2002/WD-xkms2-20020318/">http://www.w3.org/TR/2002/WD-xkms2-20020318/</a></dd>
|
|
<dt>Editor:</dt>
|
|
<dd><a href="mailto:pbaker@verisign.com">Phillip Hallam-Baker</a>
|
|
VeriSign</dd>
|
|
<dt>Contributors:</dt>
|
|
<dd>See the <a href="#Acknowledgments">Acknowledgments</a>.</dd>
|
|
</dl>
|
|
|
|
<p class="copyright"><a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a>
|
|
© 2003 <a href="http://www.w3.org/"><abbr
|
|
title="World Wide Web Consortium">W3C</abbr></a><sup>®</sup> (<a
|
|
href="http://www.lcs.mit.edu/"><abbr
|
|
title="Massachusetts Institute of Technology">MIT</abbr></a>, <a
|
|
href="http://www.ercim.org/"><abbr
|
|
title="European Research Consortium for Informatics and Mathematics">ERCIM</abbr></a>,
|
|
<a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>,
|
|
<a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a>,
|
|
<a href="http://www.w3.org/Consortium/Legal/copyright-documents">document
|
|
use</a> and <a
|
|
href="http://www.w3.org/Consortium/Legal/copyright-software">software
|
|
licensing</a> rules apply.</p>
|
|
<hr title="Separator from Header" />
|
|
</div>
|
|
|
|
<div>
|
|
<h2 class="Abstract"><a name="XKMS_2_0_LC2_Section_Marker_4"
|
|
id="XKMS_2_0_LC2_Section_Marker_4"></a> <a id="abstract"
|
|
name="abstract">Abstract</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_2" id="XKMS_2_0_LC2_Paragraph_2"
|
|
class="markParagraph">[2]</a>This document specifies protocols for
|
|
distributing and registering public keys, suitable for use in conjunction
|
|
with the proposed standard for XML Signature <a href="#XML-SIG">[XML-SIG]</a>
|
|
and XML Encryption [<a href="#XML-Enc">XML-Enc</a>]. <a
|
|
href="http://www.w3.org/TR/xkms2/">The XML Key Management Specification
|
|
(XKMS)</a> comprises two parts — the XML Key Information Service
|
|
Specification (X-KISS) and the XML Key Registration Service Specification
|
|
(X-KRSS).</p>
|
|
|
|
<h2 class="NoNumber"><a name="XKMS_2_0_LC2_Section_Marker_5"
|
|
id="XKMS_2_0_LC2_Section_Marker_5"></a> <a name="status" id="status">Status
|
|
of this document</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_3" id="XKMS_2_0_LC2_Paragraph_3"
|
|
class="markParagraph">[3]</a>This is a Last Call for the "XML Key Management
|
|
Specification" as <a
|
|
href="http://lists.w3.org/Archives/Public/www-xkms/2003Apr/0022.html">agreed
|
|
to</a> by the <a href="http://www.w3c.org/2001/XKMS/Drafts/">XKMS Working
|
|
Group</a> (<a href="http://www.w3.org/2001/XKMS/Activity.html">Activity
|
|
Statement</a>). The Last Call review period ends in 5 weeks on <em>23 May
|
|
2003</em>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_4" id="XKMS_2_0_LC2_Paragraph_4"
|
|
class="markParagraph">[4]</a>Please send comments to the editor (<<a
|
|
href="mailto:pbaker@verisign.com">pbaker@verisign.com</a>>) and cc: the
|
|
working group mailing list <a
|
|
href="mailto:www-xkms@w3.org">www-xkms@w3.org</a> (<a
|
|
href="http://lists.w3.org/Archives/Public/www-xkms/">archive</a>)</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_5" id="XKMS_2_0_LC2_Paragraph_5"
|
|
class="markParagraph">[5]</a>The Working Group will try to <a
|
|
href="http://www.w3.org/1999/10/nsuri">use a new namespace</a> when changes
|
|
in its syntax or processing are substantive. However, this namespace might be
|
|
reused (prior to reaching Candidate Recommendation) by subsequent drafts in
|
|
such a way as to cause instances using the namespace to become invalid or to
|
|
change in meaning or affect the operation of existing software. Requests for
|
|
a more stringent level of namespace stability should be made to the Working
|
|
Group.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_6" id="XKMS_2_0_LC2_Paragraph_6"
|
|
class="markParagraph">[6]</a>Publication of this document does not imply
|
|
endorsement by the W3C membership. This is a draft document and may be
|
|
updated, replaced or obsoleted by other documents at any time. It is
|
|
inappropriate to cite a W3C Working Draft as anything other than a "work in
|
|
progress." A list of current W3C working drafts can be found at <a
|
|
href="http://www.w3.org/TR/">http://www.w3.org/TR/</a>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_7" id="XKMS_2_0_LC2_Paragraph_7"
|
|
class="markParagraph">[7]</a>Patent disclosures relevant to this
|
|
specification may be found on the Working Group's <a
|
|
href="http://www.w3.org/2001/XKMS/Disclosures.html">patent disclosure
|
|
page</a> in conformance with W3C policy.</p>
|
|
</div>
|
|
|
|
<h2 class="TableOfContents"><a name="XKMS_2_0_LC2_Section_Marker_6"
|
|
id="XKMS_2_0_LC2_Section_Marker_6"></a> <a name="TableOfContents"
|
|
id="TableOfContents">Table Of Contents</a></h2>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_Marker_1">XML Key Management
|
|
Specification (XKMS)</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_Marker_2">Version 2.0</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_Marker_3">W3C Working Draft 18
|
|
April 2003</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_Marker_4">Abstract</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_Marker_5">Status of this
|
|
document</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_Marker_6">Table Of
|
|
Contents</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_1">1 Introduction</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_1">1.1 Editorial and
|
|
Conformance Conventions</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_2">1.2
|
|
Acknowledgments</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_3">1.3 Definition of
|
|
Terms</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_4">1.4 Versions Namespaces
|
|
and Identifiers</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_5">1.5 Key Information
|
|
Service Specification Overview (Non-Normative)</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_6">1.6 Key Registration
|
|
Service Specification Overview (Non-Normative)</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_1_7">1.7 Structure of this
|
|
document</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_2">2 Message Format</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_1">2.1 All Messages</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_2">2.2 Request Types</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_3">2.3 Responses</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_4">2.4 Synchronous and
|
|
Asynchronous Processing</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_5">2.5 Asynchronous
|
|
Processing</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_6">2.6 Two Phase Request
|
|
Protocol</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_7">2.7 Two Phase Protocol
|
|
with Asynchronous Processing</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_8">2.8 Compound Requests and
|
|
Responses</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_2_9">2.9 Security
|
|
Binding</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_3">3 Message Syntax</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_3_1">3.1 Message Base</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_3_2">3.2 Request
|
|
Message</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_3_3">3.3 Response
|
|
Messages</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_3_4">3.4 Compound
|
|
Requests</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_3_5">3.5 Status Request</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_4">4 Key Information Service
|
|
Overview</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_4_1">4.1 XKISS Locate
|
|
Service</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_4_2">4.2 XKISS: Validate
|
|
Service</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_4_3">4.3 Using Locate and
|
|
Validate</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_5">5 Key Information Service
|
|
Message Set</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_5_1">5.1 Key Binding
|
|
Specification</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_5_2">5.2 Locate Service</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_5_3">5.3 Validate
|
|
Service</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_6">6 Key Registration Service
|
|
Overview</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_6_1">6.1 Registration</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_6_2">6.2 Reissue</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_6_3">6.3 Revocation</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_6_4">6.4 Key Recovery</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_6_5">6.5 Request
|
|
Authentication</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_7">7 Key Registration Service
|
|
Message Set</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_7_1">7.1 Common
|
|
Elements</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_7_2">7.2 Register</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_7_3">7.3 Reissue</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_7_4">7.4 Revoke</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_7_5">7.5 Recover</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_8">8 Cryptographic Algorithm
|
|
Specific Parameters</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_8_1">8.1 Use of Limited-Use
|
|
Shared Secret Data</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_8_2">8.2 Private Key
|
|
Parameters</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_9">9 Conformance</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_10">10 Security
|
|
Considerations</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_1">10.1 Replay
|
|
Attacks</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_2">10.2 Denial of
|
|
Service</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_3">10.3 Recovery
|
|
Policy</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_4">10.4 Security of Limited
|
|
Use Shared Secret</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_5">10.5 Confidentiality of
|
|
Opaque Client Data</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_6">10.6 Security of Not
|
|
Bound Authentication Data</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_7">10.7 Signature
|
|
Oracle</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_8">10.8 Privacy</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_9">10.9 Security of the
|
|
Private Key</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_10_10">10.10 Message Length
|
|
Disclosure Vulnerabilities</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_Appendix_A">Appendix A
|
|
Schemas</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_A_1">A.1 XKMS Schema</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_Appendix_B">Appendix B Service
|
|
Location Configuration</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_B_1">B.1 Domain Name Service
|
|
(DNS)</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_Appendix_C">Appendix C Sample
|
|
Protocol Exchanges</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_C_1">C.1 Authentication
|
|
Computation</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_C_2">C.2 Pass Phrase
|
|
Computation</a></p>
|
|
|
|
<p class="toc2"><a href="#XKMS_2_0_LC2_Section_C_3">C.3 Private Key
|
|
Parameters</a></p>
|
|
|
|
<p class="toc1"><a href="#XKMS_2_0_LC2_Section_Appendix_D">Appendix D
|
|
References</a></p>
|
|
<!-- <h2 class="TableOfFigures">Table of Figures</h2>
|
|
<p class="Comment">To be generated</p> -->
|
|
<hr title="Separator from Header" />
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_1" id="XKMS_2_0_LC2_Section_1">1</a> <a
|
|
name="Introduction" id="Introduction">Introduction</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_8" id="XKMS_2_0_LC2_Paragraph_8"
|
|
class="markParagraph">[8]</a>This document specifies protocols for
|
|
distributing and registering public keys, suitable for use in conjunction
|
|
with the standard for XML Signatures <a href="#XML-SIG">[XML-SIG]</a> defined
|
|
by the World Wide Web Consortium (W3C) and the Internet Engineering Task
|
|
Force (IETF) and companion standard for XML encryption <a
|
|
href="#XML-Enc">[XML-ENC]</a>. The XML Key Management Specification
|
|
(XKMS) comprises two parts -- the XML Key Information Service Specification
|
|
(X-KISS) and the XML Key Registration Service Specification (X-KRSS).</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_9" id="XKMS_2_0_LC2_Paragraph_9"
|
|
class="markParagraph">[9]</a>These protocols do not require any particular
|
|
underlying public key infrastructure (such as X.509) but are designed to be
|
|
compatible with such infrastructures.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_10" id="XKMS_2_0_LC2_Paragraph_10"
|
|
class="markParagraph">[10]</a>This document comprises the following service
|
|
specifications:</p>
|
|
<dl>
|
|
<dt>XML Key Information Service Specification: </dt>
|
|
<dd>A protocol to support the delegation by an application to a service
|
|
of the processing of key information associated with an XML signature,
|
|
XML encryption, or other usage of the XML Signature <a
|
|
href="#XML-SIG">[XML-SIG]</a><span class="ID"><ds:KeyInfo></span>
|
|
element. </dd>
|
|
<dt>XML Key Registration Service Specification: </dt>
|
|
<dd>A protocol to support the registration of a key pair by a key pair
|
|
holder, with the intent that the key pair subsequently be usable in
|
|
conjunction with the XML Key Information Service Specification or a
|
|
Public Key Infrastructure (PKI) such as <a href="#x509">[X.509]</a><a
|
|
href="#pkix">[PKIX]</a>.</dd>
|
|
</dl>
|
|
|
|
<p>While this specification uses the terms "trust" and "policy" informally,
|
|
it does not define semantics nor processing associated with either.
|
|
Instead,it only defines how a Validate Service returns information that has
|
|
been validated according to external trust and policy specifications. In
|
|
fact, the benefit of an XKMS Validate Service is that it provides a front end
|
|
to different security and PKI technologies with their own particular
|
|
semantics.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_1" id="XKMS_2_0_LC2_Section_1_1">1.1</a>
|
|
<a id="sec-Editorial" name="sec-Editorial">Editorial</a> and Conformance
|
|
Conventions</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_11" id="XKMS_2_0_LC2_Paragraph_11"
|
|
class="markParagraph">[11]</a>This specification uses XML Schemas [<a
|
|
href="#XML-Schema1">XML-schema</a>] to describe the content model.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_12" id="XKMS_2_0_LC2_Paragraph_12"
|
|
class="markParagraph">[12]</a>The key words "MUST", "MUST NOT", "REQUIRED",
|
|
"SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
|
|
"OPTIONAL" in this specification are to be interpreted as described in <a
|
|
href="http://www.ietf.org/rfc/rfc2119.txt">RFC2119</a> [<a
|
|
href="#ref-KEYWORDS">KEYWORDS</a>]:</p>
|
|
|
|
<blockquote>
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_13" id="XKMS_2_0_LC2_Paragraph_13"
|
|
class="markParagraph">[13]</a>"they MUST only be used where it is actually
|
|
required for interoperation or to limit behavior which has potential for
|
|
causing harm (e.g., limiting retransmissions)"</p>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_14" id="XKMS_2_0_LC2_Paragraph_14"
|
|
class="markParagraph">[14]</a>Consequently, we use these capitalized keywords
|
|
to unambiguously specify requirements over protocol and application features
|
|
and behavior that affect the interoperability and security of
|
|
implementations. These key words are not used (capitalized) to describe XML
|
|
grammar; schema definitions unambiguously describe such requirements and we
|
|
wish to reserve the prominence of these terms for the natural language
|
|
descriptions of protocols and features. For instance, an XML attribute might
|
|
be described as being "optional." Compliance with the XML-namespace
|
|
specification [<a href="#ref-XML-ns">XML-NS</a>] is described as
|
|
"REQUIRED."</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_2" id="XKMS_2_0_LC2_Section_1_2">1.2</a>
|
|
<a name="Acknowledgments" id="Acknowledgments">Acknowledgments</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_15" id="XKMS_2_0_LC2_Paragraph_15"
|
|
class="markParagraph">[15]</a>The contributions of the following Working
|
|
Group members to this specification are gratefully acknowledged in accordance
|
|
with the <a href="http://www.w3.org/2001/XKMS/Contributor.html">contributor
|
|
policies</a> and the active <a
|
|
href="http://www.w3.org/2001/XKMS/Participants.html">WG roster</a>.</p>
|
|
<ul>
|
|
<li>Daniel Ash, Identrus</li>
|
|
<li>Blair Dillaway, Microsoft</li>
|
|
<li>Donald Eastlake 3rd, Motorola</li>
|
|
<li>Yassir Elley, Sun Microsystems</li>
|
|
<li>Jeremy Epstein, webMethods</li>
|
|
<li>Stephen Farrell, Baltimore (Co-Chair)</li>
|
|
<li>Phillip Hallam-Baker, VeriSign Inc. (Editor)</li>
|
|
<li>Loren Hart, VeriSign Inc.</li>
|
|
<li>Mack Hicks, Bank of America</li>
|
|
<li>Merlin Hughes, Baltimore</li>
|
|
<li>Frederick Hirsch, Nokia Mobile Phones</li>
|
|
<li>Mike Just, Treasury Board of Canada Secretariat</li>
|
|
<li>Brian LaMacchia, Microsoft</li>
|
|
<li>Pradeep Lamsal</li>
|
|
<li>Shivaram Mysore, Sun Microsystems (Co-Chair)</li>
|
|
<li>Joseph Reagle, W3C</li>
|
|
<li>Dave Remy, GeoTrust, Inc.</li>
|
|
<li>Peter Rostin, RSA Security Inc.</li>
|
|
<li>Ed Simon, XMLsec Inc.</li>
|
|
<li>Slava Galperin, Sun Microsystems</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_16" id="XKMS_2_0_LC2_Paragraph_16"
|
|
class="markParagraph">[16]</a>The authors also acknowledge the extensive
|
|
assistance provided in the design stage of this specification by David Solo
|
|
(CitiGroup), and the contributions of Jeremy Epstein, (webMethods), Andrew
|
|
Layman (Microsoft), Dr Paul Boisen (NSA), Dan Guinan, Marc Hayes,
|
|
Alex Deacon, Mingliang Pei (VeriSign).</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_3" id="XKMS_2_0_LC2_Section_1_3">1.3</a>
|
|
<a name="DefinitionofTerms" id="DefinitionofTerms">Definition of
|
|
Terms</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_17" id="XKMS_2_0_LC2_Paragraph_17"
|
|
class="markParagraph">[17]</a>The following terms are used within this
|
|
document with the particular meaning indicated below:</p>
|
|
|
|
<blockquote>
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_18"
|
|
id="XKMS_2_0_LC2_Paragraph_18" class="markParagraph">[18]</a> <b>Service<br
|
|
/>
|
|
</b> An application that provides computational or
|
|
informational resources on request. A service may be provided by several
|
|
physical servers operating as a unit.</p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_19"
|
|
id="XKMS_2_0_LC2_Paragraph_19" class="markParagraph">[19]</a> <b>Web
|
|
service<br />
|
|
</b> A service that is accessible by means of messages
|
|
sent using standard web protocols, notations and naming conventions</p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_20"
|
|
id="XKMS_2_0_LC2_Paragraph_20" class="markParagraph">[20]</a> <b>Client<br
|
|
/>
|
|
</b> An application that makes requests of a
|
|
service. The concept of 'client' is relative to a service request; an
|
|
application may have the role of client for some requests and service for
|
|
others.</p>
|
|
</blockquote>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_4" id="XKMS_2_0_LC2_Section_1_4">1.4</a>
|
|
<a name="Namespaces" id="Namespaces">Versions Namespaces and
|
|
Identifiers</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_21" id="XKMS_2_0_LC2_Paragraph_21"
|
|
class="markParagraph">[21]</a>No provision is made for an explicit version
|
|
number in this syntax. If a future version is needed, it will use a different
|
|
namespace. The XML namespace [<a href="#ref-XML-ns">XML-ns</a>] URI that MUST
|
|
be used by implementations of this (dated) specification is:</p>
|
|
<pre class="xml-example"> http://www.w3.org/2002/03/xkms#</pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_22" id="XKMS_2_0_LC2_Paragraph_22"
|
|
class="markParagraph">[22]</a>This namespace is also used as the prefix for
|
|
algorithm identifiers used by this specification. While applications MUST
|
|
support XML and XML namespaces, the use of internal entities [<a
|
|
href="#ref-XML">XML</a>] or the "xkms" XML namespace prefix and
|
|
defaulting/scoping conventions are OPTIONAL; we use these facilities to
|
|
provide compact and readable examples.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_23" id="XKMS_2_0_LC2_Paragraph_23"
|
|
class="markParagraph">[23]</a>In this document, certain namespace prefixes
|
|
represent certain namespaces in the schema fragments (shown on a yellow
|
|
background) as follows:</p>
|
|
|
|
<div class="center">
|
|
|
|
<table border="1" cellspacing="0" cellpadding="3">
|
|
<tbody>
|
|
<tr>
|
|
<td>Prefix </td>
|
|
<td>Specification </td>
|
|
<td>Schema</td>
|
|
</tr>
|
|
<tr>
|
|
<td align="left"> </td>
|
|
<td align="left">XML Schema</td>
|
|
<td class="ID" align="left">http://www.w3.org/2001/XMLSchema</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="ID" align="left">ds</td>
|
|
<td align="left">XML Signature</td>
|
|
<td class="ID" align="left">http://www.w3.org/2000/09/xmldsig#</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="ID" align="left">xenc</td>
|
|
<td align="left">XML Encryption</td>
|
|
<td class="ID" align="left">http://www.w3.org/2001/04/xmlenc#</td>
|
|
</tr>
|
|
<tr>
|
|
<td class="ID" align="left">xkms</td>
|
|
<td align="left">XKMS</td>
|
|
<td class="ID" align="left">http://www.w3.org/2002/03/xkms#</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_24" id="XKMS_2_0_LC2_Paragraph_24"
|
|
class="markParagraph">[24]</a>For clarity, some examples of XML are not
|
|
complete documents and namespace declarations may be omitted from XML
|
|
fragments.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_25" id="XKMS_2_0_LC2_Paragraph_25"
|
|
class="markParagraph">[25]</a>In all examples (shown on a light blue
|
|
background) and in the body of the text the default namespace refers to the
|
|
xkms namespace itself. This means that namespace prefixes are omitted for all
|
|
element names, type names and QNames in the <span class="ID">xkms</span>
|
|
namespace. For example the QName <span class="ID">xkms:Success</span> is
|
|
referred to using the local name part <span class="ID">Success</span>
|
|
alone.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_26" id="XKMS_2_0_LC2_Paragraph_26"
|
|
class="markParagraph">[26]</a>These namespaces are declared in the XKMS
|
|
schema as follows:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"><?xml version="1.0"?>
|
|
<schema targetNamespace="http://www.w3.org/2002/03/xkms#"
|
|
xmlns:xkms="http://www.w3.org/2002/03/xkms#"
|
|
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
xmlns="http://www.w3.org/2001/XMLSchema"
|
|
elementFormDefault="qualified" attributeFormDefault="unqualified">
|
|
<import namespace="http://www.w3.org/2000/09/xmldsig#"
|
|
schemaLocation="xmldsig-core-schema.xsd"/>
|
|
<import namespace="http://www.w3.org/2001/04/xmlenc#"
|
|
schemaLocation="xenc-schema.xsd"/>
|
|
<annotation>
|
|
<documentation xml:lang="en">
|
|
XML Schema for XKMS 2.0 Last Call Candidate 2003
|
|
</documentation>
|
|
</annotation>
|
|
<!-- /Namespace --></pre>
|
|
<pre class="Code"> ...</pre>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- End Schema -->
|
|
</schema></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_27" id="XKMS_2_0_LC2_Paragraph_27"
|
|
class="markParagraph">[27]</a>Internet Protocol addresses and Domain Name
|
|
System names used in examples are purposely chosen to avoid confusion with
|
|
assigned addresses and names. All Internet Protocol Addresses are in the
|
|
reserved non-routable network 10.x.x.x. All DNS names are in the reserved
|
|
domain <span class="ID">example.com</span>.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_5" id="XKMS_2_0_LC2_Section_1_5">1.5</a>
|
|
<a name="KISSOverview" id="KISSOverview">Key Information Service
|
|
Specification Overview</a> (Non-Normative)</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_28" id="XKMS_2_0_LC2_Paragraph_28"
|
|
class="markParagraph">[28]</a>X-KISS allows a client to delegate part or all
|
|
of the tasks required to process XML Signature <a
|
|
href="#XML-SIG">[XML-SIG]</a><span class="ID"><font
|
|
face="Courier"><ds:KeyInfo></font></span> elements to an XKMS service.
|
|
A key objective of the protocol design is to minimize the complexity of
|
|
applications using XML Signature <a href="#XML-SIG">[XML-SIG]</a>. By
|
|
becoming a client of the XKMS service, the application is relieved of the
|
|
complexity and syntax of the underlying PKI used to establish trust
|
|
relationships, which may be based upon a different specification such as
|
|
X.509/PKIX, SPKI or PGP.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_29" id="XKMS_2_0_LC2_Paragraph_29"
|
|
class="markParagraph">[29]</a>By design, the XML Signature specification <a
|
|
href="#XML-SIG">[XML-SIG]</a> does not mandate use of a particular trust
|
|
policy. The signer of a document is not required to include any key
|
|
information but may include a <span class="ID"><ds:KeyInfo></span>
|
|
element that specifies the key itself, a key name, X.509 certificate, a PGP
|
|
key identifier etc. Alternatively, a link may be provided to a location where
|
|
the full <span class="ID"><ds:KeyInfo></span> information may be
|
|
found.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_30" id="XKMS_2_0_LC2_Paragraph_30"
|
|
class="markParagraph">[30]</a>The information provided by the signer may
|
|
therefore be insufficient by itself to perform cryptographic verification and
|
|
decide whether to trust the signing key, or the information may not be in a
|
|
format the client can use. For example:</p>
|
|
<ul type="disc">
|
|
<li>The key may be specified by a name only.</li>
|
|
<li>The local trust policy of the client may require additional information
|
|
in order to trust the key.</li>
|
|
<li>The key may be encoded in an X.509 certificate that the client cannot
|
|
parse.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_31" id="XKMS_2_0_LC2_Paragraph_31"
|
|
class="markParagraph">[31]</a>In the case of an encryption operation:</p>
|
|
<ul type="disc">
|
|
<li>The client may not know the public key of the recipient.</li>
|
|
</ul>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_6" id="XKMS_2_0_LC2_Section_1_6">1.6</a>
|
|
<a name="KRSSOverview" id="KRSSOverview">Key Registration Service
|
|
Specification Overview</a> (Non-Normative)</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_32" id="XKMS_2_0_LC2_Paragraph_32"
|
|
class="markParagraph">[32]</a>X-KRSS describes a protocol for registration
|
|
and subsequent management of public key information. A client of a conforming
|
|
service may request that the registration service bind information to a
|
|
public key. The information bound may include a name, an identifier or
|
|
extended attributes defined by the implementation.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_33" id="XKMS_2_0_LC2_Paragraph_33"
|
|
class="markParagraph">[33]</a>The key pair to which the information is bound
|
|
may be generated in advance by the client or on request generated by the
|
|
service. The Registration protocol may also be used for subsequent management
|
|
operations including recovery of the private key and reissue or revocation of
|
|
the key binding.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_34" id="XKMS_2_0_LC2_Paragraph_34"
|
|
class="markParagraph">[34]</a>The protocol provides for authentication of the
|
|
applicant and, in the case that the key pair is generated by the client,
|
|
Proof of Possession (POP) of the private key. A means of communicating the
|
|
private key to the client is provided in the case that the private key is
|
|
generated by the registration service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_35" id="XKMS_2_0_LC2_Paragraph_35"
|
|
class="markParagraph">[35]</a>This document specifies means of registering
|
|
RSA and DSA keys and a framework for extending the protocol to support other
|
|
cryptographic algorithms such as Diffie-Hellman and Elliptic Curve
|
|
variants.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_1_7" id="XKMS_2_0_LC2_Section_1_7">1.7</a>
|
|
<a name="Structure" id="Structure">Structure</a> of this document</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_36" id="XKMS_2_0_LC2_Paragraph_36"
|
|
class="markParagraph">[36]</a>The remainder of this document describes the
|
|
XML Key Information Service Specification and XML Key Registration Service
|
|
Specification.</p>
|
|
<dl>
|
|
<dt><b>Section 2</b>: Message Format</dt>
|
|
<dd>Features of the XKMS that are common to the XKMS services are
|
|
described</dd>
|
|
<dt><b>Section 3</b>: Key Information Service Specification Overview.</dt>
|
|
<dd>The functional behavior of the X-KISS service is described.</dd>
|
|
<dt><b>Section 4</b>: Key Information Service Specification Message
|
|
Set.</dt>
|
|
<dd>The semantics of the X-KISS protocol messages are defined.</dd>
|
|
<dt><b>Section 5</b>: Key Registration Service Specification Overview.</dt>
|
|
<dd>The functional behavior of the X-KRSS service is described.</dd>
|
|
<dt><b>Section 6</b>: Key Registration Service Specification Message
|
|
Set.</dt>
|
|
<dd>The semantics of the X-KRSS protocol messages is defined.</dd>
|
|
<dt><b>Section 7</b>: Cryptographic Algorithm Specific Parameters</dt>
|
|
<dd>Parameters and data formats specific to the use of particular
|
|
cryptographic algorithms are defined.</dd>
|
|
<dt><b>Section 8</b>: Security Considerations</dt>
|
|
<dd>Security considerations for implementation and deployment of XKMS are
|
|
described</dd>
|
|
</dl>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_2" id="XKMS_2_0_LC2_Section_2">2</a> <a
|
|
name="MessageFormat" id="MessageFormat">Message Format</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_37" id="XKMS_2_0_LC2_Paragraph_37"
|
|
class="markParagraph">[37]</a>XKMS protocol exchanges consist of a sequence
|
|
of either one or two request response pairs.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_38" id="XKMS_2_0_LC2_Paragraph_38"
|
|
class="markParagraph">[38]</a>XKMS protocol messages share a common format
|
|
that may be carried within a variety of protocols. A binding to the
|
|
SOAP <a href="#SOAP">[SOAP]</a><a href="#XMLP">[XMLP]</a> message
|
|
protocol is provided in Part II: Protocol Bindings. It is recommended XKMS
|
|
implementers support SOAP over HTTP for interoperability purposes. XKMS is
|
|
transport protocol agnostic however and MAY be layered over any SOAP
|
|
transport.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_39" id="XKMS_2_0_LC2_Paragraph_39"
|
|
class="markParagraph">[39]</a>Implementers MAY implement bindings to other
|
|
protocols at their option.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_40" id="XKMS_2_0_LC2_Paragraph_40"
|
|
class="markParagraph">[40]</a>No XKMS operations are idempotent, that is all
|
|
XKMS requests MAY cause a change of state.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_41" id="XKMS_2_0_LC2_Paragraph_41"
|
|
class="markParagraph">[41]</a> <a
|
|
href="http://www.w3.org/TR/2003/WD-xkms2-bindings-20030418/">Part II of this
|
|
specification</a> describes the XKMS Security Protocol bindings.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_42" id="XKMS_2_0_LC2_Paragraph_42"
|
|
class="markParagraph">[42]</a>The XKMS protocol consists of pairs of requests
|
|
and responses. The XKMS protocol binding allows for the case in which an
|
|
additional request/response round trip is required to support cases such as
|
|
pending responses and 2 phase requests for replay attack protection.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_43" id="XKMS_2_0_LC2_Paragraph_43"
|
|
class="markParagraph">[43]</a>Each XKMS response message contains a <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code that
|
|
determines whether the response is final or further processing is required.
|
|
The protocol is specified in the formalism <a href="#CSP">[CSP]</a> as
|
|
follows:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><i>Final</i> = { <i>Success</i>, <i>VersionMismatch</i>,
|
|
<i>Sender</i>, <i>Receiver</i> }</dt>
|
|
<dd> </dd>
|
|
<dt><i>Request</i> <span class="ID">→</span>
|
|
<i>Result</i>.<i>Final</i></dt>
|
|
<dd>|</dd>
|
|
<dt><i>Request</i> <span class="ID">→</span>
|
|
<i>Result</i>.<i>Pending</i><span class="ID">→</span><span
|
|
class="ID"><i>PendingNotification</i>→</span><i>Request</i><span
|
|
class="ID">→</span><i>Result</i>.<i>Final</i></dt>
|
|
<dd>|</dd>
|
|
<dt><i>Request</i> <span class="ID">→</span>
|
|
<i>Result</i>.<i>Represent</i><span
|
|
class="ID">→</span><i>Request</i><span
|
|
class="ID">→</span><i>Result</i>.<i>Final</i></dt>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_44" id="XKMS_2_0_LC2_Paragraph_44"
|
|
class="markParagraph">[44]</a>The following sections describe the message
|
|
protocol and the message processing steps taken by both parties in each of
|
|
the message</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_1" id="XKMS_2_0_LC2_Section_2_1">2.1</a>
|
|
<a name="AllMessages" id="AllMessages">All Messages</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_45" id="XKMS_2_0_LC2_Paragraph_45"
|
|
class="markParagraph">[45]</a>The following processing steps are taken with
|
|
respect to all messages regardless of whether they are a request or a
|
|
response:</p>
|
|
<dl>
|
|
<dt>Generation</dt>
|
|
<dd><span class="ID">ID</span> is set to a randomly generated unique
|
|
value</dd>
|
|
<dd><span class="ID">Service</span> is set to the value of the URI to
|
|
which the XKMS request is directed<br />
|
|
Authentication Signature is generated (if required).</dd>
|
|
<dt>Processing</dt>
|
|
<dd>The value of <span class="ID">Service</span> is verified<br />
|
|
The Authentication Signature value is verified (if required)</dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_1_1"
|
|
id="XKMS_2_0_LC2_Section_2_1_1">2.1.1</a>Example</h3>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<MessageAbstractType Id="1noOYHt5Lx7xUuizWZLOMw=="
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_2" id="XKMS_2_0_LC2_Section_2_2">2.2</a>
|
|
<a name="MessageRequestTypes" id="MessageRequestTypes">Request Types</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_46" id="XKMS_2_0_LC2_Paragraph_46"
|
|
class="markParagraph">[46]</a>The XKMS specification defines three types of
|
|
request:</p>
|
|
<dl>
|
|
<dt>X-KISS Request</dt>
|
|
<dd>A Locate or Validate request as specified by the Key Information
|
|
Service Specification</dd>
|
|
<dt>X-KRSS Request</dt>
|
|
<dd>A Register, Reissue, Revoke or Recover request as specified by the
|
|
Key Information Service Specification</dd>
|
|
<dt>Compound Request</dt>
|
|
<dd>A compound request consists of a set of one or more X-KISS or X-KRSS
|
|
requests.</dd>
|
|
</dl>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_47" id="XKMS_2_0_LC2_Paragraph_47"
|
|
class="markParagraph">[47]</a>The XKMS protocol supports a number of protocol
|
|
options, including asynchronous processing, two-phase requests and compound
|
|
requests. The client specifies the protocol options it supports in relation
|
|
to a specific request through <font face="Courier">ResponseMechanism</font>
|
|
elements in the request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_48" id="XKMS_2_0_LC2_Paragraph_48"
|
|
class="markParagraph">[48]</a>The means by which the service specifies
|
|
protocol options which it accepts is outside the scope of this document. If
|
|
the mechanism used for this purpose uses URI based identifiers for this
|
|
purpose the following identifiers SHOULD be used:</p>
|
|
<dl>
|
|
<dt>Asynchronous Processing</dt>
|
|
<dd>http://www.w3.org/2002/03/xkms#Asynchronous</dd>
|
|
<dt>Two Phase Request Protocol</dt>
|
|
<dd>http://www.w3.org/2002/03/xkms#Represent</dd>
|
|
<dt>Compound Requests and Responses</dt>
|
|
<dd>http://www.w3.org/2002/03/xkms#Compound</dd>
|
|
</dl>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_3" id="XKMS_2_0_LC2_Section_2_3">2.3</a>
|
|
<a name="Responses" id="Responses">Responses</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_49" id="XKMS_2_0_LC2_Paragraph_49"
|
|
class="markParagraph">[49]</a>All XKMS responses contain a Result code
|
|
comprised of a major and minor component. If a service applies a protocol
|
|
processing option the client is informed by means of the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code value of the
|
|
response.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_4" id="XKMS_2_0_LC2_Section_2_4">2.4</a>
|
|
<a name="SynchronousandAsynchronous"
|
|
id="SynchronousandAsynchronous">Synchronous and Asynchronous</a>
|
|
Processing</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_50" id="XKMS_2_0_LC2_Paragraph_50"
|
|
class="markParagraph">[50]</a>XKMS supports two processing modes, synchronous
|
|
processing and asynchronous processing.</p>
|
|
<ul>
|
|
<li>In synchronous processing the service responds to a request such
|
|
that it has satisfied its obligation and will issue no more responses
|
|
with respect to that request: a response code in the set <i>Final</i>
|
|
defined above is returned.</li>
|
|
<li>In asynchronous processing the service will not complete the request
|
|
immediately and notifies that the request is not yet satisfied and
|
|
subsequent responses will be forthcoming: a response code that is not in
|
|
the set <i>Final</i> is returned in intermediate responses.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_51" id="XKMS_2_0_LC2_Paragraph_51"
|
|
class="markParagraph">[51]</a>A client MAY advise a service that it will
|
|
accept asynchronous processing of a request by specifying the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Asynchronous</font>. An XKMS service advises the client that
|
|
the response value will be returned asynchronously by specifying the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code <font
|
|
face="Courier">Pending</font>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_52" id="XKMS_2_0_LC2_Paragraph_52"
|
|
class="markParagraph">[52]</a>An XKMS service MUST NOT return the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code <font
|
|
face="Courier">Pending</font> unless the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Asynchronous</font> was specified in the corresponding
|
|
request. If an XKMS service receives a request that cannot be processed
|
|
synchronously and the <font face="Courier">ResponseMechanism</font> value
|
|
<font face="Courier">Asynchronous</font> is not specified the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code <font
|
|
face="Courier">Receiver</font> and <font face="Courier"><span
|
|
class="ID">MinorResult</span></font> code<span
|
|
class="ID">NotSynchronous</span> are returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_53" id="XKMS_2_0_LC2_Paragraph_53"
|
|
class="markParagraph">[53]</a>Asynchronous processing MAY be used to allow
|
|
administrator intervention during the processing of a request. For example an
|
|
administrator might be required to verify and approve all XKRSS Registration
|
|
requests before they are processed.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_4_1"
|
|
id="XKMS_2_0_LC2_Section_2_4_1">2.4.1</a> <a
|
|
name="SynchronousRequestResponse" id="SynchronousRequestResponse">Synchronous
|
|
Request / Response</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_54" id="XKMS_2_0_LC2_Paragraph_54"
|
|
class="markParagraph">[54]</a>Processing of a synchronous Request and
|
|
Response takes place as follows:</p>
|
|
<dl>
|
|
<dt>Requestor generation of the Request Message</dt>
|
|
<dd><span class="ID">Nonce</span> and <font face="Courier"><span
|
|
class="ID">OriginalRequestID</span></font> are not present<br />
|
|
<span class="ID">RespondWith</span> values <font face="Courier"><span
|
|
class="ID">Represent</span></font> and/or <font face="Courier"><span
|
|
class="ID"></span></font><span class="ID">Asynchronous</span> MAY be
|
|
specified</dd>
|
|
<dt>Service processing of the Request Message</dt>
|
|
<dd><i>Verify that request meets service authorization policy<br />
|
|
Process request to completion</i></dd>
|
|
<dt>Service generation of the Response Message</dt>
|
|
<dd><span class="ID">RequestID</span> is set to the value of <font
|
|
face="Courier">Id</font> in the request message</dd>
|
|
<dd><span class="ID">Nonce</span> is not present<br />
|
|
<span class="ID">MajorResult</span> is set to a Final result value.</dd>
|
|
<dt>Requestor processing of the Response Message</dt>
|
|
<dd><i>The value of <span class="ID">RequestID</span> is verified</i></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_4_2"
|
|
id="XKMS_2_0_LC2_Section_2_4_2">2.4.2</a>Example</h3>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_4_2_1"
|
|
id="XKMS_2_0_LC2_Section_2_4_2_1">2.4.2.1</a>Request</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest Id="I72b7f6439ae0dd3e45363d18a6d649fc"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<QueryKeyBinding />
|
|
</LocateRequest></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_4_2_2"
|
|
id="XKMS_2_0_LC2_Section_2_4_2_2">2.4.2.2</a>Response</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult Id="I2bc6874c94cbd8b8dd94b05fa3e2f084"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I72b7f6439ae0dd3e45363d18a6d649fc"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_5" id="XKMS_2_0_LC2_Section_2_5">2.5</a>
|
|
<a name="AsynchronousProcessing" id="AsynchronousProcessing">Asynchronous
|
|
Processing</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_55" id="XKMS_2_0_LC2_Paragraph_55"
|
|
class="markParagraph">[55]</a>Asynchronous processing consists of a sequence
|
|
of two request/response pairs, an initial request which specifies the request
|
|
values and a pending request which obtains the result of the operation.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_5_1"
|
|
id="XKMS_2_0_LC2_Section_2_5_1">2.5.1</a>Initial Request</h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_56" id="XKMS_2_0_LC2_Paragraph_56"
|
|
class="markParagraph">[56]</a>The initial request message is processed as
|
|
follows:</p>
|
|
<dl>
|
|
<dt>Requestor generation of the Initial Request Message</dt>
|
|
<dd><span class="ID">Nonce</span> and <font face="Courier"><span
|
|
class="ID">OriginalRequestID</span></font> are not present<br />
|
|
<span class="ID">RespondWith</span> value <font face="Courier"><span
|
|
class="ID">A</span></font><span class="ID">synchronous</span> MUST be
|
|
specified</dd>
|
|
<dt>Service processing of the Initial Request Message</dt>
|
|
<dd><i>Schedule request for asynchronous processing</i></dd>
|
|
<dt>Service generation of the Initial Response Message</dt>
|
|
<dd><span class="ID">RequestID</span> is set to the value <font
|
|
face="Courier">Id</font> in the initial request message</dd>
|
|
<dd><span class="ID">Nonce</span> is not present</dd>
|
|
<dd><span class="ID">MajorResult</span> is set to <font
|
|
face="Courier"><span class="ID">Asynchronous</span></font></dd>
|
|
<dt>Requestor processing of the Initial Response Message</dt>
|
|
<dd><i>Register request as pending completion, wait for
|
|
notification.</i></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_5_2"
|
|
id="XKMS_2_0_LC2_Section_2_5_2">2.5.2</a>Pending Request</h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_57" id="XKMS_2_0_LC2_Paragraph_57"
|
|
class="markParagraph">[57]</a>On notification the client requests the return
|
|
of the result values by issuing a <font face="Courier">PendingRequest</font>
|
|
message as follows:</p>
|
|
<dl>
|
|
<dt>Requestor generation of the Pending Request Message</dt>
|
|
<dd>The request element is <font face="Courier">PendingRequest</font></dd>
|
|
<dd><span class="ID">OriginalRequestID</span> is set to the value of
|
|
<font face="Courier">Id</font> in the initial request message<br />
|
|
<span class="ID">ResponseID</span> is set to value of <font
|
|
face="Courier">Id</font> in the initial response message</dd>
|
|
<dt>Service processing of the Pending Request Message</dt>
|
|
<dd><i>Match pending request to pending response</i></dd>
|
|
<dt>Service generation of the Pending Response Message</dt>
|
|
<dd><span class="ID">RequestID</span> is set to the value of <font
|
|
face="Courier">Id</font> in the Pending request message</dd>
|
|
<dd><span class="ID">Nonce</span> is not present</dd>
|
|
<dd><span class="ID">ResponseID</span> is set to a randomly generated
|
|
unique value</dd>
|
|
<dt>Requestor processing of the Pending Response Message</dt>
|
|
<dd><i>If <span class="ID">MajorResult</span> is set to a non-final
|
|
value consider it to be <font face="Courier">failure</font></i></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_5_3"
|
|
id="XKMS_2_0_LC2_Section_2_5_3">2.5.3</a>Example</h3>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_5_3_1"
|
|
id="XKMS_2_0_LC2_Section_2_5_3_1">2.5.3.1</a>Request</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest Id="I1221aaad701f0aacc65444c9bb93a7c0"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>Pending</RespondWith>
|
|
<QueryKeyBinding />
|
|
</LocateRequest></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_5_3_2"
|
|
id="XKMS_2_0_LC2_Section_2_5_3_2">2.5.3.2</a>Response</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult Id="I2251cfc37bc354a95c3d6a36661c990d"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Pending"
|
|
RequestId="#I1221aaad701f0aacc65444c9bb93a7c0"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_5_3_3"
|
|
id="XKMS_2_0_LC2_Section_2_5_3_3">2.5.3.3</a>Notification</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<Result xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
xmlns="http://www.w3.org/2002/03/xkms#"/></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_5_3_4"
|
|
id="XKMS_2_0_LC2_Section_2_5_3_4">2.5.3.4</a>Pending Request</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<PendingRequest Id="I4294d3993de300c1ef54d49bd0903b2d"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
OriginalRequestId="#I1221aaad701f0aacc65444c9bb93a7c0"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_5_3_5"
|
|
id="XKMS_2_0_LC2_Section_2_5_3_5">2.5.3.5</a>Response</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult Id="If91f068062d27f8f5892df0de3bb18aa"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Idbdf93883e29a3f1f505d6fe9d0c5979"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_6" id="XKMS_2_0_LC2_Section_2_6">2.6</a>
|
|
<a name="TwoPhaseRequest" id="TwoPhaseRequest">Two Phase Request</a>
|
|
Protocol</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_58" id="XKMS_2_0_LC2_Paragraph_58"
|
|
class="markParagraph">[58]</a>XKMS requests may employ a two phase request
|
|
protocol to protect against a denial of service attack. The two phase request
|
|
protocol allows the service to perform a lightweight authentication of the
|
|
source of an XKMS request, specifically the service determines that the
|
|
client is able to read messages sent to the purported source address.
