You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3785 lines
167 KiB
3785 lines
167 KiB
<?xml version="1.0" encoding="iso-8859-1"?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
|
|
<title>XML Key Management Specification (XKMS 2.0)</title>
|
|
<style type="text/css">
|
|
<!--
|
|
/*<![CDATA[*/
|
|
P.Code {
|
|
FONT-SIZE: 10pt; BACKGROUND: #ffffa7; MARGIN: 0in 0.5in 0pt; FONT-FAMILY: Courier
|
|
}
|
|
P.Example {
|
|
FONT-SIZE: 10pt; BACKGROUND: #d2e9ff; MARGIN: 0in 0.5in 0pt; FONT-FAMILY: Courier
|
|
}
|
|
|
|
/*]]>*/
|
|
-->
|
|
|
|
|
|
</style>
|
|
<link rel="stylesheet" type="text/css"
|
|
href="http://www.w3.org/StyleSheets/TR/W3C-WD.css" />
|
|
</head>
|
|
|
|
<body xml:lang="EN-US" lang="EN-US" vlink="purple" link="blue">
|
|
|
|
<div class="head">
|
|
<a href="http://www.w3.org/"><img height="48" alt="W3C"
|
|
src="http://www.w3.org/Icons/w3c_home" width="72" /></a>
|
|
|
|
<h1>XML Key Management Specification (XKMS 2.0)</h1>
|
|
|
|
<h2>W3C Working Draft 18 March 2002</h2>
|
|
<dl>
|
|
<dt>This version:</dt>
|
|
<dd><a
|
|
href="http://www.w3.org/TR/2002/WD-xkms2-20020318/">http://www.w3.org/TR/2002/WD-xkms2-20020318/</a> </dd>
|
|
<dt>Latest version:</dt>
|
|
<dd><a
|
|
href="http://www.w3.org/TR/xkms2/">http://www.w3.org/TR/xkms2/</a></dd>
|
|
<dt>Previous version:</dt>
|
|
<dd>n/a</dd>
|
|
<dt>Editor:</dt>
|
|
<dd><a href="mailto:pbaker@verisign.com">Phillip Hallam-Baker</a>
|
|
VeriSign</dd>
|
|
<dt>Contributors:</dt>
|
|
<dd>See the WG <a
|
|
href="http://www.w3.org/2001/XKMS/Participants.html">participants</a>
|
|
list.</dd>
|
|
</dl>
|
|
|
|
<p class="copyright"><a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice-20000612#Copyright">Copyright</a>
|
|
©2002 <a href="http://www.w3.org/"><abbr
|
|
title="World Wide Web Consortium">W3C</abbr></a><sup>®</sup> (<a
|
|
href="http://www.lcs.mit.edu/"><abbr
|
|
title="Massachusetts Institute of Technology">MIT</abbr></a>, <a
|
|
href="http://www.inria.fr/"><abbr xml:lang="fr" lang="fr"
|
|
title="Institut National de Recherche en Informatique et Automatique">INRIA</abbr></a>,
|
|
<a href="http://www.keio.ac.jp/">Keio</a>), All Rights Reserved. W3C <a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice-20000612#Legal_Disclaimer">liability</a>,
|
|
<a
|
|
href="http://www.w3.org/Consortium/Legal/ipr-notice-20000612#W3C_Trademarks">trademark</a>,
|
|
<a
|
|
href="http://www.w3.org/Consortium/Legal/copyright-documents-19990405">document
|
|
use</a> and <a
|
|
href="http://www.w3.org/Consortium/Legal/copyright-software-19980720">software
|
|
licensing</a> rules apply.</p>
|
|
<hr title="Separator from Header" />
|
|
</div>
|
|
|
|
<div>
|
|
<h2><a id="abstract" name="abstract">Abstract</a></h2>
|
|
|
|
<p>This document specifies protocols for distributing and registering public
|
|
keys, suitable for use in conjunction with the proposed standard for XML
|
|
Signature [XML-SIG] developed by the World Wide Web Consortium (W3C) and the
|
|
Internet Engineering Task Force (IETF) and an anticipated companion standard
|
|
for XML encryption. <a href="http://www.w3.org/2001/XKMS/Drafts/XKMS/">The
|
|
XML Key Management Specification (XKMS)</a> comprises two parts -- the XML
|
|
Key Information Service Specification (X-KISS) and the XML Key Registration
|
|
Service Specification (X-KRSS).</p>
|
|
|
|
<h2><a id="status" name="status">Status of this document</a></h2>
|
|
|
|
<p>This is the first draft of the "XML Key Management Specification (XKMS)"
|
|
specification from the <a href="http://www.w3.org/2001/XKMS/Drafts/">XML Key
|
|
Management Working Group</a> (<a
|
|
href="http://www.w3.org/2001/XKMS/Activity.html">Activity Statement</a>).</p>
|
|
|
|
<p>This specification contains points which are still under discussion, do
|
|
not yet satisfy the XKMS Requirements, or are not well specified.</p>
|
|
|
|
<p>The Working Group will try to <a
|
|
href="http://www.w3.org/1999/10/nsuri">use a new namespace</a> when changes
|
|
in its syntax or processing are substantive. However, this namespace might be
|
|
reused (prior to reaching Candidate Recommendation) by subsequent drafts in
|
|
such a way as to cause instances using the namespace to become invalid or to
|
|
change in meaning or affect the operation of existing software. Requests for
|
|
a more stringent level of namespace stability should be made to the Working
|
|
Group.</p>
|
|
|
|
<p>Publication of this document does not imply endorsement by the W3C
|
|
membership. This is a draft document and may be updated, replaced or