|
|
Although this mechanism provides only a weak form of authentication it
|
|
prevents an attacker performing a Denial of Service attack by forcing the
|
|
service to perform a resource intensive form of authentication such as the
|
|
verification of a digital signature.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_59" id="XKMS_2_0_LC2_Paragraph_59"
|
|
class="markParagraph">[59]</a>The two-phase protocol consists of two phases
|
|
as follows:</p>
|
|
|
|
<blockquote>
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_60" id="XKMS_2_0_LC2_Paragraph_60"
|
|
class="markParagraph">[60]</a>In the first phase the requestor presents the
|
|
request and the service responds the <span class="ID">MajorResult</span>
|
|
value <span class="ID">Represent</span> and presents a nonce.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_61" id="XKMS_2_0_LC2_Paragraph_61"
|
|
class="markParagraph">[61]</a>In the second phase the requestor represents
|
|
the original request together with the nonce.</p>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_62" id="XKMS_2_0_LC2_Paragraph_62"
|
|
class="markParagraph">[62]</a>A client MAY advise a service that it supports
|
|
the two phase request protocol by specifying the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Represent</font>. An XKMS service advises the client that the
|
|
use of the two phase request protocol is required by specifying the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code <font
|
|
face="Courier">Represent</font>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_63" id="XKMS_2_0_LC2_Paragraph_63"
|
|
class="markParagraph">[63]</a>An XKMS service MUST NOT return the <font
|
|
face="Courier"><span class="ID">MajorResult</span></font> code <font
|
|
face="Courier">Represent</font> unless the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Represent</font> was specified in the corresponding request.
|
|
If an XKMS service requires the use of the Two Phase Request protocol and the
|
|
<font face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Represent</font> is not specified in the corresponding request
|
|
the <font face="Courier"><span class="ID">MajorResult</span></font> code
|
|
<font face="Courier">Receiver</font> and <font face="Courier"><span
|
|
class="ID">MinorResult</span></font> code<span
|
|
class="ID">MustRepresent</span> are returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_64" id="XKMS_2_0_LC2_Paragraph_64"
|
|
class="markParagraph">[64]</a>The Two Phase request protocol bears some
|
|
similarity to asynchronous request processing. Both mechanisms introduce an
|
|
extra protocol round trip but each serve different purposes. The purpose of
|
|
asynchronous processing is to allow a delay to be introduced between the
|
|
initial request and the return of the result. In the two phase request
|
|
protocol however there is no delay between the first request and the first
|
|
response or between the first response and the second request. The purpose of
|
|
the two phase request protocol is to allow a service to protect itself
|
|
against a denial of service attack by allowing the service to perform a
|
|
lightweight authentication of the source of the request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_65" id="XKMS_2_0_LC2_Paragraph_65"
|
|
class="markParagraph">[65]</a>The service SHOULD verify that the nonce value
|
|
specified in a second phase request was recently generated by the service.
|
|
The service MAY verify that the nonce value has not been previously responded
|
|
to. The actual construction of the nonce value is outside the scope of this
|
|
specification and may be chosen as site specific circumstances dictate. The
|
|
techniques described in the section <a href="#idsandnonces">Construction of
|
|
Nonce Values</a> describe a technique that reduces or avoids the need to
|
|
maintain server state in order to meet this requirement.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_6_1"
|
|
id="XKMS_2_0_LC2_Section_2_6_1">2.6.1</a>Processing Steps</h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_66" id="XKMS_2_0_LC2_Paragraph_66"
|
|
class="markParagraph">[66]</a>In the first phase of the two phase protocol
|
|
the processing steps specified for the single phase case are performed with
|
|
the following exceptions:</p>
|
|
<dl>
|
|
<dt>Requestor generation of the Phase 1 Request Message</dt>
|
|
<dd><span class="ID">RespondWith</span> value <font face="Courier"><span
|
|
class="ID">Represent</span></font> MUST be specified</dd>
|
|
<dt>Service processing of the Phase 1 Request Message</dt>
|
|
<dd><i>Service decides to exercise option to require Two Phase
|
|
Processing</i></dd>
|
|
<dd><i>Request is NOT processed</i></dd>
|
|
<dt>Service generation of the Phase 1 Response Message</dt>
|
|
<dd><span class="ID">RequestID</span> is set to the value <font
|
|
face="Courier">Id</font> in the Phase 1 request message</dd>
|
|
<dd><span class="ID">Nonce</span> value is set in accordance with service
|
|
replay protection requirements</dd>
|
|
<dd><span class="ID">MajorResult</span> is set to <span
|
|
class="ID">Represent</span></dd>
|
|
<dt>Requestor processing of the Phase 1 Response Message</dt>
|
|
<dd><i>Proceed to phase 2</i></dd>
|
|
</dl>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_67" id="XKMS_2_0_LC2_Paragraph_67"
|
|
class="markParagraph">[67]</a>In the Second phase of the two phase protocol
|
|
the processing steps specified for the single phase case are performed with
|
|
the following exceptions:</p>
|
|
<dl>
|
|
<dt>Requestor generation of the Phase 2 Request Message</dt>
|
|
<dd><span class="ID">OriginalRequestID</span> set to the value of
|
|
<font face="Courier">Id</font> in the Phase 1 request message<br />
|
|
<span class="ID">Nonce</span> value is set to the value of <span
|
|
class="ID">Nonce</span> in the Phase 1 response message</dd>
|
|
<dt>Service processing of the Phase 2 Request Message</dt>
|
|
<dd><i>Verify value of <span class="ID">Nonce</span></i></dd>
|
|
<dd><i>Verify that request meets service authorization policy<br />
|
|
Process request to completion</i></dd>
|
|
<dt>Service generation of the Phase 2 Response Message</dt>
|
|
<dd><span class="ID">RequestID</span> is set to the value of <font
|
|
face="Courier">Id</font> in the Phase2 request message</dd>
|
|
<dd><span class="ID">Nonce</span> is not present<br />
|
|
<span class="ID">MajorResult</span> is set to a Final result value</dd>
|
|
<dt>Requestor processing of the Phase 2 Response Message</dt>
|
|
<dd><i>If <span class="ID">MajorResult</span> set to a non-final value
|
|
consider to be failure</i></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_6_2"
|
|
id="XKMS_2_0_LC2_Section_2_6_2">2.6.2</a> <a name="idsandnonces"
|
|
id="idsandnonces">Construction of Nonce Values</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_68" id="XKMS_2_0_LC2_Paragraph_68"
|
|
class="markParagraph">[68]</a>Nonce values may be constructed so as to permit
|
|
the service to determine that they were generated by the server at a specific
|
|
time in a computationally efficient manner as follows.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_69" id="XKMS_2_0_LC2_Paragraph_69"
|
|
class="markParagraph">[69]</a>The nonce is constructed from the current time
|
|
at the service, a unique serial number and a secret key known only to the
|
|
service using a Message Authentication Code as follows:</p>
|
|
|
|
<blockquote>
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_70" id="XKMS_2_0_LC2_Paragraph_70"
|
|
class="markParagraph">[70]</a> <i>nonce</i> = <i>time</i> + <i>serial</i> +
|
|
<i>M</i> ( <i>time</i> + <i>serial</i> , <i>k</i> )</p>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_71" id="XKMS_2_0_LC2_Paragraph_71"
|
|
class="markParagraph">[71]</a>The service may limit the time interval in
|
|
which replay attacks are possible by rejecting nonce values that specify an
|
|
unacceptable time value or an incorrect MAC value.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_72" id="XKMS_2_0_LC2_Paragraph_72"
|
|
class="markParagraph">[72]</a>The service may prevent replay attacks
|
|
completely by tracking the serial numbers for which responses have already
|
|
been given, using the nonce time construction value to limit the interval
|
|
over which the serial number is tracked.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_73" id="XKMS_2_0_LC2_Paragraph_73"
|
|
class="markParagraph">[73]</a>The nonce value may be encrypted to avoid
|
|
leaking information such as the serial number value which might be of
|
|
interest to an attacker.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_6_3"
|
|
id="XKMS_2_0_LC2_Section_2_6_3">2.6.3</a>Example</h3>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_6_3_1"
|
|
id="XKMS_2_0_LC2_Section_2_6_3_1">2.6.3.1</a>Request 1</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest Id="I59dd0055e74da7b1d6b6d7ac6695e60c"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>Represent</RespondWith>
|
|
<QueryKeyBinding />
|
|
</LocateRequest></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_6_3_2"
|
|
id="XKMS_2_0_LC2_Section_2_6_3_2">2.6.3.2</a>Response 1</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult Id="I181e6922d7a282a317b7456ca969050d"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
Nonce="2gxX8Mr0E2RxFjzsS2N5qw==" ResultMajor="Represent"
|
|
RequestId="#I59dd0055e74da7b1d6b6d7ac6695e60c"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_6_3_3"
|
|
id="XKMS_2_0_LC2_Section_2_6_3_3">2.6.3.3</a>Request 2</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest Id="Idbdf93883e29a3f1f505d6fe9d0c5979"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
Nonce="2gxX8Mr0E2RxFjzsS2N5qw=="
|
|
OriginalRequestId="#I59dd0055e74da7b1d6b6d7ac6695e60c"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<QueryKeyBinding />
|
|
</LocateRequest></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_6_3_4"
|
|
id="XKMS_2_0_LC2_Section_2_6_3_4">2.6.3.4</a>Response 2</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult Id="I6795e6816cc0f243d76bca9e65e4ee20"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Idbdf93883e29a3f1f505d6fe9d0c5979"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_7" id="XKMS_2_0_LC2_Section_2_7">2.7</a>
|
|
<a name="TwoPhaseProtocolwithAsynchronous"
|
|
id="TwoPhaseProtocolwithAsynchronous">Two Phase Protocol with
|
|
Asynchronous</a> Processing</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_74" id="XKMS_2_0_LC2_Paragraph_74"
|
|
class="markParagraph">[74]</a>The Two Phase Protocol may be combined with
|
|
Asynchronous Processing. In this case the operation will consist of three
|
|
round trips as follows:</p>
|
|
<ul>
|
|
<li>Initial Request / Phase 1</li>
|
|
<li>Initial Request / Phase 2</li>
|
|
<li>Pending Response</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_75" id="XKMS_2_0_LC2_Paragraph_75"
|
|
class="markParagraph">[75]</a>Message processing is performed as described
|
|
above with the following exceptions.</p>
|
|
<ul>
|
|
<li><span class="ID">OriginalRequestID</span> set to that value of
|
|
<font face="Courier">Id</font> in Initial Request / Phase 1 in
|
|
<i>both</i> subsequent requests.</li>
|
|
<li><span class="ID">Nonce</span> value is set to the value of <span
|
|
class="ID">Nonce</span> in Phase 1 response in <i>both</i> subsequent
|
|
requests.</li>
|
|
</ul>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_8" id="XKMS_2_0_LC2_Section_2_8">2.8</a>
|
|
<a name="CompoundRequestsandResponses"
|
|
id="CompoundRequestsandResponses">Compound Requests and Responses</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_76" id="XKMS_2_0_LC2_Paragraph_76"
|
|
class="markParagraph">[76]</a>A Web Service MAY support processing of
|
|
Compound Requests. A compound request permits multiple XKMS requests to be
|
|
made at the same time. A compound request consists of an outer request and
|
|
one or more inner requests. There is no ordering implicit in the inner
|
|
requests. The semantics of making a set of requests as a compound request are
|
|
exactly the same as if each individual request in the set had been made
|
|
separately and simultaneously.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_77" id="XKMS_2_0_LC2_Paragraph_77"
|
|
class="markParagraph">[77]</a>The response to a compound request is a
|
|
compound response. A compound response consists of an outer response and zero
|
|
or more inner responses. If the <font face="Courier">ResultMajor</font> value
|
|
of the outer response is <font face="Courier">Success</font> the compound
|
|
response SHOULD contain an inner response response element corresponding to
|
|
each inner request element of the compound request. If the the <font
|
|
face="Courier">ResultMajor</font> value of the outer response is not
|
|
<font face="Courier">Success</font> the response MUST NOT contain any inner
|
|
responses. If a compound response has an outer <font
|
|
face="Courier">ResultMajor</font> value <font face="Courier">Success</font>
|
|
but does not contain a response corresponding to an inner request the <font
|
|
face="Courier">ResultMajor</font> value <font face="Courier">failure</font>
|
|
is assumed for that inner request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_78" id="XKMS_2_0_LC2_Paragraph_78"
|
|
class="markParagraph">[78]</a>A Web Service MAY support the use of the two
|
|
phase protocol on the outer request of a compound response. The two phase
|
|
protocol SHOULD NOT be used on an inner response. If an inner request
|
|
specifies the <font face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Represent</font> the value SHOULD be ignored.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_79" id="XKMS_2_0_LC2_Paragraph_79"
|
|
class="markParagraph">[79]</a>A Web Service MAY support the use of
|
|
asynchronous processing in conjunction with a compound request. Asynchronous
|
|
processing MAY be performed on the compound request as a whole, on individual
|
|
inner requests or both.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_80" id="XKMS_2_0_LC2_Paragraph_80"
|
|
class="markParagraph">[80]</a>If asynchronous processing is to be performed
|
|
on the compound request as a whole the outer request specifies the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Asynchronous</font>. If the service decides to return an
|
|
asynchronous response a compound response is returned with a ResultMajor code
|
|
of <span class="ID">Pending</span>. After the appropriate notification has
|
|
taken place the client issues a <font face="Courier">PendingRequest</font>
|
|
message for the outer request to which the service replies with a compound
|
|
response returning either the inner responses corresponding to the original
|
|
inner requests or an error report.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_81" id="XKMS_2_0_LC2_Paragraph_81"
|
|
class="markParagraph">[81]</a>If asynchronous processing is performed on the
|
|
individual inner requests each inner request for which an asynchronous
|
|
response is to be accepted specifies the <font
|
|
face="Courier">ResponseMechanism</font> value <font
|
|
face="Courier">Asynchronous</font>. If the service decides to return an
|
|
asynchronous response to an inner request a compound response is returned
|
|
with an outer <font face="Courier">ResultMajor</font> code of <font
|
|
face="Courier">Success</font> and and inner <font
|
|
face="Courier">ResultMajor</font> code of <font face="Courier">Pending</font>
|
|
for the requests for which an asynchronous response is to be issued. A
|
|
service MAY return synchronous and asynchronous responses in a single
|
|
compound response.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_82" id="XKMS_2_0_LC2_Paragraph_82"
|
|
class="markParagraph">[82]</a>Since the semantics of a compound request are
|
|
exactly the same as if each inner request were made separately a client MAY
|
|
issue separate pending requests to obtain the results of the inner requests
|
|
of a previous compound request. Alternatively a client MAY issue a compound
|
|
request containing multiple inner pending requests corresponding to requests
|
|
which were originally made independently.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_2_8_1"
|
|
id="XKMS_2_0_LC2_Section_2_8_1">2.8.1</a>Example</h3>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_8_1_1"
|
|
id="XKMS_2_0_LC2_Section_2_8_1_1">2.8.1.1</a>Request 1</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<CompoundRequest Id="Ie383fac377f1e54d2b26596c072b8b7a"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<LocateRequest Id="I97a5c09bff0fe094d27facf5e5adb206"
|
|
Service="http://test.xmltrustcenter.org/XKMS">
|
|
<RespondWith>KeyValue</RespondWith>
|
|
<QueryKeyBinding>
|
|
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
|
|
<X509Data>
|
|
<X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=</X509Certificate>
|
|
</X509Data>
|
|
</KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
</QueryKeyBinding>
|
|
</LocateRequest>
|
|
<LocateRequest Id="Icf173d33d71c80c74589c6204f7aeb4f"
|
|
Service="http://test.xmltrustcenter.org/XKMS">
|
|
<RespondWith>KeyName</RespondWith>
|
|
<RespondWith>KeyValue</RespondWith>
|
|
<RespondWith>X509Cert</RespondWith>
|
|
<RespondWith>X509Chain</RespondWith>
|
|
<RespondWith>PGPWeb</RespondWith>
|
|
<RespondWith>PGP</RespondWith>
|
|
<QueryKeyBinding>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2440"
|
|
Identifier="bob@bobcorp.test"/>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="bob@bobcorp.test"/>
|
|
</QueryKeyBinding>
|
|
</LocateRequest>
|
|
</CompoundRequest></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_2_8_1_2"
|
|
id="XKMS_2_0_LC2_Section_2_8_1_2">2.8.1.2</a>Response 1</h4>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<CompoundResult Id="I884904b526e40cb235be62e3ae1f6f0b"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Ie383fac377f1e54d2b26596c072b8b7a"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<LocateResult Id="I9a6b68811ebf06e4a2e3f5e6e56f0d28"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I97a5c09bff0fe094d27facf5e5adb206">
|
|
<UnverifiedKeyBinding Id="I8510127a93f6e926833e7a622409e955">
|
|
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
|
|
<KeyValue>
|
|
<RSAKeyValue>
|
|
<Modulus>zvbTdKsTprGAKJdgi7ulDR0eQBptLv/SJNIh3uVmPBObZFsLbq
|
|
Pwo5nyLOkzWlEHNbShPMRp1qFr
|
|
AfF13LMmeohNYfCXTHLqH1MaMOm+BhXABHB9rUKaGoOBjQPHCBtHbfMGQYjznGTpfCdTrUgq8VNl
|
|
qM2Ph9XWMcc7qbjNHw8=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
</RSAKeyValue>
|
|
</KeyValue>
|
|
</KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test"/>
|
|
</UnverifiedKeyBinding>
|
|
</LocateResult>
|
|
<LocateResult Id="Ib611ff9edd2958a27c6136be730828d2"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Icf173d33d71c80c74589c6204f7aeb4f">
|
|
<UnverifiedKeyBinding Id="I35f98da2b549c0e99cb8d995496bc66e">
|
|
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
|
|
<KeyValue>
|
|
<RSAKeyValue>
|
|
<Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FL
|
|
mGHWnQy2cSj39hf5D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
</RSAKeyValue>
|
|
</KeyValue>
|
|
<X509Data>
|
|
<X509Certificate>MIIB+zCCAWigAwIBAgIQhzf6GHdFobRCYrjlFTCekjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQyWhcNMzkxMjMxMjM1OTU5WjAlMSMwIQYDVQQGExpVUyBPPUJv
|
|
YiBDb3JwIENOPUJvYiBCYWtlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtw2qGqYbO0aK
|
|
eZFb0Z3verx3Cp+KS94LiHG09D1DdgTd48FZaB5eXa4U3mLax2/Fsg/cxGZkXJur0YylS8QvRuX+
|
|
9STQgiFTO277sHFfRMvtFsuQ56ovrQWH/KoGQZssMUIqO2aN2cbMQJST3a2HZuxqPQ1rwXxHrEoA
|
|
XHZv3ysCAwEAAaNHMEUwQwYDVR0BBDwwOoAQRWvWDxzHMSR0xfgYCUPpNqEUMBIxEDAOBgNVBAMT
|
|
B1Rlc3QgQ0GCEHKxUcSI0WKITaXFa+Ylh5IwCQYFKw4DAh0FAAOBgQCieDKjvNCo7MPsgUwHydki
|
|
d4KnulcuBbZet87lcIA7ReH1qEK4s0p49po2UM69eWG7hfv8LW2Ga8HiEexTwLDFBvH2g7f09xI/
|
|
vYgPw4qhJfWoZuY/HWHUzZIRSoggipndVfdvUkmsFSx1rR4FMu0mYBjq79OkYsmwISQlaXejUg==
|
|
</X509Certificate>
|
|
<X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</X509Certificate>
|
|
</X509Data>
|
|
</KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="bob@bobcorp.test"/>
|
|
</UnverifiedKeyBinding>
|
|
</LocateResult>
|
|
</CompoundResult></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_2_9" id="XKMS_2_0_LC2_Section_2_9">2.9</a>
|
|
<a name="SecurityBinding" id="SecurityBinding">Security Binding</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_83" id="XKMS_2_0_LC2_Paragraph_83"
|
|
class="markParagraph">[83]</a>The security concerns that an XKMS service is
|
|
required to address are dependent on the specific service deployment. For
|
|
example a free XKMS Location service may not require controls for Request
|
|
Authentication or to prevent Request Replay attacks while a paid Validate
|
|
service might. The application of security enhancements is addressed in
|
|
<a href="http://www.w3.org/TR/2003/WD-xkms2-bindings-20030418/">Part II</a>
|
|
which describes the application of the following security enhancements:</p>
|
|
<ul>
|
|
<li>Confidentiality</li>
|
|
<li>Request Authentication</li>
|
|
<li>Response Authentication</li>
|
|
<li>Transitive Authentication</li>
|
|
<li>Response Replay</li>
|
|
<li>Request Substitution</li>
|
|
<li>Request Replay</li>
|
|
<li>Denial of Service</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_84" id="XKMS_2_0_LC2_Paragraph_84"
|
|
class="markParagraph">[84]</a>The use of security enhancements is further
|
|
discussed in the section <a href="#SecurityConsiderations">Security
|
|
Considerations</a> below.</p>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_3" id="XKMS_2_0_LC2_Section_3">3</a>Message
|
|
Syntax</h1>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_3_1"
|
|
id="XKMS_2_0_LC2_Section_3_1">3.1</a>Message Base</h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_1_1"
|
|
id="XKMS_2_0_LC2_Section_3_1_1">3.1.1</a> <a name="TypeMessageAbstractType"
|
|
id="TypeMessageAbstractType">Type <span
|
|
class="ID">MessageAbstractType</span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_85" id="XKMS_2_0_LC2_Paragraph_85"
|
|
class="markParagraph">[85]</a>The <span class="ID">MessageAbstractType</span>
|
|
abstract type is the type from which all XKMS message element types are
|
|
derived. The <span class="ID">MessageAbstractType</span> abstract type
|
|
contains the following element and attributes</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span
|
|
class="ID"><b><ds:Signature></b></span> [Optional]</dt>
|
|
<dd>An XML Signature <a href="#XML-SIG">[XML-SIG]</a> in enveloped
|
|
mode. The scope of the signature is the entire request message (i.e.