|
|
obsoleted by other documents at any time. It is inappropriate to cite a W3C
|
|
Working Draft as anything other than a "work in progress." A list of current
|
|
W3C working drafts can be found at <a
|
|
href="http://www.w3.org/TR/">http://www.w3.org/TR/</a>.</p>
|
|
|
|
<p>Please send comments to the editor (<<a
|
|
href="mailto:pbaker@verisign.com">pbaker@verisign.com</a>>) and cc: the
|
|
working group mailing list <a
|
|
href="mailto:www-xkms@w3c.org">www-xkms@w3c.org</a> (publicly <a
|
|
href="http://lists.w3.org/Archives/Public/www-xkms/">archived</a>)</p>
|
|
|
|
<p>Patent disclosures relevant to this specification may be found on the
|
|
Working Group's <a href="http://www.w3.org/2001/XKMS/Disclosures.html">patent
|
|
disclosure page</a> in conformance with W3C policy.</p>
|
|
<hr title="Separator from Header" />
|
|
</div>
|
|
|
|
<h2>Table Of Contents</h2>
|
|
|
|
<p>To be generated</p>
|
|
|
|
<h2>Table of Figures</h2>
|
|
|
|
<p>To be generated</p>
|
|
|
|
<h2>Executive Summary</h2>
|
|
|
|
<p>This document specifies protocols for distributing and registering public
|
|
keys, suitable for use in conjunction with the proposed standard for XML
|
|
Signature [XML-SIG] developed by the World Wide Web Consortium (W3C) and the
|
|
Internet Engineering Task Force (IETF) and an anticipated companion standard
|
|
for XML encryption. The XML Key Management Specification (XKMS) comprises
|
|
two parts -- the XML Key Information Service Specification (X-KISS) and the
|
|
XML Key Registration Service Specification (X-KRSS).</p>
|
|
|
|
<p>The X-KISS specification defines a protocol for a <em>Trust service</em>
|
|
that resolves public key information contained in XML-SIG elements. The
|
|
X-KISS protocol allows a client of such a service to delegate part or all of
|
|
the tasks required to process <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> elements. A key
|
|
objective of the protocol design is to minimize the complexity of application
|
|
implementations by allowing them to become clients and thereby to be shielded
|
|
from the complexity and syntax of the underlying PKI used to establish trust
|
|
relationships. The underlying PKI may be based upon a different specification
|
|
such as X.509/PKIX, SPKI or PGP.</p>
|
|
|
|
<p>The X-KRSS specification defines a protocol for a web service that accepts
|
|
registration of public key information. Once registered, the public key may
|
|
be used in conjunction with other web services including X-KISS.</p>
|
|
|
|
<p>Both protocols are defined in terms of structures expressed in the XML
|
|
Schema Language, protocols employing the Simple Object Access Protocol (SOAP)
|
|
v1.1 [SOAP] and relationships among messages defined by the Web Services
|
|
Definition Language v1.0 [WSDL]. Expression of XKMS in other compatible
|
|
object encoding schemes is also possible.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Introduction</h1>
|
|
|
|
<p>This document specifies protocols for distributing and registering public
|
|
keys, suitable for use in conjunction with the proposed standard for XML
|
|
Signatures [XML-SIG] developed by the World Wide Web Consortium (W3C) and the
|
|
Internet Engineering Task Force (IETF) and an anticipated companion standard
|
|
for XML encryption. The XML Key Management Specification (XKMS) comprises
|
|
two parts -- the XML Key Information Service Specification (X-KISS) and the
|
|
XML Key Registration Service Specification (X-KRSS).</p>
|
|
|
|
<p>These protocols do not require any particular underlying public key
|
|
infrastructure (such as X.509) but are designed to be compatible with such
|
|
infrastructures.</p>
|
|
|
|
<p>This document comprises the following service specifications:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>XML Key Information Service Specification: A protocol to support the
|
|
delegation by an application to a service of the processing of Key
|
|
Information associated with an XML signature, XML encryption, or other
|
|
public key. Its functions include the location of required public keys
|
|
and describing the binding of such keys to identification
|
|
information.</li>
|
|
<li>XML Key Registration Service Specification: A protocol to support the
|
|
registration of a key pair by a key pair holder, with the intent that the
|
|
key pair subsequently be usable in conjunction with the XML Key
|
|
Information Service Specification or higher level trust assertion service
|
|
such as XML Trust Assertion Service Specification [XTASS].</li>