|
|
the element derived from MessageAbstractType) and is specified using
|
|
a reference to the <span class="ID">Id</span> attribute specified in
|
|
the <span class="ID">MessageAbstractType</span> abstract type.</dd>
|
|
<dt><span class="ID"><MessageExtension></span> [Any Number]</dt>
|
|
<dd>An extension element derived from the <span
|
|
class="ID">MessageExtensionAbstractType</span>.</dd>
|
|
<dt><b><span class="ID"><OpaqueClientData></span>[Optional]</b></dt>
|
|
<dd>Data specified by the client that is opaque to the service. An XKMS
|
|
service SHOULD return the value of the <span
|
|
class="ID"><OpaqueClientData></span> element unmodified in a
|
|
request in a response with status code Success.</dd>
|
|
<dt><span class="ID">Id</span> [Required]</dt>
|
|
<dd>A unique identifier generated by the originator.</dd>
|
|
<dt><span class="ID"><b>Service</b></span> [Required]</dt>
|
|
<dd>The URI of the Web Service port to which the request is
|
|
addressed</dd>
|
|
<dt><span class="ID"><b>Nonce</b></span> [Optional]</dt>
|
|
<dd>Cryptographically random data used to defend against replay
|
|
attack.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_86" id="XKMS_2_0_LC2_Paragraph_86"
|
|
class="markParagraph">[86]</a>The following schema defines the <span
|
|
class="ID">MessageAbstractType</span> abstract type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- MessageAbstractType -->
|
|
<complexType name="MessageAbstractType" abstract="true">
|
|
<sequence>
|
|
<element ref="ds:Signature" minOccurs="0"/>
|
|
<element ref="xkms:MessageExtension" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:OpaqueClientData" minOccurs="0"/>
|
|
</sequence>
|
|
<attribute name="Id" type="ID" use="required"/>
|
|
<attribute name="Service" type="anyURI" use="required"/>
|
|
<attribute name="Nonce" type="base64Binary" use="optional"/>
|
|
</complexType>
|
|
<!-- /MessageAbstractType --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_1_2"
|
|
id="XKMS_2_0_LC2_Section_3_1_2">3.1.2</a> <a name="ElementdsSignature"
|
|
id="ElementdsSignature">Element <span
|
|
class="ID"><ds:Signature></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_87" id="XKMS_2_0_LC2_Paragraph_87"
|
|
class="markParagraph">[87]</a>An XML Signature <a
|
|
href="#XML-SIG">[XML-SIG]</a> in enveloped mode. The scope of the signature
|
|
is the entire request message (i.e. the element derrived from
|
|
MessageAbstractType) and is specified using a reference to the <span
|
|
class="ID">Id</span> attribute specified in the <span
|
|
class="ID">MessageAbstractType</span> abstract type. The empty identifier ""
|
|
MUST NOT be used.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_88" id="XKMS_2_0_LC2_Paragraph_88"
|
|
class="markParagraph">[88]</a>Validation of XML Signatures MUST be done
|
|
independent of any ancestral XML context of the message. This may be
|
|
achieved by:</p>
|
|
<ul>
|
|
<li>Isolating the XKMS message from any 'wrapper' (eg. SOAP) before
|
|
validation, or;</li>
|
|
<li>Specifying a canonicalization algorithm, such as Exclusive XML
|
|
Canonicalization, in <font face="Courier"><SignedInfo></font>:<font
|
|
face="Courier"><CanonicalizationMethod></font> to exclude ancestral
|
|
XML context during the validation of the message.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_89" id="XKMS_2_0_LC2_Paragraph_89"
|
|
class="markParagraph">[89]</a>For interoperability purposes XKMS
|
|
implementations MUST support the use of Exclusive XML Canonicalization.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_90" id="XKMS_2_0_LC2_Paragraph_90"
|
|
class="markParagraph">[90]</a>The <span
|
|
class="ID"><ds:Signature></span> element is specified in the XML
|
|
Signature specification <a href="#XML-SIG">[XML-SIG]</a>.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_1_3"
|
|
id="XKMS_2_0_LC2_Section_3_1_3">3.1.3</a> <a name="ElementMessageExtension"
|
|
id="ElementMessageExtension">Element <span
|
|
class="ID"><MessageExtension></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_91" id="XKMS_2_0_LC2_Paragraph_91"
|
|
class="markParagraph">[91]</a>The <span
|
|
class="ID"><MessageExtension></span> element is an abstract element of
|
|
the abstract type MessageExtensionAbstractType. Implementations may define
|
|
subclasses of the MessageExtensionAbstractType to define message extension
|
|
elements that may be applied to any XKMS message.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_92" id="XKMS_2_0_LC2_Paragraph_92"
|
|
class="markParagraph">[92]</a>The following schema defines the <span
|
|
class="ID">MessageExtension</span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- MessageExtension -->
|
|
<element name="MessageExtension" type="xkms:MessageExtensionAbstractType"
|
|
abstract="true"/>
|
|
<complexType name="MessageExtensionAbstractType" abstract="true"/>
|
|
<!-- /MessageExtension --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_1_4"
|
|
id="XKMS_2_0_LC2_Section_3_1_4">3.1.4</a> <a name="ElementOpaqueClientData"
|
|
id="ElementOpaqueClientData">Element <span
|
|
class="ID"><OpaqueClientData></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_93" id="XKMS_2_0_LC2_Paragraph_93"
|
|
class="markParagraph">[93]</a>The <span
|
|
class="ID"><OpaqueClientData></span> contains data specified by the
|
|
client that is opaque to the service. An XKMS service SHOULD return the value
|
|
of an <span class="ID"><OpaqueClientData></span> element specified in a
|
|
request unmodified in the corresponding response.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_94" id="XKMS_2_0_LC2_Paragraph_94"
|
|
class="markParagraph">[94]</a>A client MAY use Opaque client data in
|
|
conjunction with asynchronous request processing to match a responses to the
|
|
original request context. Opaque client data MAY also be used in conjunction
|
|
with synchronous request processing to provide context information for
|
|
purposes such as audit trail reconciliation.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_95" id="XKMS_2_0_LC2_Paragraph_95"
|
|
class="markParagraph">[95]</a>The following schema defines the <span
|
|
class="ID">OpaqueClientData</span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- OpaqueClientData -->
|
|
<element name="OpaqueClientData" type="xkms:OpaqueClientDataType"/>
|
|
<complexType name="OpaqueClientDataType">
|
|
<sequence maxOccurs="unbounded">
|
|
<element ref="xkms:OpaqueData" minOccurs="0"/>
|
|
</sequence>
|
|
</complexType>
|
|
<element name="OpaqueData" type="base64Binary"/>
|
|
<!-- /OpaqueClientData --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_3_2"
|
|
id="XKMS_2_0_LC2_Section_3_2">3.2</a>Request Message</h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_2_1"
|
|
id="XKMS_2_0_LC2_Section_3_2_1">3.2.1</a> <a name="TypeRequestAbstractType"
|
|
id="TypeRequestAbstractType">Type <span
|
|
class="ID">RequestAbstractType</span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_96" id="XKMS_2_0_LC2_Paragraph_96"
|
|
class="markParagraph">[96]</a>The <span class="ID">RequestAbstractType</span>
|
|
abstract type is the type from which all XKMS request element types are
|
|
derived. The <span class="ID">RequestAbstractType</span> abstract type
|
|
inherits the element and attributes of the <span
|
|
class="ID">MessageAbstractType</span> abstract type and in addition contains
|
|
the following attributes</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><ResponseMechanism></b></span> [Any
|
|
Number]</dt>
|
|
<dd>Specifies the extended protocol mechanisms that the client supports
|
|
in connection with this request.</dd>
|
|
<dt><span class="ID"><b><RespondWith></b></span> [Any
|
|
Number]</dt>
|
|
<dd>Specifies the types of data the recipient requests to be sent in
|
|
the response.</dd>
|
|
<dt><span
|
|
class="ID"><b><PendingNotification></b></span> [Optional]</dt>
|
|
<dd>Specifies a means by which the service may notify the requestor of
|
|
the completion of a pending response. If the <span
|
|
class="ID"><PendingNotification></span> element is present the
|
|
value <span class="ID">Pending</span> MUST be specified as a <span
|
|
class="ID"><ResponseMechanism></span> value.</dd>
|
|
<dt><span class="ID">OriginalRequestID</span> [Optional]</dt>
|
|
<dd>Specifies the value<font face="Courier">Id</font> of the first
|
|
request made in a multi-stage protocol such as the asynchronous
|
|
processing mechanism or Two Phase protocol.</dd>
|
|
<dt><span class="ID">ResponseLimit</span> [Optional]</dt>
|
|
<dd>Specifies the maximum number of data items the requestor can accept
|
|
in the case that the schema specifies an unbounded number of
|
|
elements.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_97" id="XKMS_2_0_LC2_Paragraph_97"
|
|
class="markParagraph">[97]</a>The following schema defines the <span
|
|
class="ID">RequestAbstractType</span> abstract type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RequestAbstractType -->
|
|
<complexType name="RequestAbstractType" abstract="true">
|
|
<complexContent>
|
|
<extension base="xkms:MessageAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:ResponseMechanism" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:RespondWith" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:PendingNotification" minOccurs="0"/>
|
|
</sequence>
|
|
<attribute name="OriginalRequestId" type="anyURI"
|
|
use="optional"/>
|
|
<attribute name="ResponseLimit" type="integer" use="optional"/>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /RequestAbstractType --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_2_2"
|
|
id="XKMS_2_0_LC2_Section_3_2_2">3.2.2</a> <a name="ElementResponseMechanism"
|
|
id="ElementResponseMechanism">Element <span
|
|
class="ID"><ResponseMechanism></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_98" id="XKMS_2_0_LC2_Paragraph_98"
|
|
class="markParagraph">[98]</a>The <span
|
|
class="ID"><ResponseMechanism></span> element in the request specifies
|
|
one or more strings included in the request that specify extended protocol
|
|
mechanisms that the client supports in connection with a request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_99" id="XKMS_2_0_LC2_Paragraph_99"
|
|
class="markParagraph">[99]</a> <span
|
|
class="ID">ResponseMechanism</span>values are specified as QNames, the
|
|
following identifiers are defined:</p>
|
|
|
|
<div class="center">
|
|
|
|
<table border="1" cellpadding="3" cellspacing="0" width="100%">
|
|
<tbody>
|
|
<tr>
|
|
<th valign="top">QName Local Name</th>
|
|
<td valign="top"><b>Description</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">Pending</span></td>
|
|
<td valign="top" align="left">The requestor is prepared to accept a
|
|
response that uses asynchronous processing, i.e. the service MAY
|
|
return the <span class="ID">MajorResult</span> code <font
|
|
face="Courier"><span class="ID">Pending</span></font></td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">Represent</span></td>
|
|
<td valign="top" align="left">The requestor is prepared to accept a
|
|
response that uses the two phase protocol, i.e. the service MAY
|
|
return the <span class="ID">MajorResult</span> code <font
|
|
face="Courier"><span class="ID">Represent</span></font></td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span
|
|
class="ID">RequestSignatureValue</span></td>
|
|
<td valign="top" align="left">The requestor is prepared to accept a
|
|
response that carries a <span
|
|
class="ID"><RequestSignatureValue> element.</span></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_100" id="XKMS_2_0_LC2_Paragraph_100"
|
|
class="markParagraph">[100]</a>The following schema defines the <span
|
|
class="ID"><ResponseMechanism></span> element::</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ResponseMechanism -->
|
|
<element name="ResponseMechanism" type="QName"/>
|
|
<!-- /ResponseMechanism --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_2_3"
|
|
id="XKMS_2_0_LC2_Section_3_2_3">3.2.3</a> <a name="ElementRespondWith"
|
|
id="ElementRespondWith">Element <span
|
|
class="ID"><RespondWith></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_101" id="XKMS_2_0_LC2_Paragraph_101"
|
|
class="markParagraph">[101]</a>The <span
|
|
class="ID"><RespondWith></span> element in the request specifies one or
|
|
more strings included in the request that specify data elements to be
|
|
provided in the <span class="ID"><ds:Keyinfo></span> element of the
|
|
response. Each string is a single identifier corresponding to a sub-element
|
|
of the XML Signature Specification <a href="#XML-SIG">[XML-SIG]</a><span
|
|
class="ID"><ds:Keyinfo></span> element or the private key
|
|
information defined in the section <a
|
|
href="#privatekeyparameters">Cryptographic Algorithm Specific Parameters</a>
|
|
below. The XML Signature elements are described here for convenience. The
|
|
normative reference is the specification [XML-SIG].</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_102" id="XKMS_2_0_LC2_Paragraph_102"
|
|
class="markParagraph">[102]</a>The Service SHOULD return a requested data
|
|
element if it is available. The Service MAY return additional data elements
|
|
that were not requested. In particular, the service MAY return data elements
|
|
specified in the request with the response.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_103" id="XKMS_2_0_LC2_Paragraph_103"
|
|
class="markParagraph">[103]</a> <span class="ID">RespondWith</span> values
|
|
are specified as QNames, the following identifiers are defined:</p>
|
|
|
|
<div class="center">
|
|
|
|
<table border="1" cellpadding="3" cellspacing="0" width="100%">
|
|
<tbody>
|
|
<tr>
|
|
<th valign="top">QName Local Name</th>
|
|
<td valign="top"><span class="ID"><b><ds:Keyinfo></b></span>
|
|
<b>Element</b></td>
|
|
<td valign="top"><b>Description</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">KeyName</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:KeyName></span></td>
|
|
<td valign="top" align="left">Key name</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">KeyValue</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:KeyValue></span></td>
|
|
<td valign="top" align="left">Public key parameters</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">X509Cert</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:X509Data></span></td>
|
|
<td valign="top" align="left">X509 Certificate v3 that authenticates
|
|
the specified key</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">X509Chain</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:X509Data>*</span></td>
|
|
<td valign="top" align="left">X509 Certificate v3 chain that
|
|
authenticates the specified key. Note that no ordering is implied in
|
|
the returned certificatesa.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">X509CRL</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:X509Data></span></td>
|
|
<td valign="top" align="left">X509 Certificate Revocation List v2</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">OCSP</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:X509Data></span></td>
|
|
<td valign="top" align="left">PKIX OCSP token that validates an X509v3
|
|
certificate that authenticates the key</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span
|
|
class="ID">RetrievalMethod</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:RetrievalMethod></span></td>
|
|
<td valign="top" align="left">Retrieval Method data</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">PGP</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:PGPData></span></td>
|
|
<td valign="top" align="left">PGP key signing data</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">PGPWeb</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:PGPData>*</span></td>
|
|
<td valign="top" align="left">Collection of PGP key signing data</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">SPKI</span></td>
|
|
<td valign="top" align="left"><span
|
|
class="ID"><ds:SPKIData>*</span></td>
|
|
<td valign="top" align="left">SPKI key signing</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">PrivateKey</span></td>
|
|
<td valign="top" align="left"> </td>
|
|
<td valign="top" align="left">Request that the encrypted private key be
|
|
returned in the response. [Used in the X-KRSS protocol]</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_104" id="XKMS_2_0_LC2_Paragraph_104"
|
|
class="markParagraph">[104]</a>For example, a client that has no X.509
|
|
processing capability might perform a <span class="ID">Locate</span>
|
|
operation to obtain the public key parameters and name information from a
|
|
<span class="ID"><ds:Keyinfo></span> element that specifies only a
|
|
certificate. The <span class="ID">RespondWith</span> element values in this
|
|
case would be <span class="ID">KeyName</span> and <span
|
|
class="ID">KeyValue</span>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_105" id="XKMS_2_0_LC2_Paragraph_105"
|
|
class="markParagraph">[105]</a>The following schema defines the <span
|
|
class="ID"><RespondWith></span> element::</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RespondWith -->
|
|
<element name="RespondWith" type="QName"/>
|
|
<!-- /RespondWith --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_2_4"
|
|
id="XKMS_2_0_LC2_Section_3_2_4">3.2.4</a> <a
|
|
name="ElementPendingNotification" id="ElementPendingNotification">Element
|
|
<span class="ID"><PendingNotification></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_106" id="XKMS_2_0_LC2_Paragraph_106"
|
|
class="markParagraph">[106]</a>The <span
|
|
class="ID"><PendingNotification></span> element is used to specify a
|
|
mechanism by means of which the service can inform a requestor that a pending
|
|
request has completed asynchronously.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_107" id="XKMS_2_0_LC2_Paragraph_107"
|
|
class="markParagraph">[107]</a>The <span
|
|
class="ID"><PendingNotification></span> element contains the following
|
|
attributes</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">Mechanism</span> [Required]</dt>
|
|
<dd>A URI that specifies the protocol by which the notification is
|
|
made</dd>
|
|
<dt><span class="ID">Identifier</span> [Required]</dt>
|
|
<dd>A URI that specifies the address to which the notification is to be
|
|
made</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_108" id="XKMS_2_0_LC2_Paragraph_108"
|
|
class="markParagraph">[108]</a>The following mechanisms are defined:</p>
|
|
|
|
<table border="1" id="AutoNumber1" cellspacing="0" cellpadding="2"
|
|
width="100%">
|
|
<tbody>
|
|
<tr>
|
|
<th width="68">Protocol</th>
|
|
<th width="116">URI</th>
|
|
<th width="68">Identifier</th>
|
|
<th width="644">Description</th>
|
|
</tr>
|
|
<tr>
|
|
<td width="68" valign="top">SMTP</td>
|
|
<td width="116" valign="top">urn:ietf:rfc:822</td>
|
|
<td width="68" valign="top">mailto:</td>
|
|
<td width="644" valign="top" align="left">Notification by email. The
|
|
content of the email is outside the scope of this specification</td>
|
|
</tr>
|
|
<tr>
|
|
<td width="68" valign="top">HTTP</td>
|
|
<td width="116" valign="top">urn:ietf:rfc:2616</td>
|
|
<td width="68" valign="top">http://</td>
|
|
<td width="644" valign="top" align="left">Notification by HTTP. The
|
|
content of the request is outside the scope of this specification</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_109" id="XKMS_2_0_LC2_Paragraph_109"
|
|
class="markParagraph">[109]</a>The following schema defines the <span
|
|
class="ID"><PendingNotification></span> element and <span
|
|
class="ID">PendingNotificationType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- PendingNotification -->
|
|
<element name="PendingNotification" type="xkms:PendingNotificationType"/>
|
|
<complexType name="PendingNotificationType">
|
|
<attribute name="Mechanism" type="anyURI" use="required"/>
|
|
<attribute name="Identifier" type="anyURI" use="required"/>
|
|
</complexType>
|
|
<!-- /PendingNotification --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_2_5"
|
|
id="XKMS_2_0_LC2_Section_3_2_5">3.2.5</a> <a name="ElementPendingRequest"
|
|
id="ElementPendingRequest">Element <span
|
|
class="ID"><PendingRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_110" id="XKMS_2_0_LC2_Paragraph_110"
|
|
class="markParagraph">[110]</a>The <span class="ID">PendingRequest</span>
|
|
element is used to request the result of a previously presented request for
|
|
which the <span class="ID"><font face="Courier">MajorResult</font></span>
|
|
code <span class="ID"><font face="Courier">Pending</font></span> was
|
|
returned. The <font face="Courier"><span
|
|
class="ID">PendingRequest</span></font> element inherits the element and
|
|
attributes of <span class="ID">AbstractRequestType</span> and the following
|
|
attribute:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">ResponseID</span> [Optional]</dt>
|
|
<dd>The value of the <span class="ID">Id</span> attribute sent in the
|
|
original response containing the <span class="ID"><font
|
|
face="Courier">MajorResult</font></span> code <span class="ID"><font
|
|
face="Courier">Pending</font></span>.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_111" id="XKMS_2_0_LC2_Paragraph_111"
|
|
class="markParagraph">[111]</a>If the value of ResponseID is unknown to the
|
|
service the result <span class="ID">Sender.UnknownResponseId</span> is
|
|
returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_112" id="XKMS_2_0_LC2_Paragraph_112"
|
|
class="markParagraph">[112]</a>The following schema defines the <span
|
|
class="ID">PendingRequest</span> element and <span
|
|
class="ID">PendingRequestType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- PendingRequest -->
|
|
<element name="PendingRequest" type="xkms:PendingRequestType"/>
|
|
<complexType name="PendingRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<attribute name="ResponseId" type="anyURI" use="optional"/>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /PendingRequest --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_3_3"
|
|
id="XKMS_2_0_LC2_Section_3_3">3.3</a>Response Messages</h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_3_1"
|
|
id="XKMS_2_0_LC2_Section_3_3_1">3.3.1</a> <a name="ElementResultAbstractType"
|
|
id="ElementResultAbstractType">Element <span
|
|
class="ID"><Result></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_113" id="XKMS_2_0_LC2_Paragraph_113"
|
|
class="markParagraph">[113]</a>The <span class="ID">ResultType</span> type is
|
|
the type from which all XKMS response element types are derived. The <span
|
|
class="ID">ResultType</span> type inherits the element and attributes
|
|
of the <span class="ID">MessageAbstractType</span> abstract type and in
|
|
addition contains the following attributes</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span
|
|
class="ID"><b><RequestSignatureValue></b></span> [Optional]</dt>
|
|
<dd>The value of the ds:SignatureValue element of the corresponding
|
|
request.</dd>
|
|
<dt><span class="ID"><b>ResultMajor</b></span> [Required]</dt>
|
|
<dd>The most significant component of the result code</dd>
|
|
<dt><span class="ID"><b>ResultMinor</b></span> [Optional]</dt>
|
|
<dd>The least significant component of the result code</dd>
|
|
<dt><span class="ID">RequestId</span> [Optional]</dt>
|
|
<dd>The unique identifier <span class="ID">Id</span> specified in the
|
|
request</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_114" id="XKMS_2_0_LC2_Paragraph_114"
|
|
class="markParagraph">[114]</a>If the <span class="ID">MajorResult</span>
|
|
value has the value <span class="ID">Represent</span> the <span
|
|
class="ID">nonce</span> attribute MUST be present and MUST NOT be the empty
|
|
string.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_115" id="XKMS_2_0_LC2_Paragraph_115"
|
|
class="markParagraph">[115]</a>The <span class="ID"><Result></span>
|
|
element is returned in response to an XKMS request if and only if the service
|
|
cannot return a more specific result element that inherits from the <span
|
|
class="ID">ResultType</span>. For example if a request is made for the status
|
|
of a pending request whose identifier is unknown to the service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_116" id="XKMS_2_0_LC2_Paragraph_116"
|
|
class="markParagraph">[116]</a> <b>Security Consideration:</b> Care must be
|
|
taken when signing responses to ensure that the service does not provide a
|
|
signing oracle, that is sign messages whose content is guessable by an
|
|
attacker. Implementations MUST ensure that response messages contain a
|
|
sufficient quantity of unpredictable data such as a pseudo-randomly
|
|
chosen <span class="ID">Id</span> attribute. For more information see the
|
|
section <a href="#SecurityConsiderations">Security Considerations</a>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_117" id="XKMS_2_0_LC2_Paragraph_117"
|
|
class="markParagraph">[117]</a>The following schema defines the <span
|
|
class="ID"><font face="Courier"><Result></font></span> element and
|
|
<span class="ID"><font face="Courier">ResultType</font></span>type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ResultType -->
|
|
<element name="Result" type="xkms:ResultType"/>
|
|
<complexType name="ResultType">
|
|
<complexContent>
|
|
<extension base="xkms:MessageAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:RequestSignatureValue" minOccurs="0"/>
|
|
</sequence>
|
|
<attribute name="ResultMajor" type="QName" use="required"/>
|
|
<attribute name="ResultMinor" type="QName" use="optional"/>
|
|
<attribute name="RequestId" type="anyURI" use="optional"/>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /ResultType --></pre>
|
|
|
|
<h4><a name="XKMS_2_0_LC2_Section_3_3_1_1"
|
|
id="XKMS_2_0_LC2_Section_3_3_1_1">3.3.1.1</a> <a name="ResultCodes"
|
|
id="ResultCodes">Result Codes</a></h4>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_118" id="XKMS_2_0_LC2_Paragraph_118"
|
|
class="markParagraph">[118]</a>Result codes consist of a major code and an
|
|
optional minor code. The major and minor codes are expressed as XML qualified
|
|
names. This specification uses the notation <i>ResultMajor</i><span
|
|
class="ID">.</span><i>ResultMinor</i> to specify a result code. For example
|
|
the result code <span class="ID">Sender.NoMatch</span> indicates a <span
|
|
class="ID">ResultMajor</span> code of <span class="ID">Sender</span> and a
|
|
<span class="ID">ResultMinor</span> code of <span
|
|
class="ID">NoMatch</span>.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_119" id="XKMS_2_0_LC2_Paragraph_119"
|
|
class="markParagraph">[119]</a>The following <span
|
|
class="ID">ResultMajor</span> codes are defined:</p>
|
|
|
|
<table width="100%" cellpadding="0" cellspacing="0" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<th width="164">QName Local Name</th>
|
|
<th width="139">Final</th>
|
|
<th width="1397">Description</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">Success</span></td>
|
|
<td width="139" align="center">Final</td>
|
|
<td width="1397">The operation succeeded.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">VersionMismatch</span></td>
|
|
<td width="139" align="center">Final</td>
|
|
<td width="1397">The service does not support the protocol version
|
|
specified in the request.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">Sender</span></td>
|
|
<td width="139" align="center">Final</td>
|
|
<td width="1397">An error occurred that was due to the message sent by
|
|
the sender.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">Receiver</span></td>
|
|
<td width="139" align="center">Final</td>
|
|
<td width="1397">An error occurred at the receiver.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">Represent</span></td>
|
|
<td width="139" align="center">Not Final</td>
|
|
<td width="1397">The service has not acted on the request. In order for
|
|
the request to be acted upon the request MUST be represented with the
|
|
specified nonce in accordance with the two phase protocol</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="164"><span
|
|
class="ID">Pending</span></td>
|
|
<td width="139" align="center">Not Final</td>
|
|
<td width="1397">The request has been accepted for processing and the
|
|
service will return the result asynchronously</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_120" id="XKMS_2_0_LC2_Paragraph_120"
|
|
class="markParagraph">[120]</a>The <span class="ID">ResultMajor</span> codes
|
|
<span class="ID">Success</span>, <span class="ID">VersionMismatch</span>,
|
|
<span class="ID">Sender</span> and <span class="ID">Receiver</span> are
|
|
<i>Final</i>, that is the protocol has completed when the code is returned.
|
|
The <span class="ID">ResultMajor</span> codes <span
|
|
class="ID">Represent</span> and <span class="ID">Pending</span> are <i>Not
|
|
Final</i> and indicate that further processing is necessary to receive the
|
|
result.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_121" id="XKMS_2_0_LC2_Paragraph_121"
|
|
class="markParagraph">[121]</a>The following <span
|
|
class="ID">ResultMinor</span> codes are defined:</p>
|
|
|
|
<table width="100%" cellpadding="0" cellspacing="0" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<th width="152" valign="top">QName Local Name</th>
|
|
<th width="114" valign="top">Possible Major Codes</th>
|
|
<th width="664" valign="top">Description</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" rowspan="3" width="152"><span
|
|
class="ID">NoMatch</span></td>
|
|
<td valign="top" class="ID" width="114"> </td>
|
|
<td valign="top" width="664">No match was found for the search
|
|
prototype provided.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Success</span></td>
|
|
<td valign="top" width="664">The result code <span
|
|
class="ID">Success.NoMatch</span> indicates that the service is
|
|
authoritative for the search prototype specified and that the service
|
|
positively asserts that no matches exist.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Receiver</span></td>
|
|
<td valign="top" width="664">The result code <span
|
|
class="ID">Receiver.NoMatch</span> indicates that the service is not
|
|
authoritative for the search prototype provided.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" rowspan="3" width="152"><span
|
|
class="ID">TooManyResponses</span></td>
|
|
<td valign="top" class="ID" width="114"><br />
|
|
</td>
|
|
<td valign="top" width="664">The request resulted in the number of
|
|
responses that exceeded either the <span
|
|
class="ID">ResponseLimit</span> value specified in the request or
|
|
some other limit determined by the service. The service MAY either
|
|
return a subset of the possible responses or none at all.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Success</span></td>
|
|
<td valign="top" width="664">The service has returned one or more
|
|
responses that represent a subset of the possible responses.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Receiver</span></td>
|
|
<td valign="top" width="664">The service has returned no responses.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="152"><span
|
|
class="ID">Incomplete</span></td>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Success</span></td>
|
|
<td valign="top" width="664">Only part of the information requested
|
|
could be provided.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" rowspan="3" width="152"><span
|
|
class="ID">Failure</span></td>
|
|
<td valign="top" width="114"> </td>
|
|
<td valign="top" width="664">The service attempted to perform the
|
|
request but the operation failed for unspecified reasons.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Sender</span></td>
|
|
<td valign="top" width="664">The reason for failure is attributed to
|
|
the sender (e.g. the request failed schema validation).</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Receiver</span></td>
|
|
<td valign="top" width="664">The reason for failure is attributed to
|
|
the receiver (e.g. a database lookup failed).</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" rowspan="3" width="152"><span
|
|
class="ID">Refused</span></td>
|
|
<td valign="top" width="114"> </td>
|
|
<td valign="top" width="664">The operation was refused. The service did
|
|
not attempt to perform the request.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Sender</span></td>
|
|
<td valign="top" width="664">The sender failed to provide sufficient
|
|
information to authenticate or authorize the request (e.g. payment
|
|
not supplied)</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Receiver</span></td>
|
|
<td valign="top" width="664">The receiver is currently refusing certain
|
|
requests for unspecified reasons.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="152"><span
|
|
class="ID">NoAuthentication</span></td>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Sender</span></td>
|
|
<td valign="top" width="664">The operation was refused because the
|
|
necessary authentication information was incorrect or missing.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="152"><span
|
|
class="ID">MessageNotSupported</span></td>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Sender</span></td>
|
|
<td valign="top" width="664">The receiver does not implement the
|
|
specified operation.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="152"><span
|
|
class="ID">UnknownResponseId</span></td>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Sender</span></td>
|
|
<td valign="top" width="664">The ResponseId for which pending status
|
|
was requested is unknown to the service.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" class="ID" width="152"><span
|
|
class="ID">NotSynchronous</span></td>
|
|
<td valign="top" class="ID" width="114"><span
|
|
class="ID">Receiver</span></td>
|
|
<td valign="top" width="664">The receiver does not support synchronous
|
|
processing of this type of request</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_3_2"
|
|
id="XKMS_2_0_LC2_Section_3_3_2">3.3.2</a> <a
|
|
name="ElementRequestSignatureValue" id="ElementRequestSignatureValue">Element
|
|
<span class="ID"><RequestSignatureValue></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_122" id="XKMS_2_0_LC2_Paragraph_122"
|
|
class="markParagraph">[122]</a>The <span
|
|
class="ID"><RequestSignatureValue></span> element in a response
|
|
contains the value of the base64 encoded value from the <span
|
|
class="ID"><ds:SignatureValue></span> content within the <span
|
|
class="ID"><ds:Signature></span> block in the corresponding request.
|
|
This provides a cryptographic linkage between the request and the
|
|
response.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_123" id="XKMS_2_0_LC2_Paragraph_123"
|
|
class="markParagraph">[123]</a>A service SHOULD include the <span
|
|
class="ID"><RequestSignatureValue></span> element in a response if the
|
|
following conditions are satisfied and MUST NOT include the value
|
|
otherwise:</p>
|
|
<ul>
|
|
<li>The <ds:Signature> element was present in the corresponding
|
|
request</li>
|
|
<li>The service successfully verified the <ds:Signature> element in
|
|
the corresponding request, and</li>
|
|
<li>The ResponseMechanism RequestSignatureValue was specified.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_124" id="XKMS_2_0_LC2_Paragraph_124"
|
|
class="markParagraph">[124]</a>If the <span
|
|
class="ID"><RequestSignatureValue></span> element is present in a
|
|
response the requestor MUST reject the message if either:</p>
|
|
<ul>
|
|
<li>The corresponding request was not authenticated, or:</li>
|
|
<li>The value ds:Signature/ds:SignatureValue in the request does not match
|
|
the value RequestSignatureValue in the response.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_125" id="XKMS_2_0_LC2_Paragraph_125"
|
|
class="markParagraph">[125]</a>The <span
|
|
class="ID"><RequestSignatureValue></span> element is of <span
|
|
class="ID">ds:SignatureValueType</span> type specified in the XML Signature
|
|
specification <a href="#XML-SIG">[XML-SIG]</a>.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_3_4"
|
|
id="XKMS_2_0_LC2_Section_3_4">3.4</a>Compound Requests</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_126" id="XKMS_2_0_LC2_Paragraph_126"
|
|
class="markParagraph">[126]</a>The compound request mechanism allows multiple
|
|
requests and the corresponding responses to be sent in a single request
|
|
message. This allows considerable processing resources to be saved as a
|
|
single signature on the compound message may be used in place of multiple
|
|
signatures on the individual requests or responses.</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RequestSignatureValue -->
|
|
<element name="RequestSignatureValue" type="ds:SignatureValueType"/>
|
|
<!-- /RequestSignatureValue --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_4_1"
|
|
id="XKMS_2_0_LC2_Section_3_4_1">3.4.1</a> <a name="ElementCompoundRequest"
|
|
id="ElementCompoundRequest">Element <span
|
|
class="ID"><CompoundRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_127" id="XKMS_2_0_LC2_Paragraph_127"
|
|
class="markParagraph">[127]</a>The <span
|
|
class="ID"><CompoundRequest></span> element is used to issue multiple
|
|
requests at the same time. The <span
|
|
class="ID"><CompoundRequest></span> element inherits the element and
|
|
attributes of <span class="ID">AbstractRequestType</span> together with the
|
|
following elements in any order:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><font size="3"><LocateRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS Locate Request</dd>
|
|
<dt><font size="3"><ValidateRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS Validate Request</dd>
|
|
<dt><font size="3"><RegisterRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Register</font>Request</dd>
|
|
<dt><font size="3"><ReissueRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Reissue</font>Request</dd>
|
|
<dt><font size="3"><RecoverRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Recover</font>Request</dd>
|
|
<dt><font size="3"><RevokeRequest></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Revoke</font>Request</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_128" id="XKMS_2_0_LC2_Paragraph_128"
|
|
class="markParagraph">[128]</a>The following schema defines the <span
|
|
class="ID"><CompoundRequest></span> element and <span
|
|
class="ID">CompoundRequestType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- CompoundRequest -->
|
|
<element name="CompoundRequest" type="xkms:CompoundRequestType"/>
|
|
<complexType name="CompoundRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<choice maxOccurs="unbounded">
|
|
<element ref="xkms:LocateRequest"/>
|
|
<element ref="xkms:ValidateRequest"/>
|
|
<element ref="xkms:RegisterRequest"/>
|
|
<element ref="xkms:ReissueRequest"/>
|
|
<element ref="xkms:RecoverRequest"/>
|
|
<element ref="xkms:RevokeRequest"/>
|
|
</choice>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /CompoundRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_4_2"
|
|
id="XKMS_2_0_LC2_Section_3_4_2">3.4.2</a> <a name="ElementCompoundResult"
|
|
id="ElementCompoundResult">Element <span
|
|
class="ID"><CompoundResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_129" id="XKMS_2_0_LC2_Paragraph_129"
|
|
class="markParagraph">[129]</a>The <span
|
|
class="ID"><CompoundResult></span> element is used to respond to a
|
|
<span class="ID"><CompoundRequest></span>. If the compound result has
|
|
the <font face="Courier">MajorResult</font> value <font
|
|
face="Courier">Success</font> it contains multiple responses corresponding to
|
|
the multiple requests specified in the <span
|
|
class="ID"><CompoundRequest></span>. The <span
|
|
class="ID"><CompoundResult></span> element inherits the element and
|
|
attributes of <span class="ID">ResultType</span> together with the following
|
|
additional elements in any order:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><font size="3"><LocateResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS Locate Result</dd>
|
|
<dt><font size="3"><ValidateResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS Validate Result</dd>
|
|
<dt><font size="3"><RegisterResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Register</font>Result</dd>
|
|
<dt><font size="3"><ReissueResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Reissue</font>Result</dd>
|
|
<dt><font size="3"><RecoverResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Recover</font>Result</dd>
|
|
<dt><font size="3"><RevokeResult></font>[AnyNumber]</dt>
|
|
<dd>An XKMS <font size="3">Revoke</font>Result</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_130" id="XKMS_2_0_LC2_Paragraph_130"
|
|
class="markParagraph">[130]</a>The following schema defines the <span
|
|
class="ID"><CompoundResult></span> element and <span
|
|
class="ID">CompoundResultType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- CompoundResponse -->
|
|
<element name="CompoundResult" type="xkms:CompoundResultType"/>
|
|
<complexType name="CompoundResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<choice maxOccurs="unbounded">
|
|
<element ref="xkms:LocateResult"/>
|
|
<element ref="xkms:ValidateResult"/>
|
|
<element ref="xkms:RegisterResult"/>
|
|
<element ref="xkms:ReissueResult"/>
|
|
<element ref="xkms:RecoverResult"/>
|
|
<element ref="xkms:RevokeResult"/>
|
|
</choice>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /CompoundResponse --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_3_5"
|
|
id="XKMS_2_0_LC2_Section_3_5">3.5</a>Status Request</h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_5_1"
|
|
id="XKMS_2_0_LC2_Section_3_5_1">3.5.1</a> <a name="ElementStatusRequest"
|
|
id="ElementStatusRequest">Element <span
|
|
class="ID"><StatusRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_131" id="XKMS_2_0_LC2_Paragraph_131"
|
|
class="markParagraph">[131]</a>The <span class="ID">StatusRequest</span>
|
|
element is used to request that the service return the status of a pending
|
|
request by means of a <span class="ID"><StatusResult></span> element.
|
|
The <span class="ID">Status</span><font face="Courier"><span
|
|
class="ID">Request</span></font> element inherits the element and attributes
|
|
of <span class="ID">PendingRequestType</span>.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">ResponseID</span> [Optional]</dt>
|
|
<dd>The value of the <span class="ID">Id</span> attribute sent in the
|
|
original response containing the <span class="ID"><font
|
|
face="Courier">MajorResult</font></span> code <span class="ID"><font
|
|
face="Courier">Pending</font></span>.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_132" id="XKMS_2_0_LC2_Paragraph_132"
|
|
class="markParagraph">[132]</a>The following schema defines the <span
|
|
class="ID">StatusRequest</span> element and <span
|
|
class="ID">StatusRequestType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- StatusRequest -->
|
|
<element name="StatusRequest" type="xkms:StatusRequestType"/>
|
|
<complexType name="StatusRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:PendingRequestType"/>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /StatusRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_3_5_2"
|
|
id="XKMS_2_0_LC2_Section_3_5_2">3.5.2</a> <a name="ElementStatusResult"
|
|
id="ElementStatusResult">Element <span
|
|
class="ID"><StatusResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_133" id="XKMS_2_0_LC2_Paragraph_133"
|
|
class="markParagraph">[133]</a>The <span
|
|
class="ID"><StatusResult></span> element returns the status of a
|
|
pending request. The <span class="ID">StatusResultType</span> inherits
|
|
the element and attributes of <span class="ID">ResultType</span> and contains
|
|
the following additional attributes:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">Success</span> [Optional]</dt>
|
|
<dd>In the case of a compound request the number of inner compound
|
|
operations that completed with status Success.</dd>
|
|
<dt><span class="ID">Failed</span> [Optional]</dt>
|
|
<dd>In the case of a compound request the number of inner compound
|
|
operations that completed with status other than Success.</dd>
|
|
<dt><span class="ID">Pending</span> [Optional]</dt>
|
|
<dd>In the case of a compound request the number of inner compound
|
|
operations that are still pending.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_134" id="XKMS_2_0_LC2_Paragraph_134"
|
|
class="markParagraph">[134]</a>The following schema defines the <span
|
|
class="ID">StatusResult</span> element and <span
|
|
class="ID">StatusResultType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- StatusResult -->
|
|
<element name="StatusResult" type="xkms:StatusResultType"/>
|
|
<complexType name="StatusResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<attribute name="Success" type="integer" use="optional"/>
|
|
<attribute name="Failure" type="integer" use="optional"/>
|
|
<attribute name="Pending" type="integer" use="optional"/>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /StatusResult --></pre>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_4" id="XKMS_2_0_LC2_Section_4">4</a> <a
|
|
name="KeyInformationServiceOverview" id="KeyInformationServiceOverview">Key
|
|
Information Service Overview</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_135" id="XKMS_2_0_LC2_Paragraph_135"
|
|
class="markParagraph">[135]</a>In the XML Signature Specification <a
|
|
href="#XML-SIG">[XML-SIG]</a>, a signer may optionally include information
|
|
about his public signing key ("<span class="ID"><ds:KeyInfo></span>")
|
|
within the signature block. This key information is designed to allow the
|
|
signer to communicate "hints" to a verifier about which public key to
|
|
select.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_136" id="XKMS_2_0_LC2_Paragraph_136"
|
|
class="markParagraph">[136]</a>Another important property of <span
|
|
class="ID"><ds:KeyInfo></span> is that it may or may not be
|
|
cryptographically bound to the signature itself. This allows the <span
|
|
class="ID"><ds:KeyInfo></span> to be substituted or supplemented
|
|
without "breaking" the digital signature.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_137" id="XKMS_2_0_LC2_Paragraph_137"
|
|
class="markParagraph">[137]</a>For example Alice signs a document and sends
|
|
it to Bob with a <span class="ID"><ds:KeyInfo></span> element that
|
|
specifies only the signing key data. On receiving the message Bob retrieves
|
|
additional information required to validate the signature and adds this
|
|
information into the <span class="ID"><ds:KeyInfo></span> element when
|
|
he passes the document on to Carol (see Figure 1 below).</p>
|
|
|
|
<p class="caption"><a name="XKMS_2_0_LC2_Paragraph_138"
|
|
id="XKMS_2_0_LC2_Paragraph_138" class="markParagraph">[138]</a> <img
|
|
alt="Substitution of the ds:KeyInfo element as a message is passed amongst processors."
|
|
src="Images/Image002.gif" width="420" height="372" /></p>
|
|
|
|
<p class="caption"><a name="XKMS_2_0_LC2_Paragraph_139"
|
|
id="XKMS_2_0_LC2_Paragraph_139" class="markParagraph">[139]</a> <a
|
|
id="Figure1" name="Figure1">Figure 1: Substitution of the <span
|
|
class="ID"><ds:KeyInfo></span> element as a message is passed amongst
|
|
processors</a></p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_4_1" id="XKMS_2_0_LC2_Section_4_1">4.1</a>
|
|
<a name="XKISSLocateService" id="XKISSLocateService">XKISS Locate
|
|
Service</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_140" id="XKMS_2_0_LC2_Paragraph_140"
|
|
class="markParagraph">[140]</a>The XKISS <span class="ID">Locate</span>
|
|
service resolves a <span class="ID"><ds:Keyinfo></span> element but
|
|
does NOT REQUIRE the service to make an assertion concerning the validity of
|
|
the binding between the data in the <span
|
|
class="ID"><ds:Keyinfo></span> element.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_141" id="XKMS_2_0_LC2_Paragraph_141"
|
|
class="markParagraph">[141]</a>The XKMS service MAY resolve the <span
|
|
class="ID"><ds:Keyinfo></span> element using local data or MAY relay
|
|
request to other servers. For example the XKMS service might resolve a <span
|
|
class="ID"><ds:RetrievalMethod></span> element (Figure 2) or act as a
|
|
gateway to an underlying PKI based on a non-XML syntax.</p>
|
|
|
|
<p class="center"><a name="XKMS_2_0_LC2_Paragraph_142"
|
|
id="XKMS_2_0_LC2_Paragraph_142" class="markParagraph">[142]</a> <img
|
|
alt="Diagram shows protocol exchange between a client, a trust service and a remote server (Server A). "
|
|
src="Images/image006.gif" border="0" width="576" height="244" /></p>
|
|
|
|
<p class="caption"><a name="XKMS_2_0_LC2_Paragraph_143"
|
|
id="XKMS_2_0_LC2_Paragraph_143" class="markParagraph">[143]</a>Figure 2:
|
|
Locate Service Provides Name Resolution</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_144" id="XKMS_2_0_LC2_Paragraph_144"
|
|
class="markParagraph">[144]</a>Both the request and/or the response MAY be
|
|
signed, to both authenticate the sender and protect the integrity of the data
|
|
being transmitted, using an XML Signature <a
|
|
href="#XML-SIG">[XML-SIG]</a>.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_4_1_1"
|
|
id="XKMS_2_0_LC2_Section_4_1_1">4.1.1</a> <a name="ExampleDataEncryption"
|
|
id="ExampleDataEncryption">Example: Data Encryption</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_145" id="XKMS_2_0_LC2_Paragraph_145"
|
|
class="markParagraph">[145]</a>Alice wants to send an encrypted email to Bob
|
|
but does not know his encryption key. Alice can use both the S/MIME and PGP
|
|
secure email formats. Alice's client uses DNS to locate the XKMS service that
|
|
provides a Locate service for keys bound to the domain example.com then sends
|
|
an XKMS Locate request to the discovered XKMS service for a key bound to
|
|
bob@example.com and the S/MIME or PGP protocol. The application then verifies
|
|
that the certificate obtained meets its trust criteria by standard
|
|
certificate validation to a trusted root.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_146" id="XKMS_2_0_LC2_Paragraph_146"
|
|
class="markParagraph">[146]</a>Request:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="Ibcef5348aa386dedeff0bdf6bae872db"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>KeyName</RespondWith>
|
|
<RespondWith>KeyValue</RespondWith>
|
|
<RespondWith>X509Cert</RespondWith>
|
|
<RespondWith>X509Chain</RespondWith>
|
|
<RespondWith>PGPWeb</RespondWith>
|
|
<RespondWith>PGP</RespondWith>
|
|
<QueryKeyBinding>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2440"
|
|
Identifier="bob@bobcorp.test"/>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="bob@bobcorp.test"/>
|
|
</QueryKeyBinding>
|
|
</LocateRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_147" id="XKMS_2_0_LC2_Paragraph_147"
|
|
class="markParagraph">[147]</a>Response:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I45d8cc74e012b21a0985a36aa3fcd18f"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Ibcef5348aa386dedeff0bdf6bae872db"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<UnverifiedKeyBinding Id="I12f80aa2cf90d0c80555dad9d7e6860d">
|
|
<ds:KeyInfo>
|
|
<ds:KeyValue>
|
|
<ds:RSAKeyValue>
|
|
<ds:Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FL
|
|
mGHWnQy2cSj39hf5D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</ds:Modulus>
|
|
<ds:Exponent>AQAB</ds:Exponent>
|
|
</ds:RSAKeyValue>
|
|
</ds:KeyValue>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIIB+zCCAWigAwIBAgIQhzf6GHdFobRCYrjlFTCekjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQyWhcNMzkxMjMxMjM1OTU5WjAlMSMwIQYDVQQGExpVUyBPPUJv
|
|
YiBDb3JwIENOPUJvYiBCYWtlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtw2qGqYbO0aK
|
|
eZFb0Z3verx3Cp+KS94LiHG09D1DdgTd48FZaB5eXa4U3mLax2/Fsg/cxGZkXJur0YylS8QvRuX+
|
|
9STQgiFTO277sHFfRMvtFsuQ56ovrQWH/KoGQZssMUIqO2aN2cbMQJST3a2HZuxqPQ1rwXxHrEoA
|
|
XHZv3ysCAwEAAaNHMEUwQwYDVR0BBDwwOoAQRWvWDxzHMSR0xfgYCUPpNqEUMBIxEDAOBgNVBAMT
|
|
B1Rlc3QgQ0GCEHKxUcSI0WKITaXFa+Ylh5IwCQYFKw4DAh0FAAOBgQCieDKjvNCo7MPsgUwHydki
|
|
d4KnulcuBbZet87lcIA7ReH1qEK4s0p49po2UM69eWG7hfv8LW2Ga8HiEexTwLDFBvH2g7f09xI/
|
|
vYgPw4qhJfWoZuY/HWHUzZIRSoggipndVfdvUkmsFSx1rR4FMu0mYBjq79OkYsmwISQlaXejUg==
|
|
</ds:X509Certificate>
|
|
<ds:X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="bob@bobcorp.test"/>
|
|
</UnverifiedKeyBinding>
|
|
</LocateResult></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_4_1_2"
|
|
id="XKMS_2_0_LC2_Section_4_1_2">4.1.2</a> <a name="ExampleDocumentSignature"
|
|
id="ExampleDocumentSignature">Example: Document Signature</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_148" id="XKMS_2_0_LC2_Paragraph_148"
|
|
class="markParagraph">[148]</a>Bob receives the signed document from Alice
|
|
which specifies Alice's X.509v3 certificate but not the key value. Bob's
|
|
email client is not capable of processing X.509v3 certificates but can obtain
|
|
the key parameters from the XKMS service by means of the Locate service.
|
|
Bob's email client sends the <span class="ID"><ds:Keyinfo></span>
|
|
element to the location service requesting that the <span
|
|
class="ID"><KeyName></span> and <span
|
|
class="ID"><KeyValue></span> elements be returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_149" id="XKMS_2_0_LC2_Paragraph_149"
|
|
class="markParagraph">[149]</a>Request:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I4593b8d4b6bd9ae7262560b5de1016bc"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>KeyValue</RespondWith>
|
|
<QueryKeyBinding>
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJBgUrD
|
|
gMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
</QueryKeyBinding>
|
|
</LocateRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_150" id="XKMS_2_0_LC2_Paragraph_150"
|
|
class="markParagraph">[150]</a>The location service extracts the X.509v3
|
|
certificate from the <span class="ID"><ds:Keyinfo></span> element and
|
|
returns the key values. The location service DOES NOT report the revocation
|
|
status or the trustworthiness of the certificate..</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_151" id="XKMS_2_0_LC2_Paragraph_151"
|
|
class="markParagraph">[151]</a>Response:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<LocateResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I46ee58f131435361d1e51545de10a9aa"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I4593b8d4b6bd9ae7262560b5de1016bc"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<UnverifiedKeyBinding Id="I36b45b969a9020dbe1da2cb793016117">
|
|
<ds:KeyInfo>
|
|
<ds:KeyValue>
|
|
<ds:RSAKeyValue>
|
|
<ds:Modulus>zvbTdKsTprGAKJdgi7ulDR0eQBptLv/SJNIh3uVmPBObZFsLbqPwo5n
|
|
yLOkzWlEHNbShPMRp1qFr
|
|
AfF13LMmeohNYfCXTHLqH1MaMOm+BhXABHB9rUKaGoOBjQPHCBtHbfMGQYjznGTpfCdTrUgq8VNl
|
|
qM2Ph9XWMcc7qbjNHw8=</ds:Modulus>
|
|
<ds:Exponent>AQAB</ds:Exponent>
|
|
</ds:RSAKeyValue>
|
|
</ds:KeyValue>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test" />
|
|
</UnverifiedKeyBinding>
|
|
</LocateResult></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_4_2" id="XKMS_2_0_LC2_Section_4_2">4.2</a>
|
|
<a name="XKISSValidateService" id="XKISSValidateService">XKISS: Validate
|
|
Service</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_152" id="XKMS_2_0_LC2_Paragraph_152"
|
|
class="markParagraph">[152]</a>The XKISS Validate Service allows all that the
|
|
Locate Service does, and in addition, the client may obtain an assertion
|
|
specifying the status of the binding between the public key and other data,
|
|
for example a name or a set of extended attributes. Furthermore the service
|
|
represents that the status of each of the data elements returned is valid and
|
|
that all are bound to the same public key. The client sends to the XKMS
|
|
service a prototype containing some or all of the elements for which the
|
|
status of the key binding is required. If the information in the prototype is
|
|
incomplete, the XKMS service MAY obtain additional data required from an
|
|
underlying PKI Service. Once the validity of the key binding has been
|
|
determined the XKMS service returns the status result to the client (Figure
|
|
3).</p>
|
|
|
|
<p class="center"><a name="XKMS_2_0_LC2_Paragraph_153"
|
|
id="XKMS_2_0_LC2_Paragraph_153" class="markParagraph">[153]</a> <img
|
|
alt="Diagram shows a trust service acting as a gateway to 'PKI services'"
|
|
src="Images/image008.gif" border="0" width="532" height="265" /></p>
|
|
|
|
<p class="caption"><a name="XKMS_2_0_LC2_Paragraph_154"
|
|
id="XKMS_2_0_LC2_Paragraph_154" class="markParagraph">[154]</a> <a
|
|
id="FigureTier2" name="FigureTier2">Figure 3: Validate Service Provides Key
|
|
Validation</a></p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_4_2_1"
|
|
id="XKMS_2_0_LC2_Section_4_2_1">4.2.1</a> <a name="ExampleDocumentSignature2"
|
|
id="ExampleDocumentSignature2">Example: Document Signature</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_155" id="XKMS_2_0_LC2_Paragraph_155"
|
|
class="markParagraph">[155]</a>Bob has received Alice's message and his email
|
|
client has verified the signature on the document against the public key in
|
|
the certificate supplied by Alice. It is not yet known whether the
|
|
certificate is considered trustworthy however. To determine this, Bob's email
|
|
client sends the certificate chain to an XKMS Validate service. The service
|
|
reports back that it has successfully determined that the key binding has a
|
|
trusted issuer and has not been revoked.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_156" id="XKMS_2_0_LC2_Paragraph_156"
|
|
class="markParagraph">[156]</a>Request:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<ValidateRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="Ic4d10f0affff49382b021a820613fa71"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>KeyName</RespondWith>
|
|
<QueryKeyBinding>
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=
|
|
</ds:X509Certificate>
|
|
<ds:X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test"/>
|
|
</QueryKeyBinding>
|
|
</ValidateRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_157" id="XKMS_2_0_LC2_Paragraph_157"
|
|
class="markParagraph">[157]</a>Response:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<ValidateResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="Ibc853a2455de4f7433eed5b32ece5918"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Ic4d10f0affff49382b021a820613fa71"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<KeyBinding Id="Ie4d5784ea01e70085de088bd09b6e134">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJBgUrD
|
|
gMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test" />
|
|
<Status StatusValue="Valid">
|
|
<ValidReason>Signature</ValidReason>
|
|
<ValidReason>IssuerTrust</ValidReason>
|
|
<ValidReason>RevocationStatus</ValidReason>
|
|
<ValidReason>ValidityInterval</ValidReason>
|
|
</Status>
|
|
</KeyBinding>
|
|
</ValidateResult></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_4_3" id="XKMS_2_0_LC2_Section_4_3">4.3</a>
|
|
<a name="UsingLocateandValidate" id="UsingLocateandValidate">Using Locate and
|
|
Validate</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_158" id="XKMS_2_0_LC2_Paragraph_158"
|
|
class="markParagraph">[158]</a>The Locate and Validate operations are both
|
|
used to obtain information about a public key from an XKMS Service. Locate
|
|
and Validate services are both expected to attempt to provide correct
|
|
information to the requestor. The Locate and Validate services differ in the
|
|
extent to which the service vouches for the trustworthiness the information
|
|
returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_159" id="XKMS_2_0_LC2_Paragraph_159"
|
|
class="markParagraph">[159]</a>A Location service SHOULD attempt to provide
|
|
only information which is trustworthy <i>to the best of its knowledge but
|
|
does not provide any assurance that it will do so</i>. Information obtained
|
|
from a Locate service SHOULD NOT be relied upon unless it is validated.
|
|
Validation may be achieved by forwarding the data to a Validate service or by
|
|
performing the necessary trust path verification locally.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_160" id="XKMS_2_0_LC2_Paragraph_160"
|
|
class="markParagraph">[160]</a>A Validation service undertakes to only return
|
|
information which has been positively validated by the XKMS Service as
|
|
meeting specific validation criteria. A client MAY rely on the information
|
|
returned by the service without further validation provided that the client
|
|
has a means to determine that the information returned is authentic and is
|
|
assured that the validation service applied the means of validation
|
|
appropriate to the circumstances.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_161" id="XKMS_2_0_LC2_Paragraph_161"
|
|
class="markParagraph">[161]</a>No single set of validation criteria are
|
|
appropriate to every circumstance. Applications involving financial
|
|
transactions are likely to require the application of very specific
|
|
validation criteria that ensure that certain contractual and/or regulatory
|
|
policies are enforced. The Locate service provides a key discovery function
|
|
that is neutral with respect to the validation criteria that the client
|
|
application may apply. The Validate service provides a key discovery and
|
|
validation function that produces a results which are each specific to a
|
|
single set of validation criteria.</p>
|
|
|
|
<h3 align="left"><a name="XKMS_2_0_LC2_Section_4_3_1"
|
|
id="XKMS_2_0_LC2_Section_4_3_1">4.3.1</a> <a name="DNSIntegration"
|
|
id="DNSIntegration">DNS Integration</a></h3>
|
|
|
|
<p align="left"><a name="XKMS_2_0_LC2_Paragraph_162"
|
|
id="XKMS_2_0_LC2_Paragraph_162" class="markParagraph">[162]</a>In many cases
|
|
the key information which a client requires is bound to some form of address
|
|
specified by an Internet protocol part of which consists of a DNS address.
|
|
For example an email client may require a trustworthy key to send an
|
|
encrypted email to bob@example.com. Unless an XKMS service which provides key
|
|
information about keys bound to email addresses in the domain example.com is
|
|
known a priori, some means of locating the correct XKMS service is
|
|
required.</p>
|
|
|
|
<p align="left"><a name="XKMS_2_0_LC2_Paragraph_163"
|
|
id="XKMS_2_0_LC2_Paragraph_163" class="markParagraph">[163]</a>Figure 5 shows
|
|
an example of using the DNS SRV record to perform discovery of XKMS services.
|
|
The email client requests a key for bob@example.com from a trusted Validate
|
|
service. The Validate service then queries the DNS to locate an XKMS service
|
|
providing information on keys bound to addresses in the zone example.com. The
|
|
Validate service does not have an established trust relationship with the
|
|
example.com XKMS service and so a Locate request is made to determine if any
|
|
key information bound to bob@example.com can be located. The Validate service
|
|
then validates the information received by such means as are appropriate
|
|
(e.g. by verifying that a certification chain may be constructed from a root
|
|
of trust) and the response returned to the email client.</p>
|
|
|
|
<p align="center"><a name="XKMS_2_0_LC2_Paragraph_164"
|
|
id="XKMS_2_0_LC2_Paragraph_164" class="markParagraph">[164]</a> <img
|
|
alt="see caption" src="Images/image012.gif" width="441" height="273" /></p>
|
|
|
|
<p class="caption" align="center"><a name="XKMS_2_0_LC2_Paragraph_165"
|
|
id="XKMS_2_0_LC2_Paragraph_165" class="markParagraph">[165]</a>Figure 5:
|
|
Combined use of Locate and Validate service</p>
|
|
|
|
<p align="left"><a name="XKMS_2_0_LC2_Paragraph_166"
|
|
id="XKMS_2_0_LC2_Paragraph_166" class="markParagraph">[166]</a>Appendix B
|
|
provides further information on the use of the DNS SRV record.</p>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_5" id="XKMS_2_0_LC2_Section_5">5</a> <a
|
|
name="KeyInformationServiceMessageSet"
|
|
id="KeyInformationServiceMessageSet">Key Information Service Message
|
|
Set</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_167" id="XKMS_2_0_LC2_Paragraph_167"
|
|
class="markParagraph">[167]</a>The protocol consists of pairs of messages,
|
|
with an application sending a request message to a XKMS service and the
|
|
service responding with another message. </p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_5_1" id="XKMS_2_0_LC2_Section_5_1">5.1</a>
|
|
<a name="KeyBindingSpecification" id="KeyBindingSpecification">Key Binding
|
|
Specification</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_168" id="XKMS_2_0_LC2_Paragraph_168"
|
|
class="markParagraph">[168]</a>A <i>key binding</i> asserts a binding between
|
|
data elements that relate to a public key including the <span
|
|
class="ID"><ds:KeyName></span>, <span
|
|
class="ID"><ds:KeyValue></span> and <span
|
|
class="ID"><ds:X509Data</span>> components contained in a <span
|
|
class="ID"><ds:KeyInfo></span> element. Furthermore, the Service
|
|
represents <i>to the client accessing the service and to that client
|
|
alone</i> that the binding between the data elements is <i>valid</i> under
|
|
whatever trust policy the service offers to that client.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_169" id="XKMS_2_0_LC2_Paragraph_169"
|
|
class="markParagraph">[169]</a>XKMS specifies four elements that specify key
|
|
bindings, all of which are derived from the <span
|
|
class="ID">KeyBindingAbstractType</span>. These elements are:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt>UnverifiedKeyBinding</dt>
|
|
<dd>Specifies the parameters of a particular instance of a key binding
|
|
but not the status.</dd>
|
|
<dt>KeyBinding</dt>
|
|
<dd>Specifies the parameters of a particular instance of a key
|
|
binding</dd>
|
|
<dt>QueryKeyBinding</dt>
|
|
<dd>A template used to specify one or more key bindings using query by
|
|
example.</dd>
|
|
<dt>PrototypeKeyBinding</dt>
|
|
<dd>A template used to specify the key binding parameters requested in
|
|
a registration request.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_170" id="XKMS_2_0_LC2_Paragraph_170"
|
|
class="markParagraph">[170]</a>An XKMS service MAY provide an interface to an
|
|
underlying PKI such as PKIX or PGP. This specification does not define how
|
|
XKMS operations interact with the underlying PKI. The XKMS key binding MAY be
|
|
<i>bound</i> to a data object such as a certificate or key signing in the
|
|
underlying PKI such that XKMS operations on the key binding result in a
|
|
corresponding change to the data structures in the underlying PKI and vice
|
|
versa. If for example the XKMS service provides a mapping to an underlying
|
|
PKIX/X.509 PKI the registration of a key binding would typically result in
|
|
the issue of a certificate, even if the client does not ask for the
|
|
certificate to be returned in the registration result. If the key binding
|
|
were subsequently revoked the corresponding certificate in the underlying PKI
|
|
would typically be revoked also.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_1"
|
|
id="XKMS_2_0_LC2_Section_5_1_1">5.1.1</a>Abstract <a
|
|
name="TypeKeyBindingAbstractType" id="TypeKeyBindingAbstractType">Type <span
|
|
class="ID">KeyBindingAbstractType</span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_171" id="XKMS_2_0_LC2_Paragraph_171"
|
|
class="markParagraph">[171]</a>The <span
|
|
class="ID">KeyBindingAbstractType</span> is the abstract type from which all
|
|
XKMS key binding element specifiers are derived. It contains the following
|
|
elements and attribute:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b>Id</b></span> [Optional]</dt>
|
|
<dd>Identifier of the key binding.</dd>
|
|
<dt><span
|
|
class="ID"><b><ds:KeyInfo> </b></span> [Optional]</dt>
|
|
<dd>The public key information to which the key binding information is
|
|
bound</dd>
|
|
<dt><span class="ID"><b><KeyUsage></b></span> [0 to 3]</dt>
|
|
<dd>The cryptographic key uses for which the key may be used</dd>
|
|
<dt><span class="ID"><b><UseKeyWith></b></span> [Any
|
|
Number]</dt>
|
|
<dd>The applications with which the key may be used together with the
|
|
application specific subject identifier of the key holder for that
|
|
application</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_172" id="XKMS_2_0_LC2_Paragraph_172"
|
|
class="markParagraph">[172]</a>The Id identifier is defined to provide a
|
|
means by which the key binding may be signed using XML Signature. Clients
|
|
MUST NOT rely on the key binding identifier being either unique or stable. In
|
|
the case that an XKMS service is providing an interface to an underlying PKI,
|
|
clients MUST NOT rely on the service choosing key binding identifiers that
|
|
are either the same as or bear a systematic relationship to the serial
|
|
numbers or other identifiers of the corresponding credentials in the
|
|
underlying PKI.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_173" id="XKMS_2_0_LC2_Paragraph_173"
|
|
class="markParagraph">[173]</a>The following schema defines the <span
|
|
class="ID">KeyBindingAbstractType</span> type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- KeyBindingAbstractType-->
|
|
<complexType name="KeyBindingAbstractType" abstract="true">
|
|
<sequence>
|
|
<element ref="ds:KeyInfo" minOccurs="0"/>
|
|
<element ref="xkms:KeyUsage" minOccurs="0" maxOccurs="3"/>
|
|
<element ref="xkms:UseKeyWith" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
<attribute name="Id" type="ID" use="optional"/>
|
|
</complexType>
|
|
<!-- /KeyBindingAbstractType--></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_2"
|
|
id="XKMS_2_0_LC2_Section_5_1_2">5.1.2</a> <a name="ElementKeyUsage"
|
|
id="ElementKeyUsage">Element <span class="ID"><KeyUsage></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_174" id="XKMS_2_0_LC2_Paragraph_174"
|
|
class="markParagraph">[174]</a>The <span class="ID"><KeyUsage></span>
|
|
element specifies one or more intended uses of the key. If no <span
|
|
class="ID"><KeyUsage></span> is specified all uses are permitted. The
|
|
following key usages are defined:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b>Encryption</b></span></dt>
|
|
<dd>The key pair may be used for encryption and decryption</dd>
|
|
<dt><span class="ID"><b>Signature</b></span></dt>
|
|
<dd>The key pair may be used for signature and verification</dd>
|
|
<dt><span class="ID"><b>Exchange</b></span></dt>
|
|
<dd>The key pair may be used for key exchange</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_175" id="XKMS_2_0_LC2_Paragraph_175"
|
|
class="markParagraph">[175]</a>If a key usage is specified in a <font
|
|
face="Courier">KeyBinding</font> that the cryptographic algorithm associated
|
|
with the key does not support the element MUST be ignored. If a key usage is
|
|
specified in a <font face="Courier">QueryKeyBinding</font> however the key
|
|
usage forms part of the criteria the service should attempt to match.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_176" id="XKMS_2_0_LC2_Paragraph_176"
|
|
class="markParagraph">[176]</a>For example if a KeyBinding specifies the key
|
|
usage <span class="ID">Encryption</span> for a Digital Signature Algorithm
|
|
key the relying application should ignore the key usage element. If however a
|
|
client makes a request that contains a <font
|
|
face="Courier">QueryKeyBinding</font> that specifies the key usage encryption
|
|
the service should not return a Digital Signature Algorithm key.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_177" id="XKMS_2_0_LC2_Paragraph_177"
|
|
class="markParagraph">[177]</a>The following schema defines the <span
|
|
class="ID"><KeyUsage></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- KeyUsage -->
|
|
<element name="KeyUsage" type="xkms:KeyUsageType"/>
|
|
<simpleType name="KeyUsageType">
|
|
<restriction base="QName">
|
|
<enumeration value="xkms:Encryption"/>
|
|
<enumeration value="xkms:Signature"/>
|
|
<enumeration value="xkms:Exchange"/>
|
|
</restriction>
|
|
</simpleType>
|
|
<!-- /KeyUsage --></pre>
|
|
|
|
<h3 dir="ltr"><a name="XKMS_2_0_LC2_Section_5_1_3"
|
|
id="XKMS_2_0_LC2_Section_5_1_3">5.1.3</a> <a name="ElementUseKeyWith"
|
|
id="ElementUseKeyWith">Element <span
|
|
class="ID"><UseKeyWith></span></a></h3>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_178"
|
|
id="XKMS_2_0_LC2_Paragraph_178" class="markParagraph">[178]</a>The <span
|
|
class="ID"><UseKeyWith></span> element specifies a subject identifier
|
|
and application identifier that determine a use of the key. The
|
|
interpretation of <span class="ID"><UseKeyWith></span> depends on the
|
|
enclosing construct.</p>
|
|
<dl>
|
|
<dt dir="ltr">QueryKeyBinding / TemplateKeyBinding</dt>
|
|
<dd>A key binding is requested that meets the specified criteria. If the
|
|
service is unable to meet the criteria exactly 'best guess' is
|
|
acceptable.</dd>
|
|
<dt dir="ltr">UnverifiedKeyBinding / KeyBinding</dt>
|
|
<dd>The key may be used for the purpose specified (if unverified after
|
|
validation). If more than one use key with is specified then all are
|
|
applicable jointly and severally</dd>
|
|
</dl>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_179"
|
|
id="XKMS_2_0_LC2_Paragraph_179" class="markParagraph">[179]</a>The <span
|
|
class="ID"><UseKeyWith></span> element contains the following
|
|
attributes:</p>
|
|
|
|
<blockquote dir="ltr">
|
|
<dl dir="ltr">
|
|
<dt dir="ltr"><span class="ID"><b>Application</b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>A URI that specifies the application protocol with which the key
|
|
may be used</dd>
|
|
<dd></dd>
|
|
<dt dir="ltr"><span class="ID"><b>Identifier</b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd dir="ltr">Specifies the subject to which the key corresponds within
|
|
the specified application protocol.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_180"
|
|
id="XKMS_2_0_LC2_Paragraph_180" class="markParagraph">[180]</a>The following
|
|
table lists application URIs for common protocols and the corresponding
|
|
format for the identifier information:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table border="1" cellpadding="3" cellspacing="0" dir="ltr">
|
|
<tbody>
|
|
<tr>
|
|
<th dir="ltr">Protocol</th>
|
|
<th dir="ltr">Application URI</th>
|
|
<th dir="ltr">Identifier</th>
|
|
<th dir="ltr">Type</th>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">XKMS</td>
|
|
<td dir="ltr" align="left">http://www.w3.org/2002/03/xkms#</td>
|
|
<td dir="ltr" align="left">URL identifying SOAP role</td>
|
|
<td dir="ltr" align="left">URI</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">XKMS/<i>profile</i></td>
|
|
<td dir="ltr"
|
|
align="left">http://www.w3.org/2002/03/xkms#<i>profile</i></td>
|
|
<td dir="ltr" align="left">URL identifying SOAP role</td>
|
|
<td dir="ltr" align="left">URI</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">S/MIME</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2633</td>
|
|
<td dir="ltr" align="left">SMTP email address of subject</td>
|
|
<td dir="ltr" align="left">RFC822 addr-spec</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">PGP</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2440</td>
|
|
<td dir="ltr" align="left">SMTP email address of subject</td>
|
|
<td dir="ltr" align="left">RFC822 addr-spec</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">TLS</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2246</td>
|
|
<td dir="ltr" align="left">URI identifying certificate subject</td>
|
|
<td dir="ltr" align="left">URI</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">TLS/HTTPS</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2818</td>
|
|
<td dir="ltr" align="left">DNS address of http server</td>
|
|
<td dir="ltr" align="left">DNS Address</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">TLS/SMTP</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2487</td>
|
|
<td dir="ltr" align="left">DNS address of mail server</td>
|
|
<td dir="ltr" align="left">DNS Address</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">IPSEC</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2401</td>
|
|
<td dir="ltr" align="left">IP address of network resource</td>
|
|
<td dir="ltr" align="left">IP Address</td>
|
|
</tr>
|
|
<tr>
|
|
<td dir="ltr" align="left">PKIX</td>
|
|
<td dir="ltr" align="left">urn:ietf:rfc:2459</td>
|
|
<td dir="ltr" align="left">Certificate Subject Name</td>
|
|
<td dir="ltr" align="left">X.509 Distinguished Name</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_181"
|
|
id="XKMS_2_0_LC2_Paragraph_181" class="markParagraph">[181]</a> The XKMS
|
|
application URI is used to specify a key binding that is used to secure an
|
|
XKMS service. An XKMS service SHOULD support discovery of the supported
|
|
security profiles and corresponding key bindings by means of a <span
|
|
class="ID">Locate</span> operation that specifies the XKMS application URI
|
|
and the URL of the service role. Note that as with any other Locate operation
|
|
the credentials returned by this mechanism SHOULD only be considered
|
|
trustworthy if validated according to the trust policy of the client.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_182"
|
|
id="XKMS_2_0_LC2_Paragraph_182" class="markParagraph">[182]</a> The primary
|
|
use intended for <span class="ID"><UseKeyWith></span> identifiers is to
|
|
identify application protocols. <span class="ID"><UseKeyWith></span>
|
|
URI identifiers MAY be specified that represent key binding issuance and/or
|
|
use policies instead of or in addition to an application protocol. In this
|
|
case the <span class="ID"><UseKeyWith></span> element specifies that
|
|
the key binding complies with the specified policy.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_183"
|
|
id="XKMS_2_0_LC2_Paragraph_183" class="markParagraph">[183]</a>In the case
|
|
that a client follows a referral model in which raw key binding information
|
|
is obtained from a Locate service then forwarded to a validate service the
|
|
<span class="ID"><UseKeyWith></span> elements in the query should in
|
|
both cases specify the uses for which the application intends to use the key.
|
|
Applications SHOULD NOT forward <span class="ID"><UseKeyWith></span>
|
|
elements returned in a Locate result in a subsequent Validate query.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_184"
|
|
id="XKMS_2_0_LC2_Paragraph_184" class="markParagraph">[184]</a>The following
|
|
table describes the formatting for the specified types of identifier:</p>
|
|
|
|
<table border="1" cellpadding="1" cellspacing="0" width="100%"
|
|
id="AutoNumber2" dir="ltr">
|
|
<tbody>
|
|
<tr>
|
|
<th height="19" dir="ltr">Identifier Type</th>
|
|
<th height="19" dir="ltr">Example</th>
|
|
<th height="19" dir="ltr">Description</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" height="36" dir="ltr" align="left">RFC822
|
|
addr-spec</td>
|
|
<td valign="top" height="36" dir="ltr" align="left">bob@example.com</td>
|
|
<td valign="top" height="36" dir="ltr" align="left">The addr-spec
|
|
fragment of an RFC 822 email address as used by SMTP</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" height="18" dir="ltr" align="left">URI</td>
|
|
<td valign="top" height="18" dir="ltr"
|
|
align="left">https://example.com/</td>
|
|
<td valign="top" height="18" dir="ltr" align="left">A Uniform Resource
|
|
Identifier</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" height="18" dir="ltr" align="left">DNS Address</td>
|
|
<td valign="top" height="18" dir="ltr" align="left">example.com</td>
|
|
<td valign="top" height="18" dir="ltr" align="left">An Internet DNS
|
|
address</td>
|
|
</tr>
|
|
<tr>
|
|
<td rowspan="2" valign="top" height="43" dir="ltr" align="left">IP
|
|
Address</td>
|
|
<td valign="top" height="18" dir="ltr" align="left">10.23.0.20</td>
|
|
<td valign="top" height="18" dir="ltr" align="left">An IPv4 address in
|
|
decimal notation</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" height="19" dir="ltr"
|
|
align="left">1080::8:800:200C:417A</td>
|
|
<td valign="top" height="19" dir="ltr" align="left">An IPv6 address in
|
|
<a href="#RFC-2373">RFC 2373</a> notation</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" height="36" dir="ltr" align="left">X.509 Distinguished
|
|
Name</td>
|
|
<td valign="top" height="36" dir="ltr" align="left">C="UK"
|
|
O="CryptoGuys Ltd." CN="Bob"</td>
|
|
<td valign="top" height="36" dir="ltr" align="left">An X.509
|
|
Distinguished Name</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_185"
|
|
id="XKMS_2_0_LC2_Paragraph_185" class="markParagraph">[185]</a>The following
|
|
schema defines the <span class="ID"><UseKeyWith></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- UseKeyWith -->
|
|
<element name="UseKeyWith" type="xkms:UseKeyWithType"/>
|
|
<complexType name="UseKeyWithType">
|
|
<attribute name="Application" type="anyURI" use="required"/>
|
|
<attribute name="Identifier" type="string" use="required"/>
|
|
</complexType>
|
|
<!-- /UseKeyWith --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_4"
|
|
id="XKMS_2_0_LC2_Section_5_1_4">5.1.4</a> <a
|
|
name="ElementUnverifiedKeyBinding" id="ElementUnverifiedKeyBinding">Element
|
|
<span class="ID"><UnverifiedKeyBinding></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_186" id="XKMS_2_0_LC2_Paragraph_186"
|
|
class="markParagraph">[186]</a>The <span
|
|
class="ID"><UnverifiedKeyBinding></span> element is derived from the
|
|
<span class="ID">KeyBindingAbstractType</span>. It describes a key binding
|
|
but makes no assertion regarding the status of the key binding.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_187" id="XKMS_2_0_LC2_Paragraph_187"
|
|
class="markParagraph">[187]</a>The <span
|
|
class="ID"><UnverifiedKeyBinding></span> element extends the <span
|
|
class="ID">KeyBindingAbstractType</span> with the following additional
|
|
elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span
|
|
class="ID"><b><ValidityInterval></b></span> [Optional]</dt>
|
|
<dd>The time interval in which the key binding relationship is
|
|
asserted</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_188" id="XKMS_2_0_LC2_Paragraph_188"
|
|
class="markParagraph">[188]</a>The following schema defines the <span
|
|
class="ID"><UnverifiedKeyBinding></span> element and <span
|
|
class="ID">UnverifiedKeyBinding</span><span class="ID">Type</span>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- UnverifiedKeyBinding -->
|
|
<element name="UnverifiedKeyBinding"
|
|
type="xkms:UnverifiedKeyBindingType"/>
|
|
<complexType name="UnverifiedKeyBindingType">
|
|
<complexContent>
|
|
<extension base="xkms:KeyBindingAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:ValidityInterval" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /UnverifiedKeyBinding --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_5"
|
|
id="XKMS_2_0_LC2_Section_5_1_5">5.1.5</a> <a name="ElementValidityInterval"
|
|
id="ElementValidityInterval">Element <span
|
|
class="ID"><ValidityInterval></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_189" id="XKMS_2_0_LC2_Paragraph_189"
|
|
class="markParagraph">[189]</a>The <span
|
|
class="ID"><ValidityInterval></span> element specifies limits on the
|
|
validity of the key binding.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">NotBefore</span> <b>
|
|
[Optional]</b></dt>
|
|
<dd>Time instant at which the validity interval begins</dd>
|
|
<dt><span class="ID">NotOnOrAfter</span> <b>
|
|
[Optional]</b></dt>
|
|
<dd>Time instant at which the validity interval has ended</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_190" id="XKMS_2_0_LC2_Paragraph_190"
|
|
class="markParagraph">[190]</a>All dateTime values MUST fully specify the
|
|
date.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_191" id="XKMS_2_0_LC2_Paragraph_191"
|
|
class="markParagraph">[191]</a>The <span class="ID">NotBefore</span> and
|
|
<span class="ID">NotOnOrAfter</span> attributes are optional. If the <span
|
|
class="ID">NotBefore</span> attribute is omitted the key binding is valid on
|
|
any date up to but excluding the date specified in the <span
|
|
class="ID">NotOnOrAfter</span> attribute . If the <span
|
|
class="ID">NotOnOrAfter</span> attribute is omitted the key binding is valid
|
|
from the <span class="ID">NotBefore</span> attribute with no expiry. If both
|
|
elements are omitted the key binding is valid at any time.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_192" id="XKMS_2_0_LC2_Paragraph_192"
|
|
class="markParagraph">[192]</a>In accordance with the XML Schema
|
|
Specifications, all time instances are interpreted in Universal Coordinated
|
|
Time unless they explicitly indicate a time zone.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_193" id="XKMS_2_0_LC2_Paragraph_193"
|
|
class="markParagraph">[193]</a>Implementations MUST NOT generate time
|
|
instances that specify leap seconds.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_194" id="XKMS_2_0_LC2_Paragraph_194"
|
|
class="markParagraph">[194]</a>For purposes of comparison, the time interval
|
|
<span class="ID">NotBefore</span> to <span class="ID">NotOnOrAfter</span>
|
|
begins at the earliest time instant compatible with the specification of
|
|
<span class="ID">NotBefore</span> and <i><u>has ended</u></i> at the
|
|
<i><u>earliest</u></i> time instant compatible with the specification of
|
|
<span class="ID">NotOnOrAfter</span></p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_195" id="XKMS_2_0_LC2_Paragraph_195"
|
|
class="markParagraph">[195]</a>For example if the time interval specified is
|
|
<span class="ID"><i>day</i>T12:03:02</span> to <span
|
|
class="ID"><i>day</i>T12:05:12</span> the times <span
|
|
class="ID">12:03:02.00</span> and <span class="ID">12:05:11.9999</span> are
|
|
within the time interval. The time <span class="ID">12:05:12.0000</span> is
|
|
outside the time interval.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_196" id="XKMS_2_0_LC2_Paragraph_196"
|
|
class="markParagraph">[196]</a>The following schema defines the <span
|
|
class="ID"><ValidityInterval></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ValidityInterval -->
|
|
<element name="ValidityInterval" type="xkms:ValidityIntervalType"/>
|
|
<complexType name="ValidityIntervalType">
|
|
<attribute name="NotBefore" type="dateTime"/>
|
|
<attribute name="NotOnOrAfter" type="dateTime"/>
|
|
</complexType>
|
|
<!-- /ValidityInterval --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_6"
|
|
id="XKMS_2_0_LC2_Section_5_1_6">5.1.6</a> <a name="ElementKeyBinding"
|
|
id="ElementKeyBinding">Element <span
|
|
class="ID"><KeyBinding></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_197" id="XKMS_2_0_LC2_Paragraph_197"
|
|
class="markParagraph">[197]</a>The <span class="ID"><KeyBinding></span>
|
|
element is derived from the <span class="ID">UnverifiedKeyBinding</span><span
|
|
class="ID">Type</span>. It specifies a particular instance of a key binding
|
|
and its current status as known to the issuer of the key binding.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_198" id="XKMS_2_0_LC2_Paragraph_198"
|
|
class="markParagraph">[198]</a>The <span class="ID"><KeyBinding></span>
|
|
element extends the <span class="ID">UnverifiedKeyBinding</span><span
|
|
class="ID">Type</span> with the following additional elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><Status></span> [Required]</dt>
|
|
<dd>The status of the key binding instance.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_199" id="XKMS_2_0_LC2_Paragraph_199"
|
|
class="markParagraph">[199]</a>The following schema defines the <font
|
|
face="Courier"><KeyBinding></font> element and <font
|
|
face="Courier">KeyBindingType</font>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- KeyBinding -->
|
|
<element name="KeyBinding" type="xkms:KeyBindingType"/>
|
|
<complexType name="KeyBindingType">
|
|
<complexContent>
|
|
<extension base="xkms:UnverifiedKeyBindingType">
|
|
<sequence>
|
|
<element ref="xkms:Status"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /KeyBinding --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_7"
|
|
id="XKMS_2_0_LC2_Section_5_1_7">5.1.7</a> <a name="ElementStatus"
|
|
id="ElementStatus">Element <span class="ID"><Status></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_200" id="XKMS_2_0_LC2_Paragraph_200"
|
|
class="markParagraph">[200]</a>The <span class="ID"><status></span>
|
|
element specifies the status of a <span class="ID"><KeyBinding></span>
|
|
instance.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_201" id="XKMS_2_0_LC2_Paragraph_201"
|
|
class="markParagraph">[201]</a>The status value MAY be supplemented with
|
|
codes that state the status of specific aspects of the key binding status
|
|
that were validated.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_202" id="XKMS_2_0_LC2_Paragraph_202"
|
|
class="markParagraph">[202]</a>The <span class="ID"><Status></span>
|
|
element contains the following elements and attribute:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><ValidReason></b></span> [Any
|
|
Number]</dt>
|
|
<dd>A status aspect that was evaluated and found to be Valid.</dd>
|
|
<dt><span class="ID"><b><IndeterminateReason></b></span> [Any
|
|
Number]</dt>
|
|
<dd>A status aspect that could not be evaluated or was evaluated and
|
|
returned an Indeterminate result.</dd>
|
|
<dt><span class="ID"><b><InvalidReason></b></span> [Any
|
|
Number]</dt>
|
|
<dd>A status aspect that was evaluated and found to be Invalid.</dd>
|
|
<dt><span class="ID">StatusValue</span> [Required]</dt>
|
|
<dd>The key binding status</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_203" id="XKMS_2_0_LC2_Paragraph_203"
|
|
class="markParagraph">[203]</a>The enumerated type <span
|
|
style="FONT-FAMILY: Courier" class="ID">AssertionStatus</span> is used to
|
|
indicate the key binding status. The following values are defined:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">Valid</span></dt>
|
|
<dd>The key binding is definitively valid.</dd>
|
|
<dt><span class="ID">Indeterminate</span></dt>
|
|
<dd>The status of the key binding cannot be determined.</dd>
|
|
<dt><span class="ID">Invalid</span></dt>
|
|
<dd>The key binding is definitively invalid.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_204" id="XKMS_2_0_LC2_Paragraph_204"
|
|
class="markParagraph">[204]</a>If reason codes are specified <span
|
|
class="ID">StatusValue</span> attribute MUST be consistent with the reason
|
|
codes specified as follows:</p>
|
|
<ul>
|
|
<li>If an <span class="ID"><InvalidReason></span> code is present the
|
|
<span class="ID">StatusValue</span> attibute MUST have the value <span
|
|
class="ID">Invalid</span></li>
|
|
<li>If an <span class="ID"><IndeterminateReason></span> code is
|
|
present the <span class="ID">StatusValue</span> attibute MUST have the
|
|
either the value <span class="ID">Indeterminate</span> or the value <span
|
|
class="ID">Invalid</span>.</li>
|
|
<li>If neither an <span class="ID"><InvalidReason></span> nor an
|
|
<span class="ID"><IndeterminateReason></span> code is present the
|
|
<span class="ID">StatusValue</span> attibute MAY have any defined value,
|
|
i.e. <span class="ID">Valid</span>, <span class="ID">Indeterminate</span>
|
|
or <span class="ID">Invalid</span>.</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_205" id="XKMS_2_0_LC2_Paragraph_205"
|
|
class="markParagraph">[205]</a>The following schema defines the <span
|
|
class="ID"><Status></span> element and <span
|
|
class="ID">StatusType</span> and <span class="ID">AssertionType</span>
|
|
types:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- Status -->
|
|
<element name="Status" type="xkms:StatusType"/>
|
|
<complexType name="StatusType">
|
|
<sequence>
|
|
<element ref="xkms:ValidReason" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:IndeterminateReason" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:InvalidReason" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
<attribute name="StatusValue" type="xkms:KeyBindingStatus"
|
|
use="required"/>
|
|
</complexType>
|
|
<simpleType name="KeyBindingStatus">
|
|
<restriction base="QName">
|
|
<enumeration value="xkms:Valid"/>
|
|
<enumeration value="xkms:Invalid"/>
|
|
<enumeration value="xkms:Indeterminate"/>
|
|
</restriction>
|
|
</simpleType>
|
|
<!-- /Status --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_8"
|
|
id="XKMS_2_0_LC2_Section_5_1_8">5.1.8</a> <a name="ElementsValidReasonetc"
|
|
id="ElementsValidReasonetc">Elements <span
|
|
class="ID"><ValidReason</span></a> <span class="ID">></span>, <span
|
|
class="ID"><InvalidReason></span> and<span
|
|
class="ID"><IndeterminateReason></span></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_206" id="XKMS_2_0_LC2_Paragraph_206"
|
|
class="markParagraph">[206]</a>The <span
|
|
class="ID"><ValidReason></span>, <span
|
|
class="ID"><InvalidReason></span> and<span
|
|
class="ID"><IndeterminateReason></span> elements are used to specify a
|
|
QName that specifies a reason for a particular key binding status.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_207" id="XKMS_2_0_LC2_Paragraph_207"
|
|
class="markParagraph">[207]</a>The status aspects are defined in the table
|
|
below. For convenience the equivalent X509 processing steps are given:</p>
|
|
|
|
<div class="center">
|
|
|
|
<table cellspacing="0" cellpadding="4" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<th valign="top" rowspan="2">Reason QName Local Name</th>
|
|
<th valign="top" rowspan="2">Description</th>
|
|
<th valign="top" colspan="2">X.509 Equivalent</th>
|
|
</tr>
|
|
<tr>
|
|
<th valign="top" class="ID">Valid</th>
|
|
<th valign="top" class="ID">Invalid</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">IssuerTrust</span></td>
|
|
<td valign="top" align="left">The issuer of the information on which
|
|
the key binding is based is considered to be trustworthy by the XKMS
|
|
service.</td>
|
|
<td valign="top" align="left">Certificate path anchored by trusted root
|
|
successfully constructed</td>
|
|
<td valign="top" align="left">Certificate path could not be constructed
|
|
to a trusted root</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span
|
|
class="ID">RevocationStatus</span></td>
|
|
<td valign="top" align="left">The XKMS service has affirmatively
|
|
verified the status of the key binding with an authoritative
|
|
source</td>
|
|
<td valign="top" align="left">Certificate status validated using CRL or
|
|
OCSP</td>
|
|
<td valign="top" align="left">Certificate status returned revoked or
|
|
suspended.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span
|
|
class="ID">ValidityInterval</span></td>
|
|
<td valign="top" align="left">The requested time instant was within the
|
|
validity interval of the key binding</td>
|
|
<td valign="top" align="left">The certificate chain was valid at the
|
|
requested time instant.</td>
|
|
<td valign="top" align="left">The requested time instant was before or
|
|
after the certificate chain validity interval</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" align="left"><span class="ID">Signature</span></td>
|
|
<td valign="top" align="left">Signature on signed data provided by the
|
|
client in the <font face="Courier"><Keyinfo></font> element was
|
|
successfully verified.</td>
|
|
<td valign="top" align="left">Certificate Signature verified</td>
|
|
<td valign="top" align="left">Certificate Signature verification
|
|
failed</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_208" id="XKMS_2_0_LC2_Paragraph_208"
|
|
class="markParagraph">[208]</a>The following schema defines the <span
|
|
class="ID"><ValidReason></span>, <span
|
|
class="ID"><InvalidReason></span> and<span
|
|
class="ID"><IndeterminateReason></span> elements:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- Reason -->
|
|
<element name="ValidReason" type="QName"/>
|
|
<element name="InvalidReason" type="QName"/>
|
|
<element name="IndeterminateReason" type="QName"/>
|
|
<!-- /Reason --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_9"
|
|
id="XKMS_2_0_LC2_Section_5_1_9">5.1.9</a> <a name="ElementQueryKeyBinding"
|
|
id="ElementQueryKeyBinding">Element <span class="ID"><</span><font
|
|
face="Courier">QueryKey</font><span class="ID">Binding></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_209" id="XKMS_2_0_LC2_Paragraph_209"
|
|
class="markParagraph">[209]</a>The <span
|
|
class="ID"><QueryKeyBinding></span> element is derived from the <span
|
|
class="ID">KeyBindingAbstractType</span> and is used to perform a query that
|
|
results in the return of one or more matching key bindings.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_210" id="XKMS_2_0_LC2_Paragraph_210"
|
|
class="markParagraph">[210]</a>A key binding matches the <span
|
|
class="ID">QueryKeyBinding</span> if:</p>
|
|
<ul>
|
|
<li>The key binding contains all the <span
|
|
class="ID"><UseKeyWith></span> elements contained in the query,
|
|
<i><u>and</u></i></li>
|
|
<li>The key binding contains all the <span
|
|
class="ID"><KeyInfo></span> elements contained in the query</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_211" id="XKMS_2_0_LC2_Paragraph_211"
|
|
class="markParagraph">[211]</a>The <span
|
|
class="ID"><QueryKeyBinding></span> element extends the <span
|
|
class="ID">KeyBindingAbstractType</span> with the following additional
|
|
elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><TimeInstant></span> [Optional]</dt>
|
|
<dd>The Time Instant for which the query is made. If no time instant is
|
|
specified the default is the time the request was made.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_212" id="XKMS_2_0_LC2_Paragraph_212"
|
|
class="markParagraph">[212]</a>The following schema defines the <span
|
|
class="ID"><QueryKeyBinding></span> element and <span
|
|
class="ID">KeyBindingType</span>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- QueryKeyBinding -->
|
|
<element name="QueryKeyBinding" type="xkms:QueryKeyBindingType"/>
|
|
<complexType name="QueryKeyBindingType">
|
|
<complexContent>
|
|
<extension base="xkms:KeyBindingAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:TimeInstant" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /QueryKeyBinding --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_1_10"
|
|
id="XKMS_2_0_LC2_Section_5_1_10">5.1.10</a> <a name="ElementTimeInstant"
|
|
id="ElementTimeInstant">Element <span
|
|
class="ID"><TimeInstant></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_213" id="XKMS_2_0_LC2_Paragraph_213"
|
|
class="markParagraph">[213]</a>The <span
|
|
class="ID"><TimeInstant></span> element specifies a specific instant in
|
|
time for which a key binding query is made. The <span
|
|
class="ID"><TimeInstant></span> element contains the following
|
|
attribute:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">Time</span> <b> [Required]</b></dt>
|
|
<dd>Time instant to which a <span
|
|
class="ID"><QueryKeyBinding></span> relates.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_214" id="XKMS_2_0_LC2_Paragraph_214"
|
|
class="markParagraph">[214]</a>All dateTime values MUST fully specify the
|
|
date.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_215" id="XKMS_2_0_LC2_Paragraph_215"
|
|
class="markParagraph">[215]</a>The following schema defines the <span
|
|
class="ID"><TimeInstant></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- TimeInstant -->
|
|
<element name="TimeInstant" type="xkms:TimeInstantType"/>
|
|
<complexType name="TimeInstantType">
|
|
<attribute name="Time" type="dateTime" use="required"/>
|
|
</complexType>
|
|
<!-- /TimeInstant --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_5_2" id="XKMS_2_0_LC2_Section_5_2">5.2</a>
|
|
<a name="LocateService" id="LocateService">Locate Service</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_216" id="XKMS_2_0_LC2_Paragraph_216"
|
|
class="markParagraph">[216]</a>The Locate service accepts as input a <span
|
|
class="ID"><QueryKeyBinding></span> element that specifies a key
|
|
binding and returns one or more <span
|
|
class="ID"><UnverifiedKeyBinding></span> elements that relate to the
|
|
same public key. The <span class="ID"><UnverifiedKeyBinding></span>
|
|
elements returned are specified by the <span class="ID">Respond</span>
|
|
element in the request.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_2_1"
|
|
id="XKMS_2_0_LC2_Section_5_2_1">5.2.1</a>Locate Request <a
|
|
name="ElementLocateRequest" id="ElementLocateRequest">Element <span
|
|
class="ID"><LocateRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_217" id="XKMS_2_0_LC2_Paragraph_217"
|
|
class="markParagraph">[217]</a>The request message contains a <span
|
|
class="ID"><LocateRequest></span> element that contains the following
|
|
element.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span
|
|
class="ID"><b><QueryKeyBinding></b></span> [Required]</dt>
|
|
<dd>The key binding query to be matched in the response</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_218" id="XKMS_2_0_LC2_Paragraph_218"
|
|
class="markParagraph">[218]</a> The following schema defines the <span
|
|
class="ID"><LocateRequest></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- LocateRequest -->
|
|
<element name="LocateRequest" type="xkms:LocateRequestType"/>
|
|
<complexType name="LocateRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:QueryKeyBinding"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /LocateRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_2_2"
|
|
id="XKMS_2_0_LC2_Section_5_2_2">5.2.2</a>Locate Response <a
|
|
name="ElementLocateResult" id="ElementLocateResult">Element <span
|
|
class="ID"><LocateResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_219" id="XKMS_2_0_LC2_Paragraph_219"
|
|
class="markParagraph">[219]</a>The response message contains a <span
|
|
class="ID"><LocateResult></span> element</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><UnverifiedKeyBinding></b></span> [Any
|
|
Number]</dt>
|
|
<dd>A sequence of <span class="ID"><UnverifiedKeyBinding></span>
|
|
key binding that matche the key binding query specified in the
|
|
corresponding request. If no results are found the sequence is empty
|
|
and the <span class="ID"><ResultCode>NoMatch</span> returned.
|
|
In some circumstances a <span class="ID">Locate</span> operation MAY
|
|
return multiple matching results.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_220" id="XKMS_2_0_LC2_Paragraph_220"
|
|
class="markParagraph">[220]</a> The following schema defines the <span
|
|
class="ID"><LocateResult></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- LocateResult -->
|
|
<element name="LocateResult" type="xkms:LocateResultType"/>
|
|
<complexType name="LocateResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:UnverifiedKeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /LocateResult --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_5_3" id="XKMS_2_0_LC2_Section_5_3">5.3</a>
|
|
<a name="ValidateService" id="ValidateService">Validate Service</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_221" id="XKMS_2_0_LC2_Paragraph_221"
|
|
class="markParagraph">[221]</a>The <span class="ID">Validate</span> service
|
|
allows the client to query the binding between a <span
|
|
class="ID"><ds:Keyinfo></span> element and other data such as an
|
|
identifier. The client supplies a prototype for the key binding requested.
|
|
The prototype may specify either a <span class="ID"><ds:Keyinfo></span>
|
|
element or one or more <span class="ID"><UseKeyWith></span> elements
|
|
or both. The server returns one or more <span
|
|
class="ID"><KeyBinding></span> elements that meet the criteria
|
|
specified in the request.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_3_1"
|
|
id="XKMS_2_0_LC2_Section_5_3_1">5.3.1</a>Validate Request <a
|
|
name="ElementValidateRequest" id="ElementValidateRequest">Element <span
|
|
class="ID"><ValidateRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_222" id="XKMS_2_0_LC2_Paragraph_222"
|
|
class="markParagraph">[222]</a>The validate request message contains a <span
|
|
class="ID"><ValidateRequest></span> element:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><QueryKeyBinding></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>The key binding query to be matched in the response.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_223" id="XKMS_2_0_LC2_Paragraph_223"
|
|
class="markParagraph">[223]</a>The following schema defines the <span
|
|
class="ID"><ValidateRequest></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ValidateRequest -->
|
|
<element name="ValidateRequest" type="xkms:ValidateRequestType"/>
|
|
<complexType name="ValidateRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:QueryKeyBinding"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /ValidateRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_5_3_2"
|
|
id="XKMS_2_0_LC2_Section_5_3_2">5.3.2</a>Validate Response <a
|
|
name="ElementValidateResult" id="ElementValidateResult">Element <span
|
|
class="ID"><ValidateResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_224" id="XKMS_2_0_LC2_Paragraph_224"
|
|
class="markParagraph">[224]</a>The validate response message contains a <span
|
|
class="ID"><ValidateResult></span> element:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><Keybinding></b></span>
|
|
<b> [Any Number]</b></dt>
|
|
<dd>A sequence of <span class="ID"><KeyBinding></span> key
|
|
bindings that match the key binding query specified in the
|
|
corresponding request. If no results are found the sequence is empty
|
|
and the <span class="ID"><ResultCode>NoMatch</span> returned.
|
|
In some circumstances a <span class="ID">Validate</span> operation
|
|
MAY return multiple matching results.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_225" id="XKMS_2_0_LC2_Paragraph_225"
|
|
class="markParagraph">[225]</a>The following schema defines the <span
|
|
class="ID"><ValidateResult></span> element and the <span
|
|
class="ID">ValidateResultType</span> type.</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ValidateResult -->
|
|
<element name="ValidateResult" type="xkms:ValidateResultType"/>
|
|
<complexType name="ValidateResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /ValidateResult --></pre>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_6" id="XKMS_2_0_LC2_Section_6">6</a> <a
|
|
name="KeyRegistrationServiceOverview" id="KeyRegistrationServiceOverview">Key
|
|
Registration Service Overview</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_226" id="XKMS_2_0_LC2_Paragraph_226"
|
|
class="markParagraph">[226]</a>The XML Key Registration Service Specification
|
|
permits management of information that is bound to a public key pair. The
|
|
XKRSS service specification supports the following operations:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID">Register</span></dt>
|
|
<dd>Information is bound to a public key pair through a key binding</dd>
|
|
<dt><span class="ID">Reissue</span></dt>
|
|
<dd>A previously registered key binding is reissued.</dd>
|
|
<dt><span class="ID">Revoke</span></dt>
|
|
<dd>A previously registered key binding is revoked.</dd>
|
|
<dt><span class="ID">Recover</span></dt>
|
|
<dd>The private key associated with a key binding is recovered.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_227" id="XKMS_2_0_LC2_Paragraph_227"
|
|
class="markParagraph">[227]</a>An XKMS service may offer all or none of these
|
|
services.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_228" id="XKMS_2_0_LC2_Paragraph_228"
|
|
class="markParagraph">[228]</a>The <span class="ID">Register</span> operation
|
|
does not in itself place any requirement on the registration service to
|
|
communicate that information to any other party. In most applications,
|
|
however, a registration service will provide key information to other Web
|
|
Services such as those described in the XKMS specification or a separate
|
|
underlying PKI such as PKIX.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_229" id="XKMS_2_0_LC2_Paragraph_229"
|
|
class="markParagraph">[229]</a>The <span class="ID">Register</span> operation
|
|
MAY be used in a mode where client requests are accepted by an intermediary
|
|
such as a Local Registration Authority (LRA) and forwarded to a Master
|
|
Registration Authority (MRA). This mode of operation is entirely transparent
|
|
to the client which acts as if the LRA is the only registration authority
|
|
involved. The construction of the proof-of-possession of the private key and
|
|
the authentication information is complete separate of the message
|
|
authentication signature. This allows verification by both the LRA and any
|
|
other registration authority that it is relayed to, even if the message
|
|
authentication signature has been replaced by the LRA.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_6_1" id="XKMS_2_0_LC2_Section_6_1">6.1</a>
|
|
<a name="Registration" id="Registration">Registration</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_230" id="XKMS_2_0_LC2_Paragraph_230"
|
|
class="markParagraph">[230]</a>The <span class="ID">Register</span> request
|
|
is used to assert a binding of information to a public key pair. Generation
|
|
of the public key pair MAY be performed by either the client or the
|
|
Registration service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_231" id="XKMS_2_0_LC2_Paragraph_231"
|
|
class="markParagraph">[231]</a>The Registration request message contains a
|
|
prototype of the requested key binding. The registration service MAY require
|
|
the client to provide additional information to authenticate the request. If
|
|
the public key pair is generated by the client, the service MAY require the
|
|
client to provide Proof of Possession of the private key.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_232" id="XKMS_2_0_LC2_Paragraph_232"
|
|
class="markParagraph">[232]</a>The prototype of the requested key binding may
|
|
contain only partial information, a key without a name or a name without a
|
|
key. In this case, the client is requesting that the registration service
|
|
provide the additional information required to complete the binding. All
|
|
information contained in the prototype of the requested key binding is
|
|
advisory to the service and MAY be ignored or overridden at the option of the
|
|
service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_233" id="XKMS_2_0_LC2_Paragraph_233"
|
|
class="markParagraph">[233]</a>On receipt of a registration request, the
|
|
registration service verifies the authentication and POP information provided
|
|
(if any). If the registration service accepts the request a key binding is
|
|
registered. This key binding MAY include some, all or none of the information
|
|
provided by the prototype key binding and MAY include additional
|
|
information.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_234" id="XKMS_2_0_LC2_Paragraph_234"
|
|
class="markParagraph">[234]</a>The registration service MAY return part or
|
|
all of the registered key binding to the client.</p>
|
|
|
|
<p class="center"><a name="XKMS_2_0_LC2_Paragraph_235"
|
|
id="XKMS_2_0_LC2_Paragraph_235" class="markParagraph">[235]</a> <img
|
|
alt="Diagram shows the data passed from the client to the server for registration"
|
|
src="Images/image010.gif" border="0" width="480" height="216" /></p>
|
|
|
|
<p class="caption"><a name="XKMS_2_0_LC2_Paragraph_236"
|
|
id="XKMS_2_0_LC2_Paragraph_236" class="markParagraph">[236]</a>Figure 5:
|
|
Registration of a Key Binding</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_237" id="XKMS_2_0_LC2_Paragraph_237"
|
|
class="markParagraph">[237]</a>The choice of generation of the key pair at
|
|
the client or the service depends on the application and the type of key. In
|
|
the case of a key used for signing purposes it is generally undesirable for
|
|
any party apart from the key bearer to have access to the private key. Should
|
|
access to the private key be lost a new key may be issued without affecting
|
|
the validity of any of the signatures created using the old private key.
|
|
Accordingly it is usually preferable for such keys to be generated at the
|
|
client and not the server.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_238" id="XKMS_2_0_LC2_Paragraph_238"
|
|
class="markParagraph">[238]</a>In the case of a private key used exclusively
|
|
for certain types of encryption, the loss of access to the private key may
|
|
result in the loss of access to the stored data encrypted under the key. In
|
|
such circumstances it is generally desirable for some form of key recovery to
|
|
be employed. In such systems the key pair is typically generated at the
|
|
service and delivered to the client.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_239" id="XKMS_2_0_LC2_Paragraph_239"
|
|
class="markParagraph">[239]</a>A key used for both signing and encryption
|
|
might be generated at the client or the server depending on whether key
|
|
recovery is to be supported.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_6_1_1"
|
|
id="XKMS_2_0_LC2_Section_6_1_1">6.1.1</a> <a
|
|
name="ExampleRegistrationofClientGeneratedKeyPair"
|
|
id="ExampleRegistrationofClientGeneratedKeyPair">Example: Registration of
|
|
Client-Generated Key Pair</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_240" id="XKMS_2_0_LC2_Paragraph_240"
|
|
class="markParagraph">[240]</a>Alice requests registration of an RSA key pair
|
|
for her email address <span class="ID">Alice@example.com</span>. Alice has
|
|
previously received from the XKMS service the code "024837" with which to
|
|
authenticate her request. Alice selects the pass phrase "Help I have revealed
|
|
my key" to authenticate herself should it be necessary to revoke the
|
|
registration at a later date.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_241" id="XKMS_2_0_LC2_Paragraph_241"
|
|
class="markParagraph">[241]</a>The X-KRSS request message contains the
|
|
following <span class="ID"><RegisterRequest></span> element: Because
|
|
the registration request is for a client generated key the Authentication
|
|
element contains both a <span class="ID"><ProofOfPossession></span>
|
|
element which demonstrates that the request is authorized by the holder of
|
|
the private key and a <KeyBindingAuthentication> element which
|
|
demonstrates that the request was made by a person who knows the
|
|
authentication code "024837".</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RegisterRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="Ib2a24fb53aef424e4cf5cadb457f7cf1"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>X509Cert</RespondWith>
|
|
<RespondWith>X509Chain</RespondWith>
|
|
<PrototypeKeyBinding Id="Icd1c244916cbdfbba2a41a5874050d49">
|
|
<ds:KeyInfo>
|
|
<ds:KeyValue>
|
|
<ds:RSAKeyValue>
|
|
<ds:Modulus>zvbTdKsTprGAKJdgi7ulDR0eQBptLv/SJNIh3uVmPBObZFsLbq
|
|
Pwo5nyLOkzWlEHNbShPMRp1qFr
|
|
AfF13LMmeohNYfCXTHLqH1MaMOm+BhXABHB9rUKaGoOBjQPHCBtHbfMGQYjznGTpfCdTrUgq8VNl
|
|
qM2Ph9XWMcc7qbjNHw8=</ds:Modulus>
|
|
<ds:Exponent>AQAB</ds:Exponent>
|
|
</ds:RSAKeyValue>
|
|
</ds:KeyValue>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2459"
|
|
Identifier="C=&quot;US&quot; O=&quot;Alice Corp&quot;
|
|
CN=&quot;Alice Aardvark&quot;"/>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test"/>
|
|
<UseKeyWith Application="http://ca.example.com/cps/20030401/class3"
|
|
Identifier="alice@alicecorp.test"/>
|
|
</PrototypeKeyBinding>
|
|
<Authentication>
|
|
<KeyBindingAuthentication>
|
|
<ds:Signature>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod
|
|
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
|
|
<ds:SignatureMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/
|
|
>
|
|
<ds:Reference URI="#Icd1c244916cbdfbba2a41a5874050d49">
|
|
<ds:DigestMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
|
|
<ds:DigestValue>GjT4HnC3acxVsQPB0ZKMjHkWPBc=</ds:DigestValu
|
|
e>
|
|
</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>Be8dxsuF1NA1BS186F/YE9kHSAI=</ds:SignatureValu
|
|
e>
|
|
</ds:Signature>
|
|
</KeyBindingAuthentication>
|
|
</Authentication>
|
|
<ProofOfPossession>
|
|
<ds:Signature>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod
|
|
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
|
|
/>
|
|
<ds:SignatureMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
|
|
<ds:Reference URI="#Icd1c244916cbdfbba2a41a5874050d49">
|
|
<ds:DigestMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
|
|
<ds:DigestValue>GjT4HnC3acxVsQPB0ZKMjHkWPBc=</ds:DigestValue>
|
|
</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>OG0Up9FbmfUqD5jPUtXcdbwz5mytziZ1BLYMpmoOso+oonq38
|
|
05ptbtD7Wlmat9jSN9CFA+c7CfE
|
|
klzweUl3C8YGEaiKGbYkhh3oD2UcDXgkbw+u7vnB6RDtZ9jdPjhDmHqzOBqpRmxu13Dq5IR6k5JO
|
|
PxjFHVShfnDQ3BURQ0M=</ds:SignatureValue>
|
|
</ds:Signature>
|
|
</ProofOfPossession>
|
|
</RegisterRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_244" id="XKMS_2_0_LC2_Paragraph_244"
|
|
class="markParagraph">[244]</a>The service accepts the registration and
|
|
returns the following response:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RegisterResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I2faa9375044c778584ab6dbb7601d889"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#Ib2a24fb53aef424e4cf5cadb457f7cf1"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<KeyBinding Id="Id5cead31f37696ed83c4c4300cdf726f">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=
|
|
</ds:X509Certificate>
|
|
<ds:X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2459"
|
|
Identifier="C=&quot;US&quot; O=&quot;Alice Corp&quot;
|
|
CN=&quot;Alice Aardvark&quot;"/>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test"/>
|
|
<UseKeyWith Application="http://ca.example.com/cps/20030401/class3"
|
|
Identifier="alice@alicecorp.test"/>
|
|
<Status StatusValue="Valid">
|
|
<ValidReason>Signature</ValidReason>
|
|
<ValidReason>IssuerTrust</ValidReason>
|
|
<ValidReason>RevocationStatus</ValidReason>
|
|
<ValidReason>ValidityInterval</ValidReason>
|
|
</Status>
|
|
</KeyBinding>
|
|
</RegisterResult></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_6_1_2"
|
|
id="XKMS_2_0_LC2_Section_6_1_2">6.1.2</a> <a
|
|
name="ExampleRegistrationofServiceGeneratedKeyPair"
|
|
id="ExampleRegistrationofServiceGeneratedKeyPair">Example: Registration of
|
|
Service-Generated Key Pair</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_245" id="XKMS_2_0_LC2_Paragraph_245"
|
|
class="markParagraph">[245]</a>The request for registration of a service
|
|
generated key pair omits the public key data and requests that private key
|
|
data be returned with the response.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_246" id="XKMS_2_0_LC2_Paragraph_246"
|
|
class="markParagraph">[246]</a>Bob requests a server generated key pair after
|
|
receiving the authentication code 3n9cj-jk4jk-s04jf-20934-jsr09-jwik4 through
|
|
some out-of-band mechanism. The request specifies only <span
|
|
class="ID">Encryption</span> and <span class="ID">Exchange</span> key uses as
|
|
the key is to be escrowed for possible later recovery and the security policy
|
|
of the issuer does not allow escrow of signature keys. </p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_247" id="XKMS_2_0_LC2_Paragraph_247"
|
|
class="markParagraph">[247]</a>The server generates a public-private key pair
|
|
in response to the request, generates appropriate certifications, and returns
|
|
the result to the client. The result includes the private key value
|
|
encrypted using a key derived from the authentication code value as described
|
|
in Appendix C.1.3. The client can decrypt the private key by computing
|
|
the decryption key from the authentication code value in the same manner as
|
|
the service. </p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_248" id="XKMS_2_0_LC2_Paragraph_248"
|
|
class="markParagraph">[248]</a>To avoid leaking the private key value to
|
|
unauthorized entities it is critical that the service and client protect the
|
|
authentication code value from disclosure. The service should not reuse
|
|
authentication code values nor should the key derived from an authentication
|
|
code be used to encrypt more than a single private key communication.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_249" id="XKMS_2_0_LC2_Paragraph_249"
|
|
class="markParagraph">[249]</a>The calculation of the authentication data and
|
|
encryption of the private key for this example is shown in Appendix C.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_250" id="XKMS_2_0_LC2_Paragraph_250"
|
|
class="markParagraph">[250]</a>The response includes both the public key data
|
|
and the encrypted private key:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RegisterResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I76938e53f0ed178472cb5ee1915e1506"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I4dee7816ffaeff8d93e26615b0e4fb67"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<KeyBinding Id="I397357a6483a835adb1235d9f07fb001">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIIB+zCCAWigAwIBAgIQhzf6GHdFobRCYrjlFTCekjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQyWhcNMzkxMjMxMjM1OTU5WjAlMSMwIQYDVQQGExpVUyBPPUJv
|
|
YiBDb3JwIENOPUJvYiBCYWtlcjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtw2qGqYbO0aK
|
|
eZFb0Z3verx3Cp+KS94LiHG09D1DdgTd48FZaB5eXa4U3mLax2/Fsg/cxGZkXJur0YylS8QvRuX+
|
|
9STQgiFTO277sHFfRMvtFsuQ56ovrQWH/KoGQZssMUIqO2aN2cbMQJST3a2HZuxqPQ1rwXxHrEoA
|
|
XHZv3ysCAwEAAaNHMEUwQwYDVR0BBDwwOoAQRWvWDxzHMSR0xfgYCUPpNqEUMBIxEDAOBgNVBAMT
|
|
B1Rlc3QgQ0GCEHKxUcSI0WKITaXFa+Ylh5IwCQYFKw4DAh0FAAOBgQCieDKjvNCo7MPsgUwHydki
|
|
d4KnulcuBbZet87lcIA7ReH1qEK4s0p49po2UM69eWG7hfv8LW2Ga8HiEexTwLDFBvH2g7f09xI/
|
|
vYgPw4qhJfWoZuY/HWHUzZIRSoggipndVfdvUkmsFSx1rR4FMu0mYBjq79OkYsmwISQlaXejUg==
|
|
</ds:X509Certificate>
|
|
<ds:X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2459"
|
|
Identifier="C=&quot;UK&quot; O=&quot;Bob Corp&quot; CN=&quot;Bob
|
|
Baker&quot;"/>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="bob@bobcorp.test"/>
|
|
<Status StatusValue="Valid">
|
|
<ValidReason>Signature</ValidReason>
|
|
<ValidReason>IssuerTrust</ValidReason>
|
|
<ValidReason>RevocationStatus</ValidReason>
|
|
<ValidReason>ValidityInterval</ValidReason>
|
|
</Status>
|
|
</KeyBinding>
|
|
<PrivateKey>
|
|
<xenc:EncryptedData>
|
|
<xenc:EncryptionMethod
|
|
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
|
|
<xenc:CipherData>
|
|
<xenc:CipherValue>Hnp23IfB9Vpt5f4A6392Lqk3+h+Y999rJhpiexi+xXEWokE
|
|
1ntr0Z4q4u36hRy0PPmAUSs8JbFdE
|
|
U+G+zxvH4CLbr8wL4MMWvidEZJhMbEyQE3Z8FmQmbysboFGUpqx1327fTAqhCRW1MHtMiWk1O9Si
|
|
otHY2UpTPnJ8Wud6wSGlNemwSQCc5F3AhDo0ptXidHH1SsyRyqrDCpgmUstRkUCrExZP7S5sWBCd
|
|
RuHsYB+OPwPdhEhmVcs2FECXGl/0gL872Y/YHhzwIzfqNgV663LvKBnJWLYgQb8wDM3QIIEi5YoF
|
|
HJKhrQn8WMJrQ+84UWHAldQS5AMnIbI7ObK+WzXxnlZy6Mh+zbqRB3KnqRvSiLMjpooWJv/z4obx
|
|
JZP9/1q4WF6w1zpV8jWsASCp6HKZ+PF6bhpJ9ZnVLsRvYUaQpx0Qe8eNvS1p1pRRlH7XJJZEfOff
|
|
85u8JzlJH10IP2Ayu8WLGktTjgr1qAwjhhc8NVOGtRyEB6xERr2sAKuKjXE9I72ILzHRgtKCgPqO
|
|
ILrDz1BVYnJy3oFpCud2gYDsKPgS/2qNkUgOI6beW+oYiSUbPUvyJyVnS4D6xhPH0FRTu6Fs5Q/U
|
|
R/jk+YQKAoAY6YkfJe3VhqlFB091ALcV/FsuRM1r+Iy1mqg0E5QtRpzTEVceebIFspEB628qaCIk
|
|
Mmw+j8h+9kksDzW2aZieA+fxFsS/OLGuCy6cqh+H8LxSFSpCflWxWTcBEfPNGnfPDRTn7f7kBaat
|
|
Tas1olPQZmoJ3iT3vvhpVkr9aEun0LkQ06+XApQKlhYjMgYCTMCnjEF4HhepIZS73LpiAvQM/LmV
|
|
U4HO91skUcWYBluH0h+jSm5RfsjAFldpoc0bWwCEDUHeq/K9+PEDxZeN3NQXrx8Qn6nDcKNRH7nc
|
|
LmAg/LMm6B/hMJ67WHDzqfuU6TtnkN4uv+qFgX4MXOgTKIyB9BVEgAkEUOxhsCixCd9u4wT9lT3L
|
|
guTLuFSc4oJYJfYSd5dMAOJjrHj7GSByB1pkP9RWYowKIWGW07cBnQ4p02QuUWbWoE4k0+M2Ugzu
|
|
aqJkuzmVS9MLxCNX13NjSp0nLJ5Ko+98/9rjmn/c/OoSOeDmzuOmi8zxZnp/jS/mUnaOcwGr/aA1
|
|
kkbO5fGOnJmMTKMNKi+Xnu5lZKpWpAGf079Ie8vPrYaGKCupoCowUeRDurfzDyVZNE6hy1SjvceF
|
|
/RADIKh15A+GODPXr0VRuMs38q8ZwCYmJWaBZtyBroHBxTJmqOIcNxtINCn2ojO3LjmyYKz1cJHP
|
|
DVkd210pdHWp1zjy0M2VaHSA1t9Wr5lT8c20gNqmI6AqBdirUc1Ka15Ktj2pMvDSe2RycKnkXgJ7
|
|
IgYrTyXe/BHquAeADOkFRn7ZJi3RxHDSW7B+kZ5JXubnHy8PiV8=</xenc:CipherValue>
|
|
</xenc:CipherData>
|
|
</xenc:EncryptedData>
|
|
</PrivateKey>
|
|
</RegisterResult></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_6_2" id="XKMS_2_0_LC2_Section_6_2">6.2</a>
|
|
<a name="Reissue" id="Reissue">Reissue</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_251" id="XKMS_2_0_LC2_Paragraph_251"
|
|
class="markParagraph">[251]</a>A Registration service MAY permit clients to
|
|
reissue previously issued key bindings. A reissue request is made in the same
|
|
manner as the initial registration of a key.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_252" id="XKMS_2_0_LC2_Paragraph_252"
|
|
class="markParagraph">[252]</a>The principal reason a client would make a
|
|
Reissue request is to cause the registration service to generate new
|
|
credentials in the underlying PKI, e.g. X.509 Certificates.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_6_2_1"
|
|
id="XKMS_2_0_LC2_Section_6_2_1">6.2.1</a> <a name="ExampleReissue"
|
|
id="ExampleReissue">Example: Reissue</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_253" id="XKMS_2_0_LC2_Paragraph_253"
|
|
class="markParagraph">[253]</a>Alice requests reissue of her previously
|
|
issued RSA key pair for her email address.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_254" id="XKMS_2_0_LC2_Paragraph_254"
|
|
class="markParagraph">[254]</a>The X-KRSS request message contains the
|
|
following <span class="ID"><ReissueRequest></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<ReissueRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I88343deedc35d02aca17492766be0815"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>X509Cert</RespondWith>
|
|
<RespondWith>X509Chain</RespondWith>
|
|
<ReissueKeyBinding Id="Ic46d382e5fd01e9349004cdbdb7f2ed4">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJBgUrD
|
|
gMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<Status StatusValue="Valid" />
|
|
</ReissueKeyBinding>
|
|
<Authentication>
|
|
<KeyBindingAuthentication>
|
|
<ds:Signature>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod
|
|
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
|
|
/>
|
|
<ds:SignatureMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1" />
|
|
<ds:Reference URI="#Ic46d382e5fd01e9349004cdbdb7f2ed4">
|
|
<ds:DigestMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
|
|
<ds:DigestValue>9LRNiWWg8Hqfz8It9m6rdevAvPU=</ds:DigestValue>
|
|
</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>wDQjKafl5+oC1F3ZOOVUFalzINU=</ds:SignatureValue>
|
|
</ds:Signature>
|
|
</KeyBindingAuthentication>
|
|
</Authentication>
|
|
<ProofOfPossession>
|
|
<ds:Signature>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod
|
|
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
|
|
<ds:SignatureMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
|
|
<ds:Reference URI="#Ic46d382e5fd01e9349004cdbdb7f2ed4">
|
|
<ds:DigestMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
|
|
<ds:DigestValue>9LRNiWWg8Hqfz8It9m6rdevAvPU=</ds:DigestValue>
|
|
</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>ptnvU5xfotPoerxGVC213IwkA2fsSq7xb1IkTI2Mam4CG9czL02W
|
|
fgn54Acfn2xc0NQC5cA75T9J
|
|
wApX0m+cKvldQhDQ0iIQC7Z2gX4rc5F7FfcYc1q0gz2DO6jbw1NaJ76ypGDRNxmBAOwvIoTnLBGc
|
|
ivNL60Vh3btz9GS8xcY=</ds:SignatureValue>
|
|
</ds:Signature>
|
|
</ProofOfPossession>
|
|
</ReissueRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_255" id="XKMS_2_0_LC2_Paragraph_255"
|
|
class="markParagraph">[255]</a>The service accepts the registration and
|
|
returns the following response:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<ReissueResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="Ide4b886422dd540add1611f6dcd7a504"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I88343deedc35d02aca17492766be0815"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<KeyBinding Id="I70584c813547faf48d6d296ee0876df5">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=
|
|
</ds:X509Certificate>
|
|
<ds:X509Certificate>MIIB9zCCAWSgAwIBAgIQcrFRxIjRYohNpcVr5iWHkjAJB
|
|
gUrDgMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdUZXN0IENB
|
|
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPF33VmCmSSFufPnu0JdFaKsPHsx0ee+OYedhM
|
|
xVh3LXMkMNC++JWDva7H+E9o+uj7dt5cwxHSePsyxPx3Vq+AbEZOsYxGxXgf4OuGb8ONBv3B5c8h
|
|
raOg24c5hjFS6tfNzoiatLVKHeOmPnifhkBI8h8LD7dLHsHfKUrVNwIJNQIDAQABo1YwVDANBgNV
|
|
HQoEBjAEAwIHgDBDBgNVHQEEPDA6gBBFa9YPHMcxJHTF+BgJQ+k2oRQwEjEQMA4GA1UEAxMHVGVz
|
|
dCBDQYIQcrFRxIjRYohNpcVr5iWHkjAJBgUrDgMCHQUAA4GBAAynWUPRSbabAEuX0Z8kKN/C2GoE
|
|
uULW73QxX6Q0PHAatRM6G9ZnzU+ce3lELgOj0Usw/xC9Y+2FMgj68rIas+DId5JMMj+SIZEUV1vP
|
|
PTEiEQ16Gxz9piUQoFljhI22hEl8ki0hIJlFGnki+K9dhv/7trMrfKSSHAPIDQZuz01P
|
|
</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<KeyUsage>Signature</KeyUsage>
|
|
<KeyUsage>Encryption</KeyUsage>
|
|
<KeyUsage>Exchange</KeyUsage>
|
|
<UseKeyWith Application="urn:ietf:rfc:2633"
|
|
Identifier="alice@alicecorp.test"/>
|
|
<Status StatusValue="Valid">
|
|
<ValidReason>Signature</ValidReason>
|
|
<ValidReason>IssuerTrust</ValidReason>
|
|
<ValidReason>RevocationStatus</ValidReason>
|
|
<ValidReason>ValidityInterval</ValidReason>
|
|
</Status>
|
|
</KeyBinding>
|
|
</ReissueResult></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_6_3" id="XKMS_2_0_LC2_Section_6_3">6.3</a>
|
|
<a name="Revocation" id="Revocation">Revocation</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_256" id="XKMS_2_0_LC2_Paragraph_256"
|
|
class="markParagraph">[256]</a>A Registration service MAY permit clients to
|
|
revoke previously issued key bindings.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_257" id="XKMS_2_0_LC2_Paragraph_257"
|
|
class="markParagraph">[257]</a>If an XKMS key binding is bound to a data
|
|
object in an underlying PKI the revocation of the key binding SHOULD result
|
|
in the revocation of the underlying data object. For example if the XKMS key
|
|
binding is bound to an X.509 certificate the revocation of the key binding
|
|
SHOULD result in revocation of the underlying certificate.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_6_3_1"
|
|
id="XKMS_2_0_LC2_Section_6_3_1">6.3.1</a> <a name="ExampleRevocation"
|
|
id="ExampleRevocation">Example: Revocation</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_258" id="XKMS_2_0_LC2_Paragraph_258"
|
|
class="markParagraph">[258]</a>For some reason Alice requests the
|
|
registration service revoke the binding for her public key. Alice
|
|
authenticates herself using the pass phrase value established during
|
|
registration.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_259" id="XKMS_2_0_LC2_Paragraph_259"
|
|
class="markParagraph">[259]</a>The request message is:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RevokeRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I7edfd825be9d24d0e6d9134b6ec65b02"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RevokeKeyBinding Id="I18a98c1b1d6d7b526b38d762552b12a1">
|
|
<ds:KeyInfo>
|
|
<ds:X509Data>
|
|
<ds:X509Certificate>MIICAjCCAW+gAwIBAgIQlzQovIEbLLhMa8K5MR/juzAJBgUrD
|
|
gMCHQUAMBIxEDAOBgNVBAMTB1Rl
|
|
c3QgQ0EwHhcNMDIwNjEzMjEzMzQxWhcNMzkxMjMxMjM1OTU5WjAsMSowKAYDVQQGEyFVUyBPPUFs
|
|
aWNlIENvcnAgQ049QWxpY2UgQWFyZHZhcmswgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMoy
|
|
4c9+NoNJvJUnV8pqPByGb4FOJcU0VktbGJpO2imiQx+EJsCt27z/pVUDrexTyctCWbeqR5a40JCQ
|
|
mvNmRUfg2d81HXyA+iYPl4L6nUlHbkLjrhPPtMDSd5YHjyvnCN454+Hr0paA1MJXKuw8ZMkjGYsr
|
|
4fSYpPELOH5PDJEBAgMBAAGjRzBFMEMGA1UdAQQ8MDqAEEVr1g8cxzEkdMX4GAlD6TahFDASMRAw
|
|
DgYDVQQDEwdUZXN0IENBghBysVHEiNFiiE2lxWvmJYeSMAkGBSsOAwIdBQADgYEAKp+RKhDMIVIb
|
|
ooSNcoIeV/wVew1bPVkEDOUwmhAdRXUA94uRifiFfmp9GoN08Jkurx/gF18RFB/7oLrVY+cpzRoC
|
|
ipcnAnmh0hGY8FNFmhyKU1tFhVFdFXB5QUglkmkRntNkOmcb8O87xO0XktmvNzcJDes9PMNxrVtC
|
|
hzjaFAE=</ds:X509Certificate>
|
|
</ds:X509Data>
|
|
</ds:KeyInfo>
|
|
<Status StatusValue="Indeterminate" />
|
|
</RevokeKeyBinding>
|
|
<RevocationCode>PHx8li2SUhrJv2e1DyeWbGbD6rs=</RevocationCode>
|
|
</RevokeRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_260" id="XKMS_2_0_LC2_Paragraph_260"
|
|
class="markParagraph">[260]</a>The service responds that the key binding has
|
|
been revoked:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RevokeResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I241c8cd4f1db162c02acfcec80466da6"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I7edfd825be9d24d0e6d9134b6ec65b02"
|
|
xmlns="http://www.w3.org/2002/03/xkms#" /></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_6_4" id="XKMS_2_0_LC2_Section_6_4">6.4</a>
|
|
<a name="KeyRecovery" id="KeyRecovery">Key Recovery</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_261" id="XKMS_2_0_LC2_Paragraph_261"
|
|
class="markParagraph">[261]</a>A Registration service MAY support key
|
|
recovery. For key recovery to be possible the private key to be recovered
|
|
MUST have been previously escrowed with the recovery service, for example by
|
|
means of the XKRSS registration of a server generated key. A key recovery
|
|
request is made in the same manner as the initial registration of a key
|
|
except that since the registration service might not have a record of the key
|
|
binding to be recovered the result code <span class="ID">NotFound</span> MAY
|
|
be returned.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_262" id="XKMS_2_0_LC2_Paragraph_262"
|
|
class="markParagraph">[262]</a>The key recovery service is likely to require
|
|
time to respond to the recovery request. Clients supporting key recovery
|
|
SHOULD support asynchronous processing.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_263" id="XKMS_2_0_LC2_Paragraph_263"
|
|
class="markParagraph">[263]</a>The security policy of the issuer MAY consider
|
|
the key recovery process itself as an actual or potential compromise of the
|
|
recovered key and thus require the revocation of all associated key bindings,
|
|
particularly if the key recovery was requested by a third party such as the
|
|
supervisor of the key holder.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_6_4_1"
|
|
id="XKMS_2_0_LC2_Section_6_4_1">6.4.1</a> <a name="ExampleKeyRecovery"
|
|
id="ExampleKeyRecovery">Example: Key Recovery</a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_264" id="XKMS_2_0_LC2_Paragraph_264"
|
|
class="markParagraph">[264]</a>Bob has forgotten the private key which he
|
|
obtained in the earlier registration example. He first contacts the
|
|
administrator of the key recovery service using an out-of-band authentication
|
|
procedure determined by site policy. The key recovery administrator issues to
|
|
Bob (using an out of band method) the key recovery authorization code "<span
|
|
class="ID">A8YUT VUHHU C9H29 8Y43U H9J3I 23</span>". In this case the code is
|
|
read over the telephone and so it would be inconvenient to be required to
|
|
specify spacing between the code blocks or capitalization.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_265" id="XKMS_2_0_LC2_Paragraph_265"
|
|
class="markParagraph">[265]</a>The request parameters for the key recovery
|
|
are:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RecoverRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="I6b917470995f9f4e9a7432e266d8aa23"
|
|
Service="http://test.xmltrustcenter.org/XKMS"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<RespondWith>PrivateKey</RespondWith>
|
|
<RecoverKeyBinding Id="Ifc4e210e8889bc463a6dd5765ff0645f">
|
|
<ds:KeyInfo>
|
|
<ds:KeyValue>
|
|
<ds:RSAKeyValue>
|
|
<ds:Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FLmGHWn
|
|
Qy2cSj39hf5D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</ds:Modulus>
|
|
<ds:Exponent>AQAB</ds:Exponent>
|
|
</ds:RSAKeyValue>
|
|
</ds:KeyValue>
|
|
</ds:KeyInfo>
|
|
<Status StatusValue="Indeterminate" />
|
|
</RecoverKeyBinding>
|
|
<Authentication>
|
|
<KeyBindingAuthentication>
|
|
<ds:Signature>
|
|
<ds:SignedInfo>
|
|
<ds:CanonicalizationMethod
|
|
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
|
|
/>
|
|
<ds:SignatureMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1" />
|
|
<ds:Reference URI="#Ifc4e210e8889bc463a6dd5765ff0645f">
|
|
<ds:DigestMethod
|
|
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
|
|
<ds:DigestValue>6Vd6GGuGMIgdLEt903tLvuw5Tzc=</ds:DigestValue>
|
|
</ds:Reference>
|
|
</ds:SignedInfo>
|
|
<ds:SignatureValue>rx5c/qhYsjocM7a2oGd7FoNqsco=</ds:SignatureValue>
|
|
</ds:Signature>
|
|
</KeyBindingAuthentication>
|
|
</Authentication>
|
|
</RecoverRequest></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_266" id="XKMS_2_0_LC2_Paragraph_266"
|
|
class="markParagraph">[266]</a>The policy of this particular registration
|
|
service is to revoke a private key whenever key recovery is performed. A
|
|
registration service might adopt a revoke on recover policy for a number of
|
|
reasons which include concern that the recovery process might be considered
|
|
to have compromised the key in some way. The service returns the
|
|
revoked key binding and the private key parameters:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RecoverResult xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
|
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
|
|
Id="If0a95d5df7851e45bff23df201a2bc8d"
|
|
Service="http://test.xmltrustcenter.org/XKMS" ResultMajor="Success"
|
|
RequestId="#I6b917470995f9f4e9a7432e266d8aa23"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<KeyBinding Id="Ifc4e210e8889bc463a6dd5765ff0645f">
|
|
<ds:KeyInfo>
|
|
<ds:KeyValue>
|
|
<ds:RSAKeyValue>
|
|
<ds:Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FLmGHWn
|
|
Qy2cSj39hf5D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</ds:Modulus>
|
|
<ds:Exponent>AQAB</ds:Exponent>
|
|
</ds:RSAKeyValue>
|
|
</ds:KeyValue>
|
|
</ds:KeyInfo>
|
|
<Status StatusValue="Invalid">
|
|
<InvalidReason>Signature</InvalidReason>
|
|
<InvalidReason>IssuerTrust</InvalidReason>
|
|
<InvalidReason>RevocationStatus</InvalidReason>
|
|
<InvalidReason>ValidityInterval</InvalidReason>
|
|
</Status>
|
|
</KeyBinding>
|
|
<PrivateKey>
|
|
<xenc:EncryptedData>
|
|
<xenc:EncryptionMethod
|
|
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
|
|
<xenc:CipherData>
|
|
<xenc:CipherValue>hcq+ZmNCyjbotxsLUwR7EyKqwxw2hvoLVJDBiE2ToHAG9x3d5G5
|
|
byhD0CvAumVUY1FIPurlEsU7Y
|
|
F0rgjo0BmycWyccDz8n9r8BYEkdZ0vM5YCmrw1NMCwlXVROHeXvToyq1PPAbcC4Ub9Gds6z2Z3Az
|
|
1um9UHR+kMgbHug/zai3BtSm+sIWRqx37WNQw6OSanlsk1N2K5PbKvkV1p5ajEmKiAqGiRZ3VzWJ
|
|
AyWAqHGgMcR8ZNPRlGA+Jnr5SoiUkxSzlyLVii8VDLUpfEfAkJyIoxfYdgfUHj8lAzs/vEQc1zV8
|
|
SMI0OAOQ+t405fkoVgtusnehY7ExwpyxGdGmN95dNLSliW7uPpbaQ14HvSJbmt/jvQnXmY5uDT4i
|
|
V2MM1gTqe95hrB6M5LN4SYk+hUyFoPnKWOdyc6sfIFNIf+d2UMAvj+ZZ/SbC4SBzJA91cTX9jW79
|
|
c9HXCBQn0XgKGJsRA4As3hETeqXyahyVi2yYESyYwMHq+F8wWh9yqSPxBKAbGbt7FuBkyWaaYcR7
|
|
DnagoJren08tO7z1y3VIezfg+y0N0WyVDsDXD3qizXepfDzG4HPkAnml/2QRfKRkyRDtzlEwHEUC
|
|
lNlU3UfoGDf35vHEB4iZkaajDlTLSH9tgvJNuiurJaypX4/wjeHce+j1n9qVDS4PUh1qZ0C4cf+O
|
|
6iCJbxC4iYHLgZM+QgxNPu9vzFDpVaBfxZAl8jWVRw38tbPXVXFsj52IxAr1G8emOM5NOHgqSkPB
|
|
KwDQj7I2leWkxgE+9//29I+Dfbe5qu490ST2VVsY6lCTzDpV7kUFfXo3q3qC0E1N9KjYncEheKY7
|
|
Gnr5LBw+fkMwBlo84kTo4e8MaK/EYQpc9tHEh/ZQ60jbDlomEwg0cKdxdmroG43Cvffoi8b6LRqz
|
|
MVDqyRVAh3cmKxY/kwrWGfmcz87Z2r4v0hg1ihXdW8w92xCcOOYrg+28MzA5J080a4Y9povi4/MZ
|
|
RKBF4BZ9vfp0Nn+4PzqXIhANIclAQegbf4oQmtQkmkU5o+/fBZ0cpCXa9yvdS5espHLXakM03B2o
|
|
dM7w/Q0lwQAJl+TcLXVaWhNRZdqtYO7comjpfesez0w7B59khJFWtjOUmDr68h/uG8KOQAL7roAN
|
|
VpixczelnEs3hGOGz9dYhIswQTjlajuK8imu3YC4zomoP1ph8qS+oQP7whOY3YwC4Wpwn6gHm+5s
|
|
De6MZCSd/HANOIISkwqHtt7HBuOoCl2W3j+DeWfjyoJl8XHHoPgQ8/DejUH/Yic1QodFgQRHWSEW
|
|
U1j8RWYUDXseA3Wll8D9eKpyenFoaTacy5/BHW6p1Jt4Y69RcfWeQFqP5T53VJPsqa6aQwyXR5VG
|
|
euErvZnqJadzsd29QdfwuUbv+/1hXWWO5oRKQdnOY9p+VXZ5PTU=</xenc:CipherValue>
|
|
</xenc:CipherData>
|
|
</xenc:EncryptedData>
|
|
</PrivateKey>
|
|
</RecoverResult></pre>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_267" id="XKMS_2_0_LC2_Paragraph_267"
|
|
class="markParagraph">[267]</a>The decrypted private key parameters are:</p>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RSAKeyValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FLmGHWnQy2cSj39hf5
|
|
D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
<P>9bfMM0ZkTd/bs9Vy9vGSdaOZ2qQh/0JVbpAMXSd0AEtPj8m28ZaGW+8wQ4OdOEmouNPDkhm6
|
|
O7HC
|
|
TJ3IY18Phw==</P>
|
|
<Q>66PdfVufWHWghfUMVg3SypsiFWYCWIlgzl0AyZfUpRufjAMXpkpJckNh5qBAEikEPEsY7p3D
|
|
vISV
|
|
TDqHeh/Xhw==</Q>
|
|
<DP>rZ5v768GQqwxThE9CVXJ2ct+c6nTx8w0F0o7Ijs1UNvl3MB3vp5QU3dfj+TYWyRYzjf7ESm
|
|
SmIlS
|
|
s9Ys+GH70w==</DP>
|
|
<DQ>HvCEG3qVQIspSY10UjQ8cifOYNrlAfT/xfjGKrIJ1Kf82ehqCYaFgEBCsYJnBztld/kwS9x
|
|
hH/aU
|
|
l86zjSBzLw==</DQ>
|
|
<InverseQ>FBpix6rKRUOlpddbREtNXGjiyvLK+jWu+pSCiTSpaQQkVuNH9dSRVqhbZi5ctYFuV
|
|
QISjfW4lap9
|
|
pLKX5vCw/g==</InverseQ>
|
|
<D>ystjbFxsWdF2FAmyfUAh54kr5Ir9f2PdwtO9hGqe1Qp3iy1BirWWRQU9y0MN51BlkUXej/YH
|
|
MZoc
|
|
tlaRpfLrLfcNYB4odKP4Tku+3eqqoc70kMYorU34NJQeeDVvDHaCm21qiSa9Je9QTlHI4PN38kM0
|
|
N3mEuHXRuw7MQI7W62k=</D>
|
|
</RSAKeyValue></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_6_5" id="XKMS_2_0_LC2_Section_6_5">6.5</a>
|
|
<a name="RequestAuthentication" id="RequestAuthentication">Request
|
|
Authentication</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_268" id="XKMS_2_0_LC2_Paragraph_268"
|
|
class="markParagraph">[268]</a>X-KRSS specifies a mechanism for
|
|
authenticating requests that is independent of any authentication mechanism
|
|
provided by the message security binding. By its nature the X-KRSS protocol
|
|
is required to support requests from parties who have yet to register their
|
|
credentials or who have impaired credentials which are to be revoked.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_269" id="XKMS_2_0_LC2_Paragraph_269"
|
|
class="markParagraph">[269]</a>An X-KRSS Service SHOULD ensure that all
|
|
requests are authentic and authorized.</p>
|
|
|
|
<blockquote>
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_270" id="XKMS_2_0_LC2_Paragraph_270"
|
|
class="markParagraph">[270]</a> <b>Authenticity</b>: The request message
|
|
originated from the specified party.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_271" id="XKMS_2_0_LC2_Paragraph_271"
|
|
class="markParagraph">[271]</a> <b>Integrity</b>: The request message has
|
|
not been modified.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_272" id="XKMS_2_0_LC2_Paragraph_272"
|
|
class="markParagraph">[272]</a> <b>Possession</b>: If a public key is
|
|
specified in a registration request, proof that the request is authorized
|
|
by a party that has access to the corresponding private key.</p>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_273" id="XKMS_2_0_LC2_Paragraph_273"
|
|
class="markParagraph">[273]</a>Registration services set their own
|
|
authentication policy. This specification defines an authentication mechanism
|
|
that employs a shared secret established out of band between the client and
|
|
the registration service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_274" id="XKMS_2_0_LC2_Paragraph_274"
|
|
class="markParagraph">[274]</a>Services SHOULD require that clients
|
|
demonstrate Proof of Possession of the private key components of a public key
|
|
if a request is made to register a valid key binding bound to that public
|
|
key.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_275" id="XKMS_2_0_LC2_Paragraph_275"
|
|
class="markParagraph">[275]</a>Services SHOULD accept Proof of Possession of
|
|
the private key component of a public key to effect revocation of any key
|
|
binding bound to that key.</p>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_7" id="XKMS_2_0_LC2_Section_7">7</a> <a
|
|
name="KeyRegistrationServiceMessageSet"
|
|
id="KeyRegistrationServiceMessageSet">Key Registration Service Message
|
|
Set</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_276" id="XKMS_2_0_LC2_Paragraph_276"
|
|
class="markParagraph">[276]</a>The protocol operations consist of a remote
|
|
procedure call that consists of a single request message sent by the client
|
|
to the registration service followed by a single response message sent by the
|
|
server to the client. </p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_277" id="XKMS_2_0_LC2_Paragraph_277"
|
|
class="markParagraph">[277]</a>A response message MAY contain multiple key
|
|
bindings if the operation resulted in the creation or a change in the status
|
|
of multiple key bindings. For example a Register operation might cause two
|
|
independent key bindings with different policy identifiers and validity
|
|
intervals to be established in two independent underlying PKIs. Revocation of
|
|
one such key binding might cause the revocation of other associated key
|
|
bindings.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_7_1" id="XKMS_2_0_LC2_Section_7_1">7.1</a>
|
|
<a name="CommonElements" id="CommonElements">Common Elements</a></h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_1"
|
|
id="XKMS_2_0_LC2_Section_7_1_1">7.1.1</a> <a
|
|
name="ElementPrototypeKeyBinding" id="ElementPrototypeKeyBinding">Element
|
|
<span class="ID"><PrototypeKeyBinding></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_278" id="XKMS_2_0_LC2_Paragraph_278"
|
|
class="markParagraph">[278]</a>The <span
|
|
class="ID"><PrototypeKeyBinding></span> element is derived from the
|
|
<span class="ID">KeyBindingAbstractType</span>. It is used to specify the
|
|
values of elements that a client requests be present in the keybinding
|
|
resulting from a registration request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_279" id="XKMS_2_0_LC2_Paragraph_279"
|
|
class="markParagraph">[279]</a>All fields in a <span
|
|
class="ID"><PrototypeKeyBinding></span> element are advisory and MAY be
|
|
ignored by the service. For example a client might request registration under
|
|
the policy identifier http://example.com/policy/high-security corresponding
|
|
to a high assurance issuance policy but the returned key binding might
|
|
specify the policy identifier http://example.com/policy/low-security
|
|
corresponding to a low assurance issuance policy instead.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_280" id="XKMS_2_0_LC2_Paragraph_280"
|
|
class="markParagraph">[280]</a>The <span
|
|
class="ID"><PrototypeKeyBinding></span> element extends the <span
|
|
class="ID">KeyBindingAbstractType</span> with the following additional
|
|
elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span
|
|
class="ID"><b><ValidityInterval></b></span> [Optional]</dt>
|
|
<dd>The suggested time interval for which the key binding relationship
|
|
is valid.</dd>
|
|
<dt><span class="ID"><RevocationCodeIdentifier></span>
|
|
[Optional]</dt>
|
|
<dd>Specifies a value to be used to validate a <span
|
|
class="ID">RevocationCode</span> value in a subsequent Revocation
|
|
request</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_281" id="XKMS_2_0_LC2_Paragraph_281"
|
|
class="markParagraph">[281]</a>The following schema defines the <span
|
|
class="ID"><PrototypeKeyBinding></span>element and <span
|
|
class="ID">PrototypeKeyBindingType</span>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- PrototypeKeyBinding -->
|
|
<element name="PrototypeKeyBinding" type="xkms:PrototypeKeyBindingType"/>
|
|
<complexType name="PrototypeKeyBindingType">
|
|
<complexContent>
|
|
<extension base="xkms:KeyBindingAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:ValidityInterval" minOccurs="0"/>
|
|
<element ref="xkms:RevocationCodeIdentifier" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /PrototypeKeyBinding --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_2"
|
|
id="XKMS_2_0_LC2_Section_7_1_2">7.1.2</a> <a
|
|
name="ElementRevocationCodeIdentifier"
|
|
id="ElementRevocationCodeIdentifier">Element <span
|
|
class="ID"><RevocationCodeIdentifier></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_282" id="XKMS_2_0_LC2_Paragraph_282"
|
|
class="markParagraph">[282]</a>The <span
|
|
class="ID"><RevocationCodeIdentifier></span> element contains a MAC
|
|
output value encoded as a base64 string.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_283" id="XKMS_2_0_LC2_Paragraph_283"
|
|
class="markParagraph">[283]</a>The default MAC algorithm used is HMAC-SHA1.
|
|
Other MAC algorithms MAY be used provided that the client is advised that the
|
|
service accepts such algorithms by means of an out of band mechanism such as
|
|
a Web Service description or policy mechanism.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_284" id="XKMS_2_0_LC2_Paragraph_284"
|
|
class="markParagraph">[284]</a>On initial registration the <span
|
|
class="ID"><RevocationCodeIdentifier></span> value is obtained by first
|
|
performing the MAC calculation on the pass phrase value, then performing a
|
|
second MAC calculation on the result.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_285" id="XKMS_2_0_LC2_Paragraph_285"
|
|
class="markParagraph">[285]</a>To prove knowledge of the pass phrase in a
|
|
subsequent revocation request the <span
|
|
class="ID"><RevocationCode></span> value is obtained by performing the
|
|
MAC calculation on the pass phrase value.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_286" id="XKMS_2_0_LC2_Paragraph_286"
|
|
class="markParagraph">[286]</a>The double MAC calculation ensures that the
|
|
<font face="Courier"><RevocationCode></font> value may be sent as
|
|
plaintext without the risk of disclosing a value which might have been used
|
|
by the end-user as a password in another context. A second advantage of
|
|
employing the double MAC calculation is that it ensures XKMS service does not
|
|
place arbitrary constraints on the length of or character set in which the
|
|
pass phrase is encoded.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_287" id="XKMS_2_0_LC2_Paragraph_287"
|
|
class="markParagraph">[287]</a>Details of the MAC output value calculation
|
|
are provided in the section <a href="#sharedsecret">Cryptographic Algorithm
|
|
Specific Parameters</a> below.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_288" id="XKMS_2_0_LC2_Paragraph_288"
|
|
class="markParagraph">[288]</a>The following schema defines the <span
|
|
class="ID"><RevocationCodeIdentifier></span> element and the <span
|
|
class="ID">RevocationCodeIdentifierType</span>type:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RevocationCodeIdentifier -->
|
|
<element name="RevocationCodeIdentifier"
|
|
type="xkms:RevocationCodeIdentifierType"/>
|
|
<simpleType name="RevocationCodeIdentifierType">
|
|
<restriction base="base64Binary"/>
|
|
</simpleType>
|
|
<!-- /RevocationCodeIdentifier --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_3"
|
|
id="XKMS_2_0_LC2_Section_7_1_3">7.1.3</a> <a name="ElementAuthentication"
|
|
id="ElementAuthentication">Element <span
|
|
class="ID"><Authentication></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_289" id="XKMS_2_0_LC2_Paragraph_289"
|
|
class="markParagraph">[289]</a>The <span
|
|
class="ID"><Authentication></span> element is used to authenticate the
|
|
key binding element within an XKRSS request. This may be a <<span
|
|
class="ID">PrototypeKeyBinding></span>, <span
|
|
class="ID"><ReissueKeyBinding</span>>, <span
|
|
class="ID"><RevokeKeyBinding</span>> or <span
|
|
class="ID"><RecoverKeyBinding</span>> element depending on the type of
|
|
request.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><KeyBindingAuthentication></b></span>
|
|
<b> [Optional]</b></dt>
|
|
<dd>Authentication of the key binding by means of a signature using a
|
|
previously established key.</dd>
|
|
<dt><span
|
|
class="ID"><b><NotBoundAuthentication></b></span>
|
|
[Optional]</dt>
|
|
<dd>Plaintext data used to authenticate the registration request that
|
|
is not bound to the key binding.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_290" id="XKMS_2_0_LC2_Paragraph_290"
|
|
class="markParagraph">[290]</a>The following schema defines the <span
|
|
class="ID"><Authentication></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- Authentication -->
|
|
<element name="Authentication" type="xkms:AuthenticationType"/>
|
|
<complexType name="AuthenticationType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBindingAuthentication" minOccurs="0"/>
|
|
<element ref="xkms:NotBoundAuthentication" minOccurs="0"/>
|
|
</sequence>
|
|
</complexType>
|
|
<!-- /Authentication --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_4"
|
|
id="XKMS_2_0_LC2_Section_7_1_4">7.1.4</a> <a
|
|
name="ElementKeyBindingAuthentication"
|
|
id="ElementKeyBindingAuthentication">Element <span
|
|
class="ID"><KeyBindingAuthentication></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_291" id="XKMS_2_0_LC2_Paragraph_291"
|
|
class="markParagraph">[291]</a>The <span
|
|
class="ID"><KeyBindingAuthentication></span> element: contains a XML
|
|
Signature <a href="#XML-SIG">[XML-SIG]</a> element that is used to
|
|
authenticate the request using a previously established key.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><ds:Signature></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>An XML Signature <a href="#XML-SIG">[XML-SIG]</a> element that
|
|
contains a signature over the <span
|
|
class="ID"><KeyBinding</span>> or <<span
|
|
class="ID">PrototypeKeyBinding></span> element.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_292" id="XKMS_2_0_LC2_Paragraph_292"
|
|
class="markParagraph">[292]</a>The XML signature <a
|
|
href="#XML-SIG">[XML-SIG]</a> is generated as a detached signature using the
|
|
Id attribute specified in <span class="ID">KeyBindingAbstractType</span> to
|
|
specify the signature scope.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_293" id="XKMS_2_0_LC2_Paragraph_293"
|
|
class="markParagraph">[293]</a>The following schema defines the <span
|
|
class="ID"><KeyBindingAuthentication></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- KeyBindingAuthentication -->
|
|
<element name="KeyBindingAuthentication"
|
|
type="xkms:KeyBindingAuthenticationType"/>
|
|
<complexType name="KeyBindingAuthenticationType">
|
|
<sequence>
|
|
<element ref="ds:Signature"/>
|
|
</sequence>
|
|
</complexType>
|
|
<!-- /KeyBindingAuthentication --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_5"
|
|
id="XKMS_2_0_LC2_Section_7_1_5">7.1.5</a> <a
|
|
name="ElementNotBoundAuthentication"
|
|
id="ElementNotBoundAuthentication">Element <span
|
|
class="ID"><NotBoundAuthentication></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_294" id="XKMS_2_0_LC2_Paragraph_294"
|
|
class="markParagraph">[294]</a>The <span
|
|
class="ID"><NotBoundAuthentication></span> contains a plaintext limited
|
|
use shared secret that is used to authenticate the request.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b>Protocol</b></span> <b>
|
|
[Required]</b></dt>
|
|
<dd>A URI specifying the authentication protocol used</dd>
|
|
<dt><b>Value [Required]</b></dt>
|
|
<dd>The plaintext limited use shared secret data encoded in base64
|
|
format.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_295" id="XKMS_2_0_LC2_Paragraph_295"
|
|
class="markParagraph">[295]</a>The specification of protocol URIs is outside
|
|
the scope of this document.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_296" id="XKMS_2_0_LC2_Paragraph_296"
|
|
class="markParagraph">[296]</a>This element is provided to support
|
|
applications in which the authentication scheme requires the server to have
|
|
plaintext access to the authentication data. The authentication data is not
|
|
securely bound to the request and thus the element MUST NOT be employed
|
|
except in circumstances where the message or transport protocol provides
|
|
adequate protection of both confidentiality and integrity.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_297" id="XKMS_2_0_LC2_Paragraph_297"
|
|
class="markParagraph">[297]</a>The following schema defines the <span
|
|
class="ID"><NotBoundAuthentication></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- NotBoundAuthentication -->
|
|
<element name="NotBoundAuthentication"
|
|
type="xkms:NotBoundAuthenticationType"/>
|
|
<complexType name="NotBoundAuthenticationType">
|
|
<attribute name="Protocol" type="anyURI" use="required"/>
|
|
<attribute name="Value" type="base64Binary" use="required"/>
|
|
</complexType>
|
|
<!-- /NotBoundAuthentication --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_6"
|
|
id="XKMS_2_0_LC2_Section_7_1_6">7.1.6</a> <a name="ElementProofOfPossession"
|
|
id="ElementProofOfPossession">Element <span
|
|
class="ID"><ProofOfPossession></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_298" id="XKMS_2_0_LC2_Paragraph_298"
|
|
class="markParagraph">[298]</a>The <span
|
|
class="ID"><ProofOfPossession></span> element contains a XML Signature
|
|
<a href="#XML-SIG">[XML-SIG]</a> element. The signature scope is the <span
|
|
class="ID"><PrototypeKeyBinding></span> using the public key that is to
|
|
be registered. The private key component of the public key contained within
|
|
the <span class="ID"><PrototypeKeyBinding></span> is used to generate
|
|
the signature.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><ds:Signature></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>An XML Signature <a href="#XML-SIG">[XML-SIG]</a> element that
|
|
contains a detached signature over the <span
|
|
class="ID"><PrototypeKeyBinding></span> element. The signing
|
|
key is the key identified by the <span class="ID">ds:KeyInfo</span>
|
|
element within the <span
|
|
class="ID"><PrototypeKeyBinding></span> element.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_299" id="XKMS_2_0_LC2_Paragraph_299"
|
|
class="markParagraph">[299]</a>The XML signature <a
|
|
href="#XML-SIG">[XML-SIG]</a> is generated as a detached signature using the
|
|
Id attribute specified in <span class="ID">KeyBindingAbstractType</span> to
|
|
specify the signature scope.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_300" id="XKMS_2_0_LC2_Paragraph_300"
|
|
class="markParagraph">[300]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">ProofOfPossession</span><span
|
|
class="ID">></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ProofOfPossession -->
|
|
<element name="ProofOfPossession" type="xkms:ProofOfPossessionType"/>
|
|
<complexType name="ProofOfPossessionType">
|
|
<sequence>
|
|
<element ref="ds:Signature"/>
|
|
</sequence>
|
|
</complexType>
|
|
<!-- /ProofOfPossession --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_7"
|
|
id="XKMS_2_0_LC2_Section_7_1_7">7.1.7</a> <a name="ElementPrivateKey"
|
|
id="ElementPrivateKey">Element <span
|
|
class="ID"><PrivateKey></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_301" id="XKMS_2_0_LC2_Paragraph_301"
|
|
class="markParagraph">[301]</a> The <span class="ID"><</span><span
|
|
class="ID">PrivateKey></span> element contains the encrypted private key
|
|
parameters returned by the service in a response to a registration request
|
|
with server generated keys or a response to a successful recovery request.</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><xenc:EncryptedData></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>The encrypted private key data</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_302" id="XKMS_2_0_LC2_Paragraph_302"
|
|
class="markParagraph">[302]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">PrivateKey></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- PrivateKey -->
|
|
<element name="PrivateKey" type="xkms:PrivateKeyType"/>
|
|
<complexType name="PrivateKeyType">
|
|
<sequence>
|
|
<element ref="xenc:EncryptedData"/>
|
|
</sequence>
|
|
</complexType>
|
|
<!-- /PrivateKey --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_1_8"
|
|
id="XKMS_2_0_LC2_Section_7_1_8">7.1.8</a> <a name="ElementRevocationCode"
|
|
id="ElementRevocationCode">Element <span
|
|
class="ID"><RevocationCode></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_303" id="XKMS_2_0_LC2_Paragraph_303"
|
|
class="markParagraph">[303]</a> The <span
|
|
class="ID"><RevocationCode></span> element contains a MAC output value
|
|
encoded as a base64 string.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_304" id="XKMS_2_0_LC2_Paragraph_304"
|
|
class="markParagraph">[304]</a>The default MAC algorithm used is HMAC-SHA1.
|
|
Other MAC algorithms MAY be used provided that the client is advised that the
|
|
service accepts such algorithms by means of an out of band mechanism such as
|
|
a Web Service description or policy mechanism.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_305" id="XKMS_2_0_LC2_Paragraph_305"
|
|
class="markParagraph">[305]</a>On initial registration the <span
|
|
class="ID"><RevocationCodeIdentifier></span> value is obtained by first
|
|
performing the MAC calculation on the pass phrase value, then performing a
|
|
second MAC calculation on the result.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_306" id="XKMS_2_0_LC2_Paragraph_306"
|
|
class="markParagraph">[306]</a>To prove knowledge of the pass phrase in a
|
|
subsequent revocation request the <span
|
|
class="ID"><RevocationCode></span> value is obtained by performing the
|
|
MAC calculation on the pass phrase value.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_307" id="XKMS_2_0_LC2_Paragraph_307"
|
|
class="markParagraph">[307]</a> Details of the MAC output value calculation
|
|
are provided in the section <a href="#sharedsecret">Cryptographic Algorithm
|
|
Specific Parameters</a> below.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_308" id="XKMS_2_0_LC2_Paragraph_308"
|
|
class="markParagraph">[308]</a>The following schema defines the <span
|
|
class="ID"><RevocationCode></span> element and the <span
|
|
class="ID">RevocationCodeType</span>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RevocationCode -->
|
|
<element name="RevocationCode" type="xkms:RevocationCodeType"/>
|
|
<simpleType name="RevocationCodeType">
|
|
<restriction base="base64Binary"/>
|
|
</simpleType>
|
|
<!-- /RevocationCode --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_7_2" id="XKMS_2_0_LC2_Section_7_2">7.2</a>
|
|
<a name="RegisterOP" id="RegisterOP">Register</a></h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_2_1"
|
|
id="XKMS_2_0_LC2_Section_7_2_1">7.2.1</a>Register Request <a
|
|
name="ElementRegisterRequest" id="ElementRegisterRequest">Element <span
|
|
class="ID"><RegisterRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_309" id="XKMS_2_0_LC2_Paragraph_309"
|
|
class="markParagraph">[309]</a>The register request message contains a <span
|
|
class="ID"><</span><span class="ID">RegisterRequest</span><span
|
|
class="ID">></span> element that contains the following elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><</b>PrototypeKeyBinding<b>></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>Specifies elements that the client requests be registered.</dd>
|
|
<dt><span class="ID"><b><Authentication></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>Information that authenticates the request.</dd>
|
|
<dt><span class="ID"><b><ProofOfPossesion></b></span>
|
|
<b> [Optional]</b></dt>
|
|
<dd>Proof of possession of the private key component of the key
|
|
binding.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_310" id="XKMS_2_0_LC2_Paragraph_310"
|
|
class="markParagraph">[310]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">RegisterRequest</span><span
|
|
class="ID">></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RegisterRequest -->
|
|
<element name="RegisterRequest" type="xkms:RegisterRequestType"/>
|
|
<complexType name="RegisterRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:PrototypeKeyBinding"/>
|
|
<element ref="xkms:Authentication"/>
|
|
<element ref="xkms:ProofOfPossession" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /RegisterRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_2_2"
|
|
id="XKMS_2_0_LC2_Section_7_2_2">7.2.2</a>Register Response <a
|
|
name="ElementRegisterResult" id="ElementRegisterResult">Element <span
|
|
class="ID"><RegisterResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_311" id="XKMS_2_0_LC2_Paragraph_311"
|
|
class="markParagraph">[311]</a>The register response message contains a <span
|
|
class="ID"><</span><span class="ID">RegisterResult</span><span
|
|
class="ID">></span> element that contains the following elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><KeyBinding></b></span>
|
|
<b> [Any number]</b></dt>
|
|
<dd>If present specifies the key binding that was registered by the
|
|
service</dd>
|
|
<dt><span class="ID"><b><PrivateKey></b></span>
|
|
<b> [Optional]</b></dt>
|
|
<dd>The values of the private key parameters of a private key generated
|
|
by the registration service</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_312" id="XKMS_2_0_LC2_Paragraph_312"
|
|
class="markParagraph">[312]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">RegisterResult</span><span
|
|
class="ID">></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RegisterResult -->
|
|
<element name="RegisterResult" type="xkms:RegisterResultType"/>
|
|
<complexType name="RegisterResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:PrivateKey" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /RegisterResult --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_7_3" id="XKMS_2_0_LC2_Section_7_3">7.3</a>
|
|
<a name="ReissueOP" id="ReissueOP">Reissue</a></h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_3_1"
|
|
id="XKMS_2_0_LC2_Section_7_3_1">7.3.1</a>Reissue Request <a
|
|
name="ElementReissueRequest" id="ElementReissueRequest">Element <span
|
|
class="ID"><ReissueRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_313" id="XKMS_2_0_LC2_Paragraph_313"
|
|
class="markParagraph">[313]</a>The reissue request message contains a <span
|
|
class="ID"><</span><span class="ID">ReissueRequest</span><span
|
|
class="ID">></span> element that contains the following elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><ReissueKeyBinding<b>></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>Identifies the key binding to be reissued</dd>
|
|
<dt><span class="ID"><b><Authentication></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>Information that authenticates the request.</dd>
|
|
<dt><span class="ID"><b><ProofOfPossesion></b></span>
|
|
<b> [Optional]</b></dt>
|
|
<dd>Proof of possession of the private key component of the key
|
|
binding.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_314" id="XKMS_2_0_LC2_Paragraph_314"
|
|
class="markParagraph">[314]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">ReissueRequest</span><span
|
|
class="ID">></span> and <span class="ID"><ReissueKeyBinding></span>
|
|
elements:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ReissueRequest -->
|
|
<element name="ReissueRequest" type="xkms:ReissueRequestType"/>
|
|
<complexType name="ReissueRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:ReissueKeyBinding"/>
|
|
<element ref="xkms:Authentication"/>
|
|
<element ref="xkms:ProofOfPossession" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<element name="ReissueKeyBinding" type="xkms:KeyBindingType"/>
|
|
<!-- /ReissueRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_3_2"
|
|
id="XKMS_2_0_LC2_Section_7_3_2">7.3.2</a>Reissue Response <a
|
|
name="ElementReissueResult" id="ElementReissueResult">Element <span
|
|
class="ID"><ReissueResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_315" id="XKMS_2_0_LC2_Paragraph_315"
|
|
class="markParagraph">[315]</a>The reissue response message contains a <span
|
|
class="ID"><</span><span class="ID">ReissueResult</span><span
|
|
class="ID">></span> element that contains the following element:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><KeyBinding></b></span> [Any
|
|
Number]</dt>
|
|
<dd>If present specifies the key binding(s) that were reissued by the
|
|
service</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_316" id="XKMS_2_0_LC2_Paragraph_316"
|
|
class="markParagraph">[316]</a> The following schema defines the <span
|
|
class="ID"><</span><span class="ID">ReissueResult</span><span
|
|
class="ID">></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- ReissueResult -->
|
|
<element name="ReissueResult" type="xkms:ReissueResultType"/>
|
|
<complexType name="ReissueResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /ReissueResult --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_7_4" id="XKMS_2_0_LC2_Section_7_4">7.4</a>
|
|
<a name="RevokeOP" id="RevokeOP">Revoke</a></h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_4_1"
|
|
id="XKMS_2_0_LC2_Section_7_4_1">7.4.1</a>Revoke Request <a
|
|
name="ElementRevokeRequest" id="ElementRevokeRequest">Element <span
|
|
class="ID"><RevokeRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_317" id="XKMS_2_0_LC2_Paragraph_317"
|
|
class="markParagraph">[317]</a>The revoke request message contains a <span
|
|
class="ID"><</span><span class="ID">RevokeRequest</span><span
|
|
class="ID">></span> element that contains the following elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><RevokeKeyBinding></span>
|
|
[Required]</dt>
|
|
<dd>Identifies the key binding to be revoked.</dd>
|
|
<dt><span class="ID"><b><Authentication></b></span>
|
|
<b> [Choice]</b></dt>
|
|
<dd>Information that authenticates the request.</dd>
|
|
<dt><<span class="ID">RevocationCode></span>[Choice]</dt>
|
|
<dd>The revocation code value that generates the revocation code
|
|
identifier value specified during registration</dd>
|
|
<dd> </dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_318" id="XKMS_2_0_LC2_Paragraph_318"
|
|
class="markParagraph">[318]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">RevokeRequest</span><span
|
|
class="ID">></span> and <span class="ID"><RevokeKeyBinding></span>
|
|
elements:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RevokeRequest -->
|
|
<element name="RevokeRequest" type="xkms:RevokeRequestType"/>
|
|
<complexType name="RevokeRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:RevokeKeyBinding"/>
|
|
<choice>
|
|
<element ref="xkms:Authentication"/>
|
|
<element ref="xkms:RevocationCode"/>
|
|
</choice>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<element name="RevokeKeyBinding" type="xkms:KeyBindingType"/>
|
|
<!-- /RevokeRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_4_2"
|
|
id="XKMS_2_0_LC2_Section_7_4_2">7.4.2</a>Revoke Response <a
|
|
name="ElementRevokeResult" id="ElementRevokeResult">Element <span
|
|
class="ID"><RevokeResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_319" id="XKMS_2_0_LC2_Paragraph_319"
|
|
class="markParagraph">[319]</a>The request message contains a <span
|
|
class="ID"><</span><span class="ID">RevokeResult</span><span
|
|
class="ID">></span> element that contains the following element:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><KeyBinding></b></span> <b>
|
|
[Any Number]</b></dt>
|
|
<dd>If present specifies the key binding that was revoked by the
|
|
service</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_320" id="XKMS_2_0_LC2_Paragraph_320"
|
|
class="markParagraph">[320]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">RevokeResult</span><span
|
|
class="ID">></span>:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RevokeResult -->
|
|
<element name="RevokeResult" type="xkms:RevokeResultType"/>
|
|
<complexType name="RevokeResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /RevokeResult --></pre>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_7_5" id="XKMS_2_0_LC2_Section_7_5">7.5</a>
|
|
<a name="RecoverOP" id="RecoverOP">Recover</a></h2>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_5_1"
|
|
id="XKMS_2_0_LC2_Section_7_5_1">7.5.1</a>Recover Request <a
|
|
name="ElementRecoverRequest" id="ElementRecoverRequest">Element <span
|
|
class="ID"><RecoverRequest></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_321" id="XKMS_2_0_LC2_Paragraph_321"
|
|
class="markParagraph">[321]</a>The recover request message contains a <span
|
|
class="ID"><</span><span class="ID">RecoverRequest</span><span
|
|
class="ID">></span> element that contains the following elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><RecoverKeyBinding></span>
|
|
[Required]</dt>
|
|
<dd>Identifies the key binding to be recovered.</dd>
|
|
<dt><span class="ID"><b><Authentication></b></span>
|
|
<b> [Required]</b></dt>
|
|
<dd>Information that authenticates the request.</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_322" id="XKMS_2_0_LC2_Paragraph_322"
|
|
class="markParagraph">[322]</a>The following schema defines the <span
|
|
class="ID"><</span><span class="ID">RecoverRequest</span><span
|
|
class="ID">></span> and <span class="ID"><RecoverKeyBinding></span>
|
|
elements:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RecoverRequest -->
|
|
<element name="RecoverRequest" type="xkms:RecoverRequestType"/>
|
|
<complexType name="RecoverRequestType">
|
|
<complexContent>
|
|
<extension base="xkms:RequestAbstractType">
|
|
<sequence>
|
|
<element ref="xkms:RecoverKeyBinding"/>
|
|
<element ref="xkms:Authentication"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<element name="RecoverKeyBinding" type="xkms:KeyBindingType"/>
|
|
<!-- /RecoverRequest --></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_7_5_2"
|
|
id="XKMS_2_0_LC2_Section_7_5_2">7.5.2</a>Recover Response <a
|
|
name="ElementRecoverResult" id="ElementRecoverResult">Element <span
|
|
class="ID"><RecoverResult></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_323" id="XKMS_2_0_LC2_Paragraph_323"
|
|
class="markParagraph">[323]</a>The request message contains a <span
|
|
class="ID"><RecoverResult></span> element that contains the following
|
|
elements:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><KeyBinding></span>
|
|
[Any Number]</dt>
|
|
<dd>May be present to advertise a change to the status of the key
|
|
binding made as a result of the key recovery.</dd>
|
|
<dt><span class="ID"><b><PrivateKey></b></span> <b>
|
|
[Optional]</b></dt>
|
|
<dd>The values of the private key parameters of the recovered private
|
|
key</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_324" id="XKMS_2_0_LC2_Paragraph_324"
|
|
class="markParagraph">[324]</a>The following schema defines the <span
|
|
class="ID"><RecoverResult></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RecoverResult -->
|
|
<element name="RecoverResult" type="xkms:RecoverResultType"/>
|
|
<complexType name="RecoverResultType">
|
|
<complexContent>
|
|
<extension base="xkms:ResultType">
|
|
<sequence>
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/>
|
|
<element ref="xkms:PrivateKey" minOccurs="0"/>
|
|
</sequence>
|
|
</extension>
|
|
</complexContent>
|
|
</complexType>
|
|
<!-- /RecoverResult --></pre>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_8" id="XKMS_2_0_LC2_Section_8">8</a> <a
|
|
name="CryptographicAlgorithmSpecificParameters"
|
|
id="CryptographicAlgorithmSpecificParameters">Cryptographic Algorithm
|
|
Specific Parameters</a></h1>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_8_1" id="XKMS_2_0_LC2_Section_8_1">8.1</a>
|
|
<a name="sharedsecret" id="sharedsecret">Use of Limited-Use Shared Secret
|
|
Data</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_325" id="XKMS_2_0_LC2_Paragraph_325"
|
|
class="markParagraph">[325]</a>It is frequently necessary or desirable to use
|
|
a limited use shared secret for authentication (i.e. a one time use PIN or
|
|
pass phrase) to authenticate registration request messages. In particular a
|
|
private key cannot be used for authentication until the corresponding public
|
|
key has been registered.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_326" id="XKMS_2_0_LC2_Paragraph_326"
|
|
class="markParagraph">[326]</a>In addition it is desirable that private key
|
|
parameters generated or recovered by the registration service be returned
|
|
encrypted. It is convenient to use symmetric data for this purpose.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_327" id="XKMS_2_0_LC2_Paragraph_327"
|
|
class="markParagraph">[327]</a>Since human users are the most demanding in
|
|
terms of interface requirements the handling of symmetric key data is
|
|
designed for the needs of clients supporting human users directly. Symmetric
|
|
keying data is typically issued to a human user in the form of a text string
|
|
which may in some circumstances be read over a telephone line. The
|
|
authentication data itself MAY be randomly generated and represent an
|
|
underlying numeric value, or MAY be a password or phrase. In either case it
|
|
is most convenient to present the value to the human user as a string of
|
|
characters in a character set the particular user understands.</p>
|
|
<ul>
|
|
<li>All shared string values are encoded as XML</li>
|
|
<li>All space and control characters are removed.</li>
|
|
<li>All upper case characters in the Latin-1 alphabet (A-Z) are converted
|
|
to lower case.</li>
|
|
<li>No other characters, including accented characters are converted</li>
|
|
</ul>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_328" id="XKMS_2_0_LC2_Paragraph_328"
|
|
class="markParagraph">[328]</a>Applications MUST ensure that the limited use
|
|
shared secret data contains sufficient entropy to prevent dictionary attacks.
|
|
For more details see the more detailed comment in the <a
|
|
href="#limitedusesecurity">security considerations section</a> of this
|
|
document.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_329" id="XKMS_2_0_LC2_Paragraph_329"
|
|
class="markParagraph">[329]</a>Keying material is derived from the shared
|
|
string using a MAC function.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_330" id="XKMS_2_0_LC2_Paragraph_330"
|
|
class="markParagraph">[330]</a>The default MAC algorithm used is HMAC-SHA1.
|
|
Other MAC algorithms MAY be used provided that the client is advised that the
|
|
service accepts such algorithms by means of an out of band mechanism such as
|
|
a Web Service description or policy mechanism.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_331" id="XKMS_2_0_LC2_Paragraph_331"
|
|
class="markParagraph">[331]</a>Different MAC keying values are used according
|
|
to the use of the symmetric key derived as follows:</p>
|
|
|
|
<div class="center">
|
|
|
|
<table cellspacing="0" cellpadding="0" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<th valign="top" width="18%">Value</th>
|
|
<th valign="top" width="81%">Application</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" width="18%" align="center">0x1</td>
|
|
<td valign="top" width="81%">Authentication</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" width="18%" align="center">0x2</td>
|
|
<td valign="top" width="81%">Encoding of <span
|
|
class="ID">RevocationCodeIdentifier</span> - Pass 1</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" width="18%" align="center">0x3</td>
|
|
<td valign="top" width="81%">Encoding of <span
|
|
class="ID">RevocationCodeIdentifier</span> - Pass 2</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" width="18%" align="center">0x4</td>
|
|
<td valign="top" width="81%">Encryption of <span
|
|
class="ID">PrivateKey</span> data</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_332" id="XKMS_2_0_LC2_Paragraph_332"
|
|
class="markParagraph">[332]</a>If the output of the MAC function provides
|
|
more keying material than is required for a cryptographic operation (i.e.
|
|
encryption, MAC), the lowest significant bits are used.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_333" id="XKMS_2_0_LC2_Paragraph_333"
|
|
class="markParagraph">[333]</a>If the output of the MAC function provides
|
|
less keying material than is required additional keying material is obtained
|
|
as follows:</p>
|
|
|
|
<blockquote>
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_334" id="XKMS_2_0_LC2_Paragraph_334"
|
|
class="markParagraph">[334]</a>block<sub>0</sub> = MAC (converted, key)</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_335" id="XKMS_2_0_LC2_Paragraph_335"
|
|
class="markParagraph">[335]</a>block<sub>n+1</sub> = MAC (converted, key
|
|
XOR block<sub>n</sub>)</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_336" id="XKMS_2_0_LC2_Paragraph_336"
|
|
class="markParagraph">[336]</a>output = block<sub>0</sub> +
|
|
block<sub>1</sub> ... block<sub>n</sub></p>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_337" id="XKMS_2_0_LC2_Paragraph_337"
|
|
class="markParagraph">[337]</a>i.e. the first MAC output value is used to
|
|
supply the least significant bits of keying material. A second MAC output
|
|
value is then obtained by applying the MAC function to the converted string
|
|
again, this time the MAC keying value is obtained by XOR-ing the first output
|
|
with the previous keying value. This process may be repeated as many times as
|
|
necessary to produce a sufficient amount of keying material.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_8_2" id="XKMS_2_0_LC2_Section_8_2">8.2</a>
|
|
<a name="privatekeyparameters" id="privatekeyparameters">Private Key
|
|
Parameters</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_338" id="XKMS_2_0_LC2_Paragraph_338"
|
|
class="markParagraph">[338]</a>The <span class="ID"><PrivateKey></span>
|
|
element may contain the private key parameters for any public key encryption
|
|
algorithm. The parameters for the RSA algorithm are specified below.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_339" id="XKMS_2_0_LC2_Paragraph_339"
|
|
class="markParagraph">[339]</a>This specification does not specify private
|
|
key parameters for the DSA signature algorithm since the algorithm only
|
|
supports signature modes and so the application of server generated keys and
|
|
key recovery is of limited value.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_8_2_1"
|
|
id="XKMS_2_0_LC2_Section_8_2_1">8.2.1</a> <a name="ElementRSAKeyPair"
|
|
id="ElementRSAKeyPair">Element <span
|
|
class="ID"><RSAKeyPair></span></a></h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_340" id="XKMS_2_0_LC2_Paragraph_340"
|
|
class="markParagraph">[340]</a>The <span class="ID"><RSAKeyPair></span>
|
|
element specifies the public and private parameters of an RSA key pair. The
|
|
contents of the RSAKeyPair element are specified in [PKCS1]. The <span
|
|
class="ID">RSAKeyPair></span> element contains the following
|
|
parameters:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt><span class="ID"><b><Modulus></b></span> (Required)</dt>
|
|
<dd>The modulus</dd>
|
|
<dt><span class="ID"><b><Exponent></b></span> (Required)</dt>
|
|
<dd>The public exponent</dd>
|
|
<dt><span class="ID"><b><span class="ID"><P></span></b></span>
|
|
(Required)</dt>
|
|
<dd>The first factor, a positive integer</dd>
|
|
<dt><span class="ID"><b><Q></b></span> (Required)</dt>
|
|
<dd>The second factor, a positive integer</dd>
|
|
<dt><span class="ID"><b><DP></b></span> (Required)</dt>
|
|
<dd>The first factor's CRT exponent, a positive integer</dd>
|
|
<dt><span class="ID"><b><DQ></b></span> (Required)</dt>
|
|
<dd>The second factor's CRT exponent, a positive integer</dd>
|
|
<dt><span class="ID"><b><InverseQ></b></span> (Required)</dt>
|
|
<dd>The (first) CRT coefficient, a positive integer</dd>
|
|
<dt><span class="ID"><b><D></b></span> (Required)</dt>
|
|
<dd>The private exponent</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_341" id="XKMS_2_0_LC2_Paragraph_341"
|
|
class="markParagraph">[341]</a> The following schema defines the <span
|
|
class="ID"><RSAKeyPair></span> element:</p>
|
|
<!-- Include file -->
|
|
<pre class="Code"> <!-- RSAKeyPair -->
|
|
<element name="RSAKeyValue" type="xkms:RSAKeyValueType"/>
|
|
<complexType name="RSAKeyValueType">
|
|
<sequence>
|
|
<element ref="xkms:Modulus"/>
|
|
<element ref="xkms:Exponent"/>
|
|
<element ref="xkms:P"/>
|
|
<element ref="xkms:Q"/>
|
|
<element ref="xkms:DP"/>
|
|
<element ref="xkms:DQ"/>
|
|
<element ref="xkms:InverseQ"/>
|
|
<element ref="xkms:D"/>
|
|
</sequence>
|
|
</complexType>
|
|
<element name="Modulus" type="ds:CryptoBinary"/>
|
|
<element name="Exponent" type="ds:CryptoBinary"/>
|
|
<element name="P" type="ds:CryptoBinary"/>
|
|
<element name="Q" type="ds:CryptoBinary"/>
|
|
<element name="DP" type="ds:CryptoBinary"/>
|
|
<element name="DQ" type="ds:CryptoBinary"/>
|
|
<element name="InverseQ" type="ds:CryptoBinary"/>
|
|
<element name="D" type="ds:CryptoBinary"/>
|
|
<!-- /RSAKeyPair --></pre>
|
|
|
|
<h1 dir="ltr"><a name="XKMS_2_0_LC2_Section_9"
|
|
id="XKMS_2_0_LC2_Section_9">9</a> <a name="Conformance"
|
|
id="Conformance">Conformance</a></h1>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_342"
|
|
id="XKMS_2_0_LC2_Paragraph_342" class="markParagraph">[342]</a>The section
|
|
describes features and operations that XKMS applications whose support is
|
|
either required or recommended to ensure interoperability of XKMS
|
|
services.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_343"
|
|
id="XKMS_2_0_LC2_Paragraph_343" class="markParagraph">[343]</a>As such the
|
|
conformance requirements fall on message recipients rather than message
|
|
senders, although a sender SHOULD NOT send a message unless it is known that
|
|
it will be accepted by the recipient.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_344"
|
|
id="XKMS_2_0_LC2_Paragraph_344" class="markParagraph">[344]</a>The following
|
|
table specifies the conformance requirements of XKMS as REQUIRED,.
|
|
RECOMMENDED or OPTIONAL as follows:</p>
|
|
<ul dir="ltr">
|
|
<li dir="ltr"><p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_345"
|
|
id="XKMS_2_0_LC2_Paragraph_345" class="markParagraph">[345]</a>If support
|
|
for a feature is specified as REQUIRED a conforming XKMS implementation
|
|
MUST support the use of that feature in a message sent by another XKMS
|
|
implementation.</p>
|
|
</li>
|
|
<li dir="ltr"><p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_346"
|
|
id="XKMS_2_0_LC2_Paragraph_346" class="markParagraph">[346]</a>If support
|
|
for a feature is specified as RECOMMENDED a conforming XKMS
|
|
implementation SHOULD support the use of that feature if used by another
|
|
XKMS implementation.</p>
|
|
</li>
|
|
<li dir="ltr"><p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_347"
|
|
id="XKMS_2_0_LC2_Paragraph_347" class="markParagraph">[347]</a>If support
|
|
for a feature is specified as OPTIONAL, XKMS implementations SHOULD NOT
|
|
send messages requiring support for that feature.</p>
|
|
</li>
|
|
</ul>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_348"
|
|
id="XKMS_2_0_LC2_Paragraph_348" class="markParagraph">[348]</a>Some features
|
|
as specified as REQUIRED* or RECOMMENDED*. This signifies that the condition
|
|
holds if another feature is supported. For example an XKMS Locate service is
|
|
not required to support XML Signature. If however XML Signature is supported
|
|
the use of Exclusive Canonicalization MUST be supported.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_349"
|
|
id="XKMS_2_0_LC2_Paragraph_349" class="markParagraph">[349]</a>One feature is
|
|
specified as RECOMMENDED +. This signifies that even though this feature can
|
|
only be used at the request of the client it is strongly recommended that the
|
|
client request use of this feature since a service is likely to require it
|
|
for the response to be successful.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_350"
|
|
id="XKMS_2_0_LC2_Paragraph_350" class="markParagraph">[350]</a>Where a
|
|
service supports a feature that is advertised as OPTIONAL it is recommended
|
|
that the service advertise this feature by means of a Web Service description
|
|
mechanism. For example an XKMS service that supports the use of a transport
|
|
encoding other than HTTP SHOULD advertise that fact.</p>
|
|
|
|
<p dir="ltr"><a name="XKMS_2_0_LC2_Paragraph_351"
|
|
id="XKMS_2_0_LC2_Paragraph_351" class="markParagraph">[351]</a>Implementers
|
|
should note that these requirements may change in future versions of the XKMS
|
|
specification. For example it is likely that future versions of the XKMS
|
|
specification will make the then current version of the SOAP specification a
|
|
requirement.</p>
|
|
|
|
<table border="1" cellpadding="3" cellspacing="0" width="100%"
|
|
id="AutoNumber3" dir="ltr">
|
|
<tbody>
|
|
<tr>
|
|
<th valign="top" dir="ltr">Feature</th>
|
|
<th valign="top" dir="ltr">Operations</th>
|
|
<th valign="top" dir="ltr">Requirement Level</th>
|
|
<th valign="top" dir="ltr">Comments</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" rowspan="4" dir="ltr">Operation Support</td>
|
|
<td valign="top" dir="ltr">Locate</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr">Services SHOULD support retrieval of their
|
|
own credential by means of the Locate operation with the XKMS
|
|
protocol URI.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">One Operation REQUIRED</td>
|
|
<td valign="top" dir="ltr">A conforming XKMS service MUST support at
|
|
least one XKMS operation, that is there MUST be at least one possible
|
|
input that results in the result <span class="ID">Success</span>.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Compound</td>
|
|
<td valign="top" dir="ltr">OPTIONAL</td>
|
|
<td valign="top" dir="ltr">See note for Status operation support.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Status</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED*</td>
|
|
<td valign="top" dir="ltr">Services SHOULD support status operations if
|
|
asynchronous processing and compound requests are also supported</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Operation Response</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">REQUIRED</td>
|
|
<td valign="top" dir="ltr">A conforming XKMS service MUST accept any
|
|
valid XKMS request sent to it and be capable of responding to the
|
|
request with a correctly formatted XKMS result. If a service does not
|
|
support an operation it MUST respond to all requests for a particular
|
|
operation with the result <span class="ID">Sender</span>.<span
|
|
class="ID">MessageNotSupported</span>.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" colspan="4" align="center" dir="ltr"><b>Response
|
|
Mechanisms</b></td>
|
|
</tr>
|
|
<tr>
|
|
<th valign="top" dir="ltr">Feature</th>
|
|
<th valign="top" dir="ltr">Operations</th>
|
|
<th valign="top" dir="ltr">Requirement Level</th>
|
|
<th valign="top" dir="ltr">Comments</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Synchronous Response</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">REQUIRED</td>
|
|
<td valign="top" dir="ltr">A conforming XKMS service MUST be capable of
|
|
returning an immediate response to any XKMS request.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" rowspan="4" dir="ltr">Asynchronous Response
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_352"
|
|
class="markParagraph">[352]</a></p>
|
|
</td>
|
|
<td valign="top" dir="ltr">Register, Reissue, Recover</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED+</td>
|
|
<td valign="top" dir="ltr">Processing of certain XKRSS operations may
|
|
require manual intervention by an operator in certain circumstances.
|
|
It is therefore recommended that clients support the use of
|
|
asynchronous processing with these operations unless it is known that
|
|
all requests will be serviced immediately.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Compound</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr">Services that support Compound Operations
|
|
SHOULD support compound requests</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Locate, Validate,<br />
|
|
Revoke</td>
|
|
<td valign="top" dir="ltr">OPTIONAL</td>
|
|
<td valign="top" dir="ltr">Services MAY support Asynchronous responses
|
|
be supported on these operations</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Pending,<br />
|
|
Status</td>
|
|
<td valign="top" dir="ltr">PROHIBITED</td>
|
|
<td valign="top" dir="ltr">A client MAY offer asynchronous processing
|
|
of Pending and Status operations however a service MUST NOT return a
|
|
pending response.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Two-Phase Request</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED+</td>
|
|
<td valign="top" dir="ltr">Clients SHOULD support use of the two phase
|
|
request protocol. The additional complexity of implementing the two
|
|
phase protocol is not high and allows a service to provide a response
|
|
even in cases where it is under a denial of service attack.</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" colspan="4" align="center" dir="ltr"><b>Protocol
|
|
Encapsulation</b></td>
|
|
</tr>
|
|
<tr>
|
|
<th valign="top" dir="ltr">Feature</th>
|
|
<th valign="top" dir="ltr">Operations</th>
|
|
<th valign="top" dir="ltr">Requirement Level</th>
|
|
<th valign="top" dir="ltr">Comments</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">HTTP Transport</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">REQUIRED</td>
|
|
<td valign="top" dir="ltr">Services MUST support the use of HTTP
|
|
transport</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">SOAP 1.1 Transport</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">REQUIRED</td>
|
|
<td valign="top" dir="ltr">Services MUST support the use of SOAP 1.1
|
|
encapsulation</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">SOAP 1.2 Transport</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr">Services SHOULD support the use of SOAP 1.2
|
|
encapsulation</td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" colspan="4" align="center" dir="ltr"><b>Security
|
|
Enhancements</b></td>
|
|
</tr>
|
|
<tr>
|
|
<th valign="top" dir="ltr">Feature</th>
|
|
<th valign="top" dir="ltr">Operations</th>
|
|
<th valign="top" dir="ltr">Requirement Level</th>
|
|
<th valign="top" dir="ltr">Comments</th>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" rowspan="2" dir="ltr">No Security</td>
|
|
<td valign="top" dir="ltr">Locate</td>
|
|
<td valign="top" dir="ltr">REQUIRED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">[Others]</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Payload Authentication I</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Payload Authentication II</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">TLS Binding I</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">TLS Binding II</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">TLS Binding III</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">RECOMMENDED</td>
|
|
<td valign="top" dir="ltr"> </td>
|
|
</tr>
|
|
<tr>
|
|
<td valign="top" dir="ltr">Exclusive Canonicalization</td>
|
|
<td valign="top" dir="ltr">All</td>
|
|
<td valign="top" dir="ltr">REQUIRED*</td>
|
|
<td valign="top" dir="ltr">If XML Signature is used, Exclusive
|
|
Canonicalization MUST be supported.</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<h1><a name="XKMS_2_0_LC2_Section_10" id="XKMS_2_0_LC2_Section_10">10</a> <a
|
|
name="SecurityConsiderations" id="SecurityConsiderations">Security
|
|
Considerations</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_353" id="XKMS_2_0_LC2_Paragraph_353"
|
|
class="markParagraph">[353]</a>Implementations SHOULD consider the following
|
|
security issues.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_1"
|
|
id="XKMS_2_0_LC2_Section_10_1">10.1</a> <a name="ReplayAttacks"
|
|
id="ReplayAttacks">Replay Attacks</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_354" id="XKMS_2_0_LC2_Paragraph_354"
|
|
class="markParagraph">[354]</a>Implementations SHOULD ensure that replay of a
|
|
previous XKMS response is not possible.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_355" id="XKMS_2_0_LC2_Paragraph_355"
|
|
class="markParagraph">[355]</a>The precise mechanism by which replay attacks
|
|
are prevented is left to the implementation. For example generic mechanism
|
|
built into the object exchange protocol if specified MAY be used.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_356" id="XKMS_2_0_LC2_Paragraph_356"
|
|
class="markParagraph">[356]</a>A generally applicable means of preventing a
|
|
replay attack is to place a token in each message that demonstrates to the
|
|
recipient that the message is 'fresh', for example:</p>
|
|
<ul type="disc">
|
|
<li>A message origination time that the recipient verifies by checking that
|
|
it is sufficiently recent.</li>
|
|
<li>A nonce, that is a piece of random data that was previously issued by
|
|
the user.</li>
|
|
<li>A message serial number</li>
|
|
</ul>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_2"
|
|
id="XKMS_2_0_LC2_Section_10_2">10.2</a> <a name="DenialofService"
|
|
id="DenialofService">Denial of Service</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_357" id="XKMS_2_0_LC2_Paragraph_357"
|
|
class="markParagraph">[357]</a>XKMS Services SHOULD take measures to prevent
|
|
or mitigate denial of service attacks. In particular XKMS Services SHOULD NOT
|
|
perform an unlimited number of resource intensive operations unless the
|
|
request comes from an authenticated source. Potentially resource intensive
|
|
operations include:</p>
|
|
<ul>
|
|
<li>CPU intensive cryptographic operations, including signature
|
|
verification and key exchange.</li>
|
|
<li>Resolution of URLs.</li>
|
|
</ul>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_3"
|
|
id="XKMS_2_0_LC2_Section_10_3">10.3</a> <a name="RecoveryPolicy"
|
|
id="RecoveryPolicy">Recovery Policy</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_358" id="XKMS_2_0_LC2_Paragraph_358"
|
|
class="markParagraph">[358]</a>Key recovery policy is left as an
|
|
implementation decision.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_359" id="XKMS_2_0_LC2_Paragraph_359"
|
|
class="markParagraph">[359]</a>Depending on the implementation and
|
|
application, a key recovery operation might involve an unacceptable loss of
|
|
confidence in the security of a private key component. This may lead to the
|
|
possibility of repudiation of a signed document or of accountability in the
|
|
case of an encrypted document.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_360" id="XKMS_2_0_LC2_Paragraph_360"
|
|
class="markParagraph">[360]</a>Services SHOULD carefully assess the extent to
|
|
which a recovery operation compromises a private key and apply sufficient
|
|
controls such as the revocation of the underlying key binding as
|
|
appropriate.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_4"
|
|
id="XKMS_2_0_LC2_Section_10_4">10.4</a> <a name="limitedusesecurity"
|
|
id="limitedusesecurity">Security of Limited Use Shared Secret</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_361" id="XKMS_2_0_LC2_Paragraph_361"
|
|
class="markParagraph">[361]</a>If a limited use shared secret is used care
|
|
must be taken to ensure that the secret has sufficient entropy that the
|
|
probability of guessing by an attacker is tolerably low. Particular care must
|
|
be taken if a limited use shared secret is used to encrypt a service
|
|
generated private key since the transported private key might be subject to a
|
|
dictionary attack. Applications SHOULD enforce the following minimum entropy
|
|
values for the shared secret:</p>
|
|
|
|
<blockquote>
|
|
<dl>
|
|
<dt>Registration of Client Generated Key</dt>
|
|
<dd>The shared secret SHOULD contain a minimum of 32 bits of entropy if
|
|
the service implements measures to prevent guessing of the shared
|
|
secret and a minimum of 128 bits of entropy otherwise.</dd>
|
|
<dt>Registration of Service Generated Key</dt>
|
|
<dd>The shared secret SHOULD have a minimum of 128 bits of entropy</dd>
|
|
</dl>
|
|
</blockquote>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_5"
|
|
id="XKMS_2_0_LC2_Section_10_5">10.5</a> <a
|
|
name="ConfidentialityofOpaqueClientData"
|
|
id="ConfidentialityofOpaqueClientData">Confidentiality of Opaque Client
|
|
Data</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_362" id="XKMS_2_0_LC2_Paragraph_362"
|
|
class="markParagraph">[362]</a>Clients SHOULD NOT send confidential or
|
|
privacy sensitive data to an XKMS Service as Opaque Data unless it is
|
|
encrypted such that it is not disclosed to the service.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_363" id="XKMS_2_0_LC2_Paragraph_363"
|
|
class="markParagraph">[363]</a>Examples of confidential data include internal
|
|
program indices such as pointers which might permit a malicious party with
|
|
access to an XKMS service or its audit logs to perform an attack based on
|
|
knowledge of the internal state of the client.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_6"
|
|
id="XKMS_2_0_LC2_Section_10_6">10.6</a> <a
|
|
name="SecurityofNotBoundAuthenticationData"
|
|
id="SecurityofNotBoundAuthenticationData">Security of Not Bound
|
|
Authentication Data</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_364" id="XKMS_2_0_LC2_Paragraph_364"
|
|
class="markParagraph">[364]</a>If a service supports the use of
|
|
authentication using the <NotBoundAuthentication> element, controls
|
|
MUST be employed to ensure the confidentiality of the authentication data and
|
|
to ensure that the <NotBoundAuthentication> is bound to the request.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_365" id="XKMS_2_0_LC2_Paragraph_365"
|
|
class="markParagraph">[365]</a>This MAY be a message level or transport level
|
|
protocol that protects <i>both</i> encryption <i>and integrity</i> such as
|
|
TLS [RFC-2246]. Note that merely encrypting the shared secret <i>does not
|
|
provide adequate security</i> since the <span
|
|
class="ID"><PassPhraseAuth></span> element is not cryptographically
|
|
bound to the message.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_7"
|
|
id="XKMS_2_0_LC2_Section_10_7">10.7</a> <a name="SignatureOracle"
|
|
id="SignatureOracle">Signature Oracle</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_366" id="XKMS_2_0_LC2_Paragraph_366"
|
|
class="markParagraph">[366]</a>Web Services that provide signed responses
|
|
SHOULD ensure that the requestor cannot solicit a predicted response, thus
|
|
providing a signing oracle. Such a signing oracle might provide a direct
|
|
compromise for the key under a different protocol or allow a weakness in the
|
|
signature or digest algorithm employed to be exploited.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_367" id="XKMS_2_0_LC2_Paragraph_367"
|
|
class="markParagraph">[367]</a>Response messages should include at least as
|
|
much randomly chosen data as the output of the digest algorithm used to
|
|
create the signature. For example a message signed using RSA and SHA-1 should
|
|
contain at least 160 bits of random data.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_8"
|
|
id="XKMS_2_0_LC2_Section_10_8">10.8</a> <a name="Privacy"
|
|
id="Privacy">Privacy</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_368" id="XKMS_2_0_LC2_Paragraph_368"
|
|
class="markParagraph">[368]</a>An XKMS service MAY solicit data which is
|
|
subject to privacy concerns. In certain circumstances management of such data
|
|
MAY be subject to government regulation, corporate policies or contractual
|
|
obligations. Deployments SHOULD consider whether the information they collect
|
|
is subject to such concerns and if necessary deploy a privacy notification
|
|
mechanism such as P3P <a href="#P3P">[P3P]</a>.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_9"
|
|
id="XKMS_2_0_LC2_Section_10_9">10.9</a> <a name="SecurityofthePrivateKey"
|
|
id="SecurityofthePrivateKey">Security of the Private Key</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_369" id="XKMS_2_0_LC2_Paragraph_369"
|
|
class="markParagraph">[369]</a>Implementations MUST ensure that in cases
|
|
where a private key is generated by the service, the information used to
|
|
encrypt the private key data is adequately protected. In particular if an
|
|
authentication pass phrase exchanged out of band is used to encrypt the
|
|
private key the implementation MUST ensure that the out of band communication
|
|
mechanism adequately protects the confidentiality of the pass phrase.</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_370" id="XKMS_2_0_LC2_Paragraph_370"
|
|
class="markParagraph">[370]</a>It is recommended that implementations make
|
|
use of TLS or an in-band key exchange mechanism to protect the private key in
|
|
the case that the authentication pass phrase is disclosed.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_10_10"
|
|
id="XKMS_2_0_LC2_Section_10_10">10.10</a> <a
|
|
name="MessageLengthDisclosureVulnerabilities"
|
|
id="MessageLengthDisclosureVulnerabilities">Message Length Disclosure
|
|
Vulnerabilities</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_371" id="XKMS_2_0_LC2_Paragraph_371"
|
|
class="markParagraph">[371]</a>In certain circumstances the length of an
|
|
encrypted response MAY reveal information that is useful to an attacker. For
|
|
example a short message might indicate that a request was refused.
|
|
Deployments SHOULD consider whether such disclosures might result in
|
|
compromise of confidential information.</p>
|
|
|
|
<h1 class="appendix"><a name="XKMS_2_0_LC2_Section_Appendix_A"
|
|
id="XKMS_2_0_LC2_Section_Appendix_A">Appendix A</a> <a name="Schemas"
|
|
id="Schemas">Schemas</a></h1>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_A_1" id="XKMS_2_0_LC2_Section_A_1">A.1</a>
|
|
<a name="XKMSSchema" id="XKMSSchema">XKMS Schema</a></h2>
|
|
The collected schema is available at <a
|
|
href="Schemas/xkms.xsd">Schemas/xkms.xsd</a> .<!-- include class="Code" source="Schemas/xkms.xsd"></include -->
|
|
|
|
|
|
<h1 class="appendix"><a name="XKMS_2_0_LC2_Section_Appendix_B"
|
|
id="XKMS_2_0_LC2_Section_Appendix_B">Appendix B</a><a
|
|
name="ServiceLocationConfiguration" id="ServiceLocationConfiguration">Service
|
|
Location Configuration</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_372" id="XKMS_2_0_LC2_Paragraph_372"
|
|
class="markParagraph">[372]</a>In many instances it is desirable to advertise
|
|
the existence of an XKMS service in some form of discovery protocol. This
|
|
appendix describes specific means of advertising the existence of XKMS
|
|
services in the Internet Domain Name Service (DNS).</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_B_1"
|
|
id="XKMS_2_0_LC2_Section_B_1">B.1</a><a name="DomainNameService"
|
|
id="DomainNameService">Domain Name Service</a> (DNS)</h2>
|
|
|
|
<p class="appendix"><a name="XKMS_2_0_LC2_Paragraph_373"
|
|
id="XKMS_2_0_LC2_Paragraph_373" class="markParagraph">[373]</a>The provision
|
|
of an XKMS service that provides information on key information bound to DNS
|
|
addresses in a specified DNS zone MAY be advertised by means of the DNS SRV
|
|
record <a href="#RFC-2782">[RFC 2782]</a>. An SRV record contains the
|
|
following data fields:</p>
|
|
|
|
<p class="appendix"><a name="XKMS_2_0_LC2_Paragraph_374"
|
|
id="XKMS_2_0_LC2_Paragraph_374" class="markParagraph">[374]</a><span
|
|
class="ID">_<i>Service</i>._<i>Protocol</i>.<i>Name</i><i>TTL</i><i>Class</i><i>SRV</i><i>Priority</i><i>Weight</i><i>Port</i><i>Target</i></span></p>
|
|
<dl>
|
|
<dt>Service</dt>
|
|
<dd>The symbolic name of the desired service, as defined in Assigned
|
|
Numbers [STD 2] or locally. An underscore (_) is prepended to the
|
|
service identifier to avoid collisions with DNS labels that occur in
|
|
nature.</dd>
|
|
<dt>Protocol</dt>
|
|
<dd>The symbolic name of the desired protocol, with an underscore (_)
|
|
prepended to prevent collisions with DNS labels that occur in
|
|
nature.</dd>
|
|
<dt>Name</dt>
|
|
<dd>The domain this RR refers to. The SRV RR is unique in that the name
|
|
one searches for is not this name.</dd>
|
|
<dt>TTL</dt>
|
|
<dd>Standard DNS meaning [RFC 1035].</dd>
|
|
<dt>Class</dt>
|
|
<dd>Standard DNS meaning [RFC 1035]. SRV records occur in the IN
|
|
Class.</dd>
|
|
<dt>Priority</dt>
|
|
<dd>The priority of this target host. A client MUST attempt to contact
|
|
the target host with the lowest-numbered priority it can reach; target
|
|
hosts with the same priority SHOULD be tried in an order defined by the
|
|
weight field.</dd>
|
|
<dt>Weight</dt>
|
|
<dd>A server selection mechanism. The weight field specifies a relative
|
|
weight for entries with the same priority. Larger weights SHOULD be
|
|
given a proportionately higher probability of being selected. The range
|
|
of this number is 0-65535.</dd>
|
|
<dt>Port</dt>
|
|
<dd>The port on this target host of this service. The range is 0-65535.
|
|
This is a 16 bit unsigned integer in network byte order. This is often
|
|
as specified in Assigned Numbers but need not be.</dd>
|
|
<dt>Target</dt>
|
|
<dd>The domain name of the target host. There MUST be one or more address
|
|
records for this name, the name MUST NOT be an alias (in the sense of
|
|
RFC 1034 or RFC 2181). Implementors are urged, but not required, to
|
|
return the address record(s) in the Additional Data section. Unless and
|
|
until permitted by future standards action, name compression is not to
|
|
be used for this field.</dd>
|
|
</dl>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_375" id="XKMS_2_0_LC2_Paragraph_375"
|
|
class="markParagraph">[375]</a>The following service values are defined:</p>
|
|
<dl>
|
|
<dt>_XKMS_XKISS_SOAP_HTTP</dt>
|
|
<dd>An XKMS service supporting the XKISS protocol in the SOAP binding
|
|
using HTTP as the application layer transport. The Protocol value for
|
|
this service is TCP.</dd>
|
|
<dt>_XKMS_XKRSS_SOAP_HTTP</dt>
|
|
<dd>An XKMS service supporting the XKRSS protocol in the SOAP binding
|
|
using HTTP as the application layer transport. The Protocol value for
|
|
this service is TCP.</dd>
|
|
</dl>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_376" id="XKMS_2_0_LC2_Paragraph_376"
|
|
class="markParagraph">[376]</a>The publication of an SRV record in a DNS zone
|
|
that advertises an XKMS service is an affirmative statement by the operator
|
|
of the zone that the XKMS service indicated MAY be queried for information
|
|
concerning key information bound to protocol addresses within that zone. The
|
|
publication of an SRV record does not imply any undertaking on the part of
|
|
the part of the publisher to ensure that the information provided by the XKMS
|
|
service is accurate or trustworthy. Relying parties MUST therefore establish
|
|
the trustworthiness of any information they may receive from an XKMS service
|
|
discovered by means of an SRV record by other means, for example by
|
|
forwarding the data to an XKMS Validate service.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_B_1_1"
|
|
id="XKMS_2_0_LC2_Section_B_1_1">B.1.1</a>Examples</h3>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_377" id="XKMS_2_0_LC2_Paragraph_377"
|
|
class="markParagraph">[377]</a>The following SRV record advertises an XKMS
|
|
XKISS service on port 80 of border-xkms.example.com:</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_378" id="XKMS_2_0_LC2_Paragraph_378"
|
|
class="markParagraph">[378]</a><span
|
|
class="ID">_XKMS_XKISS_SOAP_HTTP._TCP.example.com - IN 0 1 80
|
|
border-xkms.example.com</span></p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_379" id="XKMS_2_0_LC2_Paragraph_379"
|
|
class="markParagraph">[379]</a>The following SRV record advertises three XKMS
|
|
XKISS services, main1, main2 and backup. Clients should direct requests to
|
|
main1 and main2 with equal priority. The service backup should only be
|
|
accessed if neither main1 or main2 is available:</p>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_380" id="XKMS_2_0_LC2_Paragraph_380"
|
|
class="markParagraph">[380]</a><span
|
|
class="ID">_XKMS_XKISS_SOAP_HTTP._TCP.example.com - IN 0 50 80
|
|
main1.example.com<br />
|
|
_XKMS_XKISS_SOAP_HTTP._TCP.example.com - IN 0 50 80 main2.example.com<br />
|
|
_XKMS_XKISS_SOAP_HTTP._TCP.example.com - IN 1 1 80
|
|
backup.example.com</span></p>
|
|
|
|
<h1 class="appendix"><a name="XKMS_2_0_LC2_Section_Appendix_C"
|
|
id="XKMS_2_0_LC2_Section_Appendix_C">Appendix C</a><a
|
|
id="SampleProtocolExchanges" name="SampleProtocolExchanges">Sample Protocol
|
|
Exchanges</a></h1>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_381" id="XKMS_2_0_LC2_Paragraph_381"
|
|
class="markParagraph">[381]</a>For clarity the examples in the running text
|
|
omit certain details such as the message authentication signatures and SOAP
|
|
binding information. This section provides theses messages in full to
|
|
facilitate interoperability testing.</p>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_C_1"
|
|
id="XKMS_2_0_LC2_Section_C_1">C.1</a><a name="AuthenticationComputation"
|
|
id="AuthenticationComputation">Authentication Computation</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_382" id="XKMS_2_0_LC2_Paragraph_382"
|
|
class="markParagraph">[382]</a>The calculation of the authentication values
|
|
used in the examples.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_1_1"
|
|
id="XKMS_2_0_LC2_Section_C_1_1">C.1.1</a><a
|
|
name="AliceRegistrationAuthenticationKey"
|
|
id="AliceRegistrationAuthenticationKey">Alice Registration Authentication
|
|
Key</a></h3>
|
|
<dl>
|
|
<dt>Authentication Data</dt>
|
|
<dd><span class="ID">024837</span></dd>
|
|
<dt>Converted Authentication Data</dt>
|
|
<dd><span class="ID">[30][32][34][38][33][37]</span></dd>
|
|
<dt>Key = HMAC-SHA1 (Converted Authentication Data, 0x1)</dt>
|
|
<dd><span class="ID">[d6][cc][34][cb][83][fa][e2][99]
|
|
[3a][39][3a][a8][e7][de][9a][06] [c7][fa][2c][92]</span></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_1_2"
|
|
id="XKMS_2_0_LC2_Section_C_1_2">C.1.2</a><a
|
|
name="BobRegistrationAuthenticationKey"
|
|
id="BobRegistrationAuthenticationKey">Bob Registration Authentication
|
|
Key</a></h3>
|
|
<dl>
|
|
<dt>Authentication Data</dt>
|
|
<dd> <span class="ID">3N9CJ-JK4JK-S04JF-W0934-JSR09-JWIK4</span></dd>
|
|
<dt>Converted Authentication Data</dt>
|
|
<dd> <span class="ID">[33][6e][39][63][6a][6b][34][6a]
|
|
[6b][73][30][34][6a][66][77][30] [39][33][34][6a][73][72][30][39]
|
|
[6a][77][69][6b][34]</span></dd>
|
|
<dt>Key = HMAC-SHA1 (Converted Authentication Data, 0x1)</dt>
|
|
<dd> <span class="ID">[2d][7d][34][d5][ba][69][6b][f3]
|
|
[ea][c7][9f][fe][6d][b5][e7][e7] [99][46][a0][e3]</span></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_1_3"
|
|
id="XKMS_2_0_LC2_Section_C_1_3">C.1.3</a><a
|
|
name="BobRegistrationPrivateKeyEncryption"
|
|
id="BobRegistrationPrivateKeyEncryption">Bob Registration Private Key
|
|
Encryption</a></h3>
|
|
<dl>
|
|
<dt>Authentication Data</dt>
|
|
<dd><span class="ID">3N9CJ-K4JKS-04JWF-0934J-SR09JW-IK4</span></dd>
|
|
<dt>Converted Authentication Data</dt>
|
|
<dd><span
|
|
class="ID">[33][6e][39][63][6a][6b][34][6a][6b][73][30][34][6a][66][77][30][39][33][34][6a][73][72][30][39][6a][77][69][6b][34]</span></dd>
|
|
<dt>First Block = HMAC-SHA1 (Converted Authentication Data, 0x4)</dt>
|
|
<dd><span
|
|
class="ID">[82][6d][b2][12][44][89][22][a0][ef][83][da][23][d6][f1][ec][9a][03][03][5a][3e]</span></dd>
|
|
<dt>Key = First Block XOR 0x4</dt>
|
|
<dd><span
|
|
class="ID">[86][6d][b2][12][44][89][22][a0][ef][83][da][23][d6][f1][ec][9a][03][03][5a][3e]</span></dd>
|
|
<dt>Second Block = HMAC-SHA1 (Converted Authentication Data, Key)</dt>
|
|
<dd><span
|
|
class="ID">[6c][15][9b][39][ab][df][15][d4][7a][c6][1c][02][64][66][0d][ea][c5][62][4c][b3]</span></dd>
|
|
<dt>Final Private Key</dt>
|
|
<dd><span class="ID">[82][6d][b2][12][44][89][22][a0]
|
|
[ef][83][da][23][d6][f1][ec][9a]
|
|
[03][03][5a][3e][6c][15][9b][39]</span></dd>
|
|
</dl>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_383" id="XKMS_2_0_LC2_Paragraph_383"
|
|
class="markParagraph">[383]</a>The private key is used to encrypt Bob's
|
|
private key as follows:</p>
|
|
<dl>
|
|
<dt>Initialization Vector</dt>
|
|
<dd><span class="ID">[1e][7a][76][dc][87][c1][f5][5a]</span></dd>
|
|
<dt>PlainText</dt>
|
|
<dd><font face="Courier"><?xml version="1.0" encoding="utf-16"?><br
|
|
/>
|
|
<RSAKeyPair xmlns="http://www.w3.org/2002/03/xkms#"> ...<br />
|
|
</font></dd>
|
|
<dt>Plain Text</dt>
|
|
<dd><span class="ID">[3c][3f][78][6d][6c][20][76][65]
|
|
[72][73][69][6f][6e][3d][22][31] [2e][30][22][20][65][6e][63][6f]
|
|
[64][69][6e][67][3d][22][75][74] [66][2d][31][36][22][3f][3e][0d]
|
|
[0a][3c][52][53][41][4b][65][79] [50][61][69][72][20][78][6d][6c]
|
|
[6e][73][3d][22][68][74][74][70] [3a][2f][2f][77][77][77][2e][77]
|
|
[33][2e][6f][72][67][2f][32][30] [30][32][2f][30][33][2f][78][6b]
|
|
...<br />
|
|
[69][72][3e][05][05][05][05][05]</span></dd>
|
|
<dt>Cipher Text (with pre-pended Initialization Vector)</dt>
|
|
<dd><span class="ID">[1e][7a][76][dc][87][c1][f5][5a]
|
|
[6d][e5][fe][00][eb][7f][76][2e] [a9][37][fa][1f][98][f7][df][6b]
|
|
[26][1a][62][7b][18][be][c5][71] [16][a2][41][35][9e][da][f4][67]
|
|
[8a][b8][bb][7e][a1][47][2d][0f] [3e][60][14][4a][cf][09][6c][57]
|
|
[45][56][2c][31][3e][12][63][e2] [79][79][9e][6c][16][f1][b6][64]
|
|
[6f][42][a3][1b][fa][cb][7a][a6] [97][21][b1][94][c1][86][b6][e2]
|
|
[55][5e][23][3b][c8][42][16][09]</span></dd>
|
|
<dd><span class="ID">...<br />
|
|
[23][b2][59][cb][5d][32][1d][48]</span></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_1_4"
|
|
id="XKMS_2_0_LC2_Section_C_1_4">C.1.4</a><a
|
|
name="BobRecoveryPrivateKeyEncryption"
|
|
id="BobRecoveryPrivateKeyEncryption">Bob Recovery Private Key
|
|
Encryption</a></h3>
|
|
<dl>
|
|
<dt>Authentication Data</dt>
|
|
<dd><span class="ID">A8YUT vuhhu c9h29 8y43u h9j3i 23</span></dd>
|
|
<dt>Converted Authentication Data</dt>
|
|
<dd><span class="ID">[61][38][79][75][74][76][75][68]
|
|
[68][75][63][39][68][32][39][38] [79][34][33][75][68][39][6a][33]
|
|
[69][32][33]</span></dd>
|
|
<dt>Private Key</dt>
|
|
<dd><span class="ID">[91][8c][67][d8][bc][16][78][86]
|
|
[dd][6d][39][19][91][c4][49][6f]
|
|
[14][e2][61][33][8a][4a][d5][be]</span></dd>
|
|
</dl>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_C_2"
|
|
id="XKMS_2_0_LC2_Section_C_2">C.2</a><a name="PassPhraseComputation"
|
|
id="PassPhraseComputation">Pass Phrase Computation</a></h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_384" id="XKMS_2_0_LC2_Paragraph_384"
|
|
class="markParagraph">[384]</a>The calculation of the pass phrase values used
|
|
in the examples.</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_2_1"
|
|
id="XKMS_2_0_LC2_Section_C_2_1">C.2.1</a><a name="AlicePassPhraseComputation"
|
|
id="AlicePassPhraseComputation">Alice Pass Phrase Computation</a></h3>
|
|
<dl>
|
|
<dt>Pass Phrase</dt>
|
|
<dd><span class="ID">"Help I Have Revealed My Key"</span></dd>
|
|
<dt>Converted Pass Phrase</dt>
|
|
<dd><span
|
|
class="ID">[68][65][6c][70][69][68][61][76][65][72][65][76][65][61][6c][65][64][6d][79][6b][65][79]</span></dd>
|
|
<dt>Pass Phrase Pass 1 HMAC-SHA1 (Converted Authentication Data, 0x1)</dt>
|
|
<dd><span
|
|
class="ID">[3c][7c][7c][96][2d][92][52][1a][c9][bf][67][b5][0f][27][96][6c][66][c3][ea][bb]</span></dd>
|
|
<dt>Pass Phrase Pass 2 = HMAC-SHA1 (Pass Phrase Pass 1 , 0x2)</dt>
|
|
<dd><span
|
|
class="ID">[e4][01][00][6a][2d][3a][84][52][44][92][ea][b2][0f][2a][8d][87][c9][3f][bb][73]</span></dd>
|
|
<dt>Base 64 Encoding of Pass Phrase</dt>
|
|
<dd><span class="ID">5AEAai06hFJEkuqyDyqNh8k/u3M=</span></dd>
|
|
</dl>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_2_2"
|
|
id="XKMS_2_0_LC2_Section_C_2_2">C.2.2</a><a name="BobPassPhraseComputation"
|
|
id="BobPassPhraseComputation">Bob Pass Phrase Computation</a></h3>
|
|
<dl>
|
|
<dt>Pass Phrase</dt>
|
|
<dd><span class="ID">"Have A Banana"</span></dd>
|
|
<dt>Converted Pass Phrase</dt>
|
|
<dd><span
|
|
class="ID">[68][61][76][65][61][62][61][6e][61][6e][61]</span></dd>
|
|
<dt>Pass Phrase Pass 1 = HMAC-SHA1 (Converted Authentication Data, 0x1)</dt>
|
|
<dd><span
|
|
class="ID">[f0][66][22][54][af][33][04][3e][44][d2][af][51][ab][66][3f][19][c8][b4][66][9a]</span></dd>
|
|
<dt>Base 64 Encoding of Pass Phrase Stage 1</dt>
|
|
<dd><span class="ID">PHx8li2SUhrJv2e1DyeWbGbD6rs=</span></dd>
|
|
<dt>Pass Phrase Pass 2 = HMAC-SHA1 (Pass Phrase Pass 1 , 0x2)</dt>
|
|
<dd><span
|
|
class="ID">[60][37][64][79][9e][a9][e6][e7][97][9e][f9][ce][3f][22][39][53][bf][8f][d9][0a]</span></dd>
|
|
<dt>Base 64 Encoding of Pass Phrase Stage 2</dt>
|
|
<dd><span class="ID">YDdkeZ6p5ueXnvnOPyI5U7+P2Qo=</span></dd>
|
|
</dl>
|
|
|
|
<h2><a name="XKMS_2_0_LC2_Section_C_3"
|
|
id="XKMS_2_0_LC2_Section_C_3">C.3</a>Private Key Parameters</h2>
|
|
|
|
<p><a name="XKMS_2_0_LC2_Paragraph_385" id="XKMS_2_0_LC2_Paragraph_385"
|
|
class="markParagraph">[385]</a>The parameters of the parties RSA key pairs
|
|
are as follows:</p>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_3_1"
|
|
id="XKMS_2_0_LC2_Section_C_3_1">C.3.1</a><a name="AlicePrivateKeyParameters"
|
|
id="AlicePrivateKeyParameters">Alice Private Key Parameters</a></h3>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RSAKeyValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<Modulus>zvbTdKsTprGAKJdgi7ulDR0eQBptLv/SJNIh3uVmPBObZFsLbqPwo5nyLOkzWlEHNb
|
|
ShPMRp1qFr
|
|
AfF13LMmeohNYfCXTHLqH1MaMOm+BhXABHB9rUKaGoOBjQPHCBtHbfMGQYjznGTpfCdTrUgq8VNl
|
|
qM2Ph9XWMcc7qbjNHw8=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
<P>+6Tn14NSh6SAKPFYwM90SyPpaLUlKrXlkHYK+kz4NhwL0gWFs47wNEMqt3jst2dbMWXGvaS/
|
|
wGhf
|
|
83Z1OiSE7Q==</P>
|
|
<Q>0ovuzCkVfkcLegWTiHU1N7y012ZEMXO1/9at+t/91u5uKvdmV7hW+A9TDfo8Np8lkKxAp7yg
|
|
NXPB
|
|
/LxdjY3Qaw==</Q>
|
|
<DP>Yx9e74ZcAPAsR3Rh6HkPLvXzX/pSrJM/3PqScmvVLcM4aL8iHkuElKGMdv7cB5Zf1oJnmZY
|
|
Griyu
|
|
9wDHRmLSNQ==</DP>
|
|
<DQ>UlpNgymmsIfVY1r/A+bkc/KpwX7MuZMK4xDzaCdowELucHvoWfNOgSRtVhBEsRC6vsXBXFq
|
|
ZR48J
|
|
l3OOHCoWFQ==</DQ>
|
|
<InverseQ>cixn+N0gEnHqH843NjJyYBQd6vMWZNYlVGFAbLHAYrOSds2LUZglRbiTfRnOOjadK
|
|
rTOu3na75Mk
|
|
s8rp0hKuZA==</InverseQ>
|
|
<D>oMqalfWjmsoka2TQGT97h6irq9ncIbuWpAytS+Klft8sxtcFFrw/ZJthzwqOXwi8tTjUW8Wt
|
|
BJb7
|
|
79KMYx68MOdG7eKgSz9yuYMKo3KZVxa0gUvtzBroI3kH/ggqIwT0zgTEU6sDjGIezRt1tt3hmaMO
|
|
ekPaOBiGym+h6nv+9+E=</D>
|
|
</RSAKeyValue></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_3_2"
|
|
id="XKMS_2_0_LC2_Section_C_3_2">C.3.2</a><a name="BobPrivateKeyParameters"
|
|
id="BobPrivateKeyParameters">Bob Private Key Parameters</a></h3>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RSAKeyValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<Modulus>4i0BEhQ8Jc4tjwZYbvtMyYfBrIGOMx34K4Cdo2pAzoGnV679FLmGHWnQy2cSj39hf5
|
|
D1mIaPyD3j
|
|
/33TdfglTaaKqp7IPf6ei754fOuI/r1HpX7uqsw+j9LC4Z7GnG3yoY/eBJOZ8TRwMnx+MkwmopXP
|
|
VLvhMWRyiUOcO3SEkTE=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
<P>9bfMM0ZkTd/bs9Vy9vGSdaOZ2qQh/0JVbpAMXSd0AEtPj8m28ZaGW+8wQ4OdOEmouNPDkhm6
|
|
O7HC
|
|
TJ3IY18Phw==</P>
|
|
<Q>66PdfVufWHWghfUMVg3SypsiFWYCWIlgzl0AyZfUpRufjAMXpkpJckNh5qBAEikEPEsY7p3D
|
|
vISV
|
|
TDqHeh/Xhw==</Q>
|
|
<DP>rZ5v768GQqwxThE9CVXJ2ct+c6nTx8w0F0o7Ijs1UNvl3MB3vp5QU3dfj+TYWyRYzjf7ESm
|
|
SmIlS
|
|
s9Ys+GH70w==</DP>
|
|
<DQ>HvCEG3qVQIspSY10UjQ8cifOYNrlAfT/xfjGKrIJ1Kf82ehqCYaFgEBCsYJnBztld/kwS9x
|
|
hH/aU
|
|
l86zjSBzLw==</DQ>
|
|
<InverseQ>FBpix6rKRUOlpddbREtNXGjiyvLK+jWu+pSCiTSpaQQkVuNH9dSRVqhbZi5ctYFuV
|
|
QISjfW4lap9
|
|
pLKX5vCw/g==</InverseQ>
|
|
<D>ystjbFxsWdF2FAmyfUAh54kr5Ir9f2PdwtO9hGqe1Qp3iy1BirWWRQU9y0MN51BlkUXej/YH
|
|
MZoc
|
|
tlaRpfLrLfcNYB4odKP4Tku+3eqqoc70kMYorU34NJQeeDVvDHaCm21qiSa9Je9QTlHI4PN38kM0
|
|
N3mEuHXRuw7MQI7W62k=</D>
|
|
</RSAKeyValue></pre>
|
|
|
|
<h3><a name="XKMS_2_0_LC2_Section_C_3_3"
|
|
id="XKMS_2_0_LC2_Section_C_3_3">C.3.3</a><a
|
|
name="XKMSServicePrivateKeyParameters"
|
|
id="XKMSServicePrivateKeyParameters">XKMS Service Private Key
|
|
Parameters</a></h3>
|
|
<!-- Include file -->
|
|
<pre class="Example"><?xml version="1.0" encoding="utf-8"?>
|
|
<RSAKeyValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns="http://www.w3.org/2002/03/xkms#">
|
|
<Modulus>wqmaAkC8cZi/KSAO/T9ICP+Blf2MRL66/rgj+c0hqgOrXnkOpDYXQXRWl1RG2DIcRO
|
|
H2KWZPgP2H
|
|
JlRc2xiF8dZvahoNCZTsQdqrgmo9hdNFxm65RHQsnUdcUfw24ojP4hGQaBzCAkGt8f0/7W9wg2p/
|
|
2fiCGe4gM1Wzixssd2c=</Modulus>
|
|
<Exponent>AQAB</Exponent>
|
|
<P>+59K7Ed5qVT6310U4UZi1tec4Bu/2Gwbq9X/4cIZAeX00Ia8PY9SiFrCvCdYzEUi65iCXr0/
|
|
w8N3
|
|
iQUQtjtlSw==</P>
|
|
<Q>xgydSIsBjcJe/XUQovNKE94JaU5GvYmewKs2E3vF8R8UnrjB1tDlF3w5m+44rP6o2LmO8W5h
|
|
RrKV
|
|
QO8jJvWQ1Q==</Q>
|
|
<DP>TUaDfQMKcx2dGkH86p5yNmbrT8xV48J30RMczZmNko6r2+q1HvbIMwYkriIrXDiTW+VvjGb
|
|
0kUuT
|
|
h2od0sl09w==</DP>
|
|
<DQ>hfNmNfh+toiugrM4612tzr4wk170DaIVE685RfhDKxCge7HuuQJU0Iue005OWwNq5BqtCbJ
|
|
kbNLA
|
|
jEix99nDeQ==</DQ>
|
|
<InverseQ>aq9qMcPcVj0QJ9kgOu1aF1l2dfuXDlsC+Nm96AQY3H+C9whSjqtePys3GSEC6dfZF
|
|
9utSsJ2L63u
|
|
Pf3UY4DCFA==</InverseQ>
|
|
<D>ESpJdVdmBpJUkPjNuZEh9gEp2SMRgmJbNOjh6z4mcMqACwWbv+kxJclvdUquMJRCn+RZA4+N
|
|
BS/W
|
|
AhBAW+WOsfvyvXqMLk+h3Y8p4qI5xp/DTcJceXUl2902owMOZD2KNI4jmm+AyBB7Vw/oa1GK4era
|
|
cK4/acuRjnKWPcgubFk=</D>
|
|
</RSAKeyValue></pre>
|
|
|
|
<h1 class="appendix"><a name="XKMS_2_0_LC2_Section_Appendix_D"
|
|
id="XKMS_2_0_LC2_Section_Appendix_D">Appendix D</a><a name="References"
|
|
id="References">References</a></h1>
|
|
|
|
<p class="Ref"><a name="CSP" id="CSP">[CSP]</a> TBD</p>
|
|
|
|
<p><a id="ref-KEYWORDS" name="ref-KEYWORDS">[KEYWORDS]</a><a
|
|
href="http://www.ietf.org/rfc/rfc2119.txt"> RFC 2119: Key words for use in
|
|
RFCs to Indicate Requirement Levels.</a> S. Bradner. Best Current Practice,
|
|
March 1997. <a
|
|
href="http://www.ietf.org/rfc/rfc2119.txt">http://www.ietf.org/rfc/rfc2119.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_386"
|
|
id="XKMS_2_0_LC2_Paragraph_386" class="markParagraph">[386]</a><b><a
|
|
name="P3P" id="P3P">[P3P]</a></b> Lorrie Cranor, Marc Langheinrich,
|
|
Massimo Marchiori, Martin Presler-Marshall, Joseph Reagle, <i> The
|
|
Platform for Privacy Preferences 1.0 (P3P1.0) Specification</i>, W3C
|
|
Recommendation 16 April 2002, <a
|
|
href="http://www.w3.org/TR/2002/REC-P3P-20020416/">http://www.w3.org/TR/2002/REC-P3P-20020416/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_387"
|
|
id="XKMS_2_0_LC2_Paragraph_387" class="markParagraph">[387]</a><b><a
|
|
name="pkix" id="pkix">[PKIX]</a> </b>R. Housley, W. Ford, W. Polk, D.
|
|
Solo, Internet X.509 Public Key Infrastructure Certificate and CRL Profile,
|
|
IETF RFC 2459, January 1999, <a
|
|
href="http://www.ietf.org/rfc/rfc2459.txt">http://www.ietf.org/rfc/rfc2459.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_388"
|
|
id="XKMS_2_0_LC2_Paragraph_388" class="markParagraph">[388]</a><b>[<a
|
|
id="PKCS1" name="PKCS1">PKCS1</a>]</b> Kaliski, B., <i>PKCS #1: RSA
|
|
Encryption Version 2.</i>0, RSA Laboratories, also IETF RFC 2437, October
|
|
1998. <a
|
|
href="http://www.ietf.org/rfc/rfc2437.txt">http://www.ietf.org/rfc/rfc2437.txt</a>.</p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_389"
|
|
id="XKMS_2_0_LC2_Paragraph_389" class="markParagraph">[389]</a><b><a
|
|
name="RFC2459" id="RFC2459">[RFC2459]</a></b>R. Housley, W. Ford, W. Polk, D.
|
|
Solo, <i>Internet X.509 Public Key Infrastructure Certificate and CRL
|
|
Profile</i>, IETF RFC 2459, January 1999. <a
|
|
href="http://www.ietf.org/rfc/rfc2459.txt">http://www.ietf.org/rfc/rfc2459.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_390"
|
|
id="XKMS_2_0_LC2_Paragraph_390" class="markParagraph">[390]</a><b>[<a
|
|
id="RFC-2104" name="RFC-2104">RFC-2104</a>]</b> Krawczyk, H.,
|
|
Bellare, M. and R. Canetti, <i>HMAC: Keyed Hashing for Message
|
|
Authentication</i>, IETF RFC 2104, February 1997. <a
|
|
href="http://www.ietf.org/rfc/rfc2104.txt">http://www.ietf.org/rfc/rfc2104.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_391"
|
|
id="XKMS_2_0_LC2_Paragraph_391" class="markParagraph">[391]</a><b><a id="TLS"
|
|
name="TLS">[RFC-2246]</a></b> T. Dierks, C. Allen., <i>The TLS Protocol
|
|
Version, 1.0.</i> IETF RFC 2246 January 1999. <a
|
|
href="http://www.ietf.org/rfc/rfc2246.txt">http://www.ietf.org/rfc/rfc2246.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_392"
|
|
id="XKMS_2_0_LC2_Paragraph_392" class="markParagraph">[392]</a><b><a
|
|
name="RFC-2373" id="RFC-2373">[RFC-2373]</a></b> R.
|
|
Hinden, S. Deering,<i>IP Version 6 Addressing Architecture</i>,
|
|
<i> </i> IETF RFC 2373 July 1998., <a
|
|
href="http://www.ietf.org/rfc/rfc2373.txt">http://www.ietf.org/rfc/rfc2373.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_393"
|
|
id="XKMS_2_0_LC2_Paragraph_393" class="markParagraph">[393]</a><b><a
|
|
name="RFC-2782" id="RFC-2782">[RFC-2782]</a></b>A. Gulbrandsen, P. Vixie, L.
|
|
Esibov, <i>A DNS RR for specifying the location of services (DNS SRV)</i>,
|
|
IETF RFC 2782, February 2000, <a
|
|
href="http://www.ietf.org/rfc/rfc2782.txt">http://www.ietf.org/rfc/rfc2782.txt</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_394"
|
|
id="XKMS_2_0_LC2_Paragraph_394" class="markParagraph">[394]</a><b>[<a
|
|
id="SOAP" name="SOAP">SOAP</a>]</b> D. Box, D Ehnebuske, G. Kakivaya, A.
|
|
Layman, N. Mendelsohn, H. Frystyk Nielsen, S Thatte, D. Winer. <i>Simple
|
|
Object Access Protocol (SOAP) 1.1</i>, W3C Note 08 May 2000, <a
|
|
href="http://www.w3.org/TR/SOAP/">http://www.w3.org/TR/SOAP/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_395"
|
|
id="XKMS_2_0_LC2_Paragraph_395" class="markParagraph">[395]</a><b><a
|
|
name="XMLP" id="XMLP">[XMLP]</a></b> XML Protocol Working Group, <a
|
|
href="http://www.w3.org/2000/xp/Group/">http://www.w3.org/2000/xp/Group/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_396"
|
|
id="XKMS_2_0_LC2_Paragraph_396" class="markParagraph">[396]</a><b>[<a
|
|
id="WSSL" name="WSSL">WSSL</a>]</b> E. Christensen, F. Curbera, G. Meredith,
|
|
S. Weerawarana, <i>Web Services Description Language (WSDL) 1.0</i> September
|
|
25, 2000, <a
|
|
href="http://msdn.microsoft.com/xml/general/wsdl.asp">http://msdn.microsoft.com/xml/general/wsdl.asp</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_397"
|
|
id="XKMS_2_0_LC2_Paragraph_397" class="markParagraph">[397]</a><b><a
|
|
name="x509" id="x509">[X509]</a> </b>ITU-T Recommendation X.509 (1997
|
|
E): Information Technology - <i>Open Systems Interconnection - The Directory:
|
|
Authentication Framework</i>, June 1997.</p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_398"
|
|
id="XKMS_2_0_LC2_Paragraph_398" class="markParagraph">[398]</a><b>[<a
|
|
id="ref-XML" name="ref-XML">XML</a>]</b> T. Bray, E. Maler, J. Paoli, C. M.
|
|
Sperberg-McQueen. <i>Extensible Markup Language (XML) 1.0 (Second
|
|
Edition).</i> W3C Recommendation. October 2000. <a
|
|
href="http://www.w3.org/TR/2000/REC-xml-20001006">http://www.w3.org/TR/2000/REC-xml-20001006</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_399"
|
|
id="XKMS_2_0_LC2_Paragraph_399" class="markParagraph">[399]</a><b>[<a
|
|
id="XML-SIG" name="XML-SIG">XML-SIG</a>]</b> D. Eastlake, J. R., D.
|
|
Solo, M. Bartel, J. Boyer , B. Fox , E. Simon. <i>XML-Signature Syntax and
|
|
Processing</i>, World Wide Web Consortium. <a
|
|
href="http://www.w3.org/TR/xmldsig-core/">http://www.w3.org/TR/xmldsig-core/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_400"
|
|
id="XKMS_2_0_LC2_Paragraph_400" class="markParagraph">[400]</a><b>[<a
|
|
id="XML-SIG-XSD" name="XML-SIG-XSD">XML-SIG-XSD</a>]</b> XML Signature Schema
|
|
available from <span class="ID"><font face="Arial"><a
|
|
href="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd">http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd</a></font></span></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_401"
|
|
id="XKMS_2_0_LC2_Paragraph_401" class="markParagraph">[401]</a><b>[<a
|
|
id="XML-Enc" name="XML-Enc">XML-Enc</a>]</b>Donald Eastlake, Joseph Reagle,
|
|
Takeshi Imamura, Blair Dillaway, Ed Simon, <i>XML Encryption Syntax and
|
|
Processing</i>, World Wide Web Consortium, <a
|
|
href="http://www.w3.org/TR/xmlenc-core/">http://www.w3.org/TR/xmlenc-core/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_402"
|
|
id="XKMS_2_0_LC2_Paragraph_402" class="markParagraph">[402]</a><b>[<a
|
|
id="ref-XML-ns">XML-ns</a>]</b> T. Bray, D. Hollander, A. Layman.
|
|
<i>Namespaces in XML. W3C Recommendation.</i> January 1999. <a
|
|
href="http://www.w3.org/TR/1999/REC-xml-names-19990114/">http://www.w3.org/TR/1999/REC-xml-names-19990114</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_403"
|
|
id="XKMS_2_0_LC2_Paragraph_403" class="markParagraph">[403]</a><b>[<a
|
|
id="XML-Schema1" name="XML-Schema1">XML-Schema1</a>]</b> H. S. Thompson, D.
|
|
Beech, M. Maloney, N. Mendelsohn. <i>XML Schema Part 1: Structures</i>, W3C
|
|
Working Draft 22 September 2000, <a
|
|
href="http://www.w3.org/TR/2000/WD-xmlschema-1-20000922/">http://www.w3.org/TR/2000/WD-xmlschema-1-20000922/</a>,
|
|
latest draft at <a
|
|
href="http://www.w3.org/TR/xmlschema-1/">http://www.w3.org/TR/xmlschema-1/</a></p>
|
|
|
|
<p class="Ref"><a name="XKMS_2_0_LC2_Paragraph_404"
|
|
id="XKMS_2_0_LC2_Paragraph_404" class="markParagraph">[404]</a><b>[<a
|
|
id="XML-Schema2" name="XML-Schema2">XML-Schema2</a>]</b> P. V. Biron, A.
|
|
Malhotra, <i>XML Schema Part 2: Datatypes</i>; W3C Working Draft 22 September
|
|
2000, <a
|
|
href="http://www.w3.org/TR/2000/WD-xmlschema-2-20000922/">http://www.w3.org/TR/2000/WD-xmlschema-2-20000922/</a>,
|
|
latest draft at <a
|
|
href="http://www.w3.org/TR/xmlschema-2/">http://www.w3.org/TR/xmlschema-2/</a></p>
|
|
</body>
|
|
</html>
|