|
|
</ul>
|
|
|
|
<h3><a id="sec-Editorial" name="sec-Editorial">Editorial</a> and Conformance
|
|
Conventions</h3>
|
|
|
|
<p>This specification uses XML Schemas [<a
|
|
href="#ref-XML-schema">XML-schema</a>] to describe the content model.</p>
|
|
|
|
<p>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
|
|
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
|
|
specification are to be interpreted as described in <a
|
|
href="http://www.ietf.org/rfc/rfc2119.txt">RFC2119</a> [<a
|
|
href="#ref-KEYWORDS">KEYWORDS</a>]:</p>
|
|
|
|
<blockquote>
|
|
<p>"they MUST only be used where it is actually required for interoperation
|
|
or to limit behavior which has potential for causing harm (e.g., limiting
|
|
retransmissions)"</p>
|
|
</blockquote>
|
|
|
|
<p>Consequently, we use these capitalized keywords to unambiguously specify
|
|
requirements over protocol and application features and behavior that affect
|
|
the interoperability and security of implementations. These key words are not
|
|
used (capitalized) to describe XML grammar; schema definitions unambiguously
|
|
describe such requirements and we wish to reserve the prominence of these
|
|
terms for the natural language descriptions of protocols and features. For
|
|
instance, an XML attribute might be described as being "optional." Compliance
|
|
with the XML-namespace specification [<a href="#ref-XML-NS">XML-NS</a>] is
|
|
described as "REQUIRED."</p>
|
|
|
|
<h3><a id="sec-Design" name="sec-Design">Design</a> Philosophy</h3>
|
|
|
|
<p>Design criteria include:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>Compatibility with the XML Signature Specification (currently a
|
|
standards proposal to the W3C and IETF) and with an anticipated
|
|
specification on XML Encryption. However, its use is not restricted to
|
|
these grammars.</li>
|
|
<li>Implementation should be as simple as possible using standard XML tools
|
|
while remaining consistent with the entirety of relevant specifications;
|
|
the only cryptographic functions required by an application are those
|
|
needed to support XML Signature or Encryption;</li>
|
|
<li>Implementation should not require ASN.1 tools;</li>
|
|
<li>Management of status information (e.g. "revocation") is transparent to
|
|
a public-key using application in an online environment;</li>
|
|
<li>Minimize client code and configuration complexity through use of
|
|
standard protocols and message grammars and also by delegating tasks that
|
|
may require complex configuration to web services.</li>
|
|
</ul>
|
|
|
|
<p>To meet these design criteria, the specifications in this family are
|
|
layered, separating the protocol semantics from the implementation syntax.</p>
|
|
|
|
<p>The message syntax presented in this document is based on XML and is
|
|
designed to allow use of the Simple Object Access Protocol (SOAP) and the Web
|
|
Service Definition Language (WSDL) specifications. From these, it is possible
|
|
to generate APIs in common programming languages such as the C family of
|
|
programming languages. </p>
|
|
|
|
<p>It is also possible to express the messages in syntax other than XML, over
|
|
protocols other than SOAP and through a definition language other than WSDL,
|
|
though such expression is outside the scope of this specification except to
|
|
note that SOAP and WSDL are proposals currently or potentially considered by
|
|
the World Wide Web Consortium XML Protocol Activity. If XML and SOAP are not
|
|
adopted by this Activity, we anticipate that the protocol would be
|
|
expressible in any specification recommended by the Activity.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Definition of Terms</h2>
|
|
|
|
<p>The following terms are used within this document with the particular
|
|
meaning indicated below:</p>
|
|
|
|
<blockquote>
|
|
<p class="Ref"><strong>Service<br />
|
|
</strong> An application that provides computational or informational
|
|
resources on request. A service may be provided by several physical servers
|
|
operating as a unit.</p>
|
|
|
|
<p class="Ref"><strong>Web service<br />
|
|
</strong> A service that is accessible by means of messages sent using
|
|
standard web protocols, notations and naming conventions</p>
|
|
|
|
<p class="Ref"><strong>Client<br />
|
|
</strong> An application that makes requests of a service. The concept
|
|
of 'client' is relative to a service request; an application may have the
|
|
role of client for some requests and service for others.</p>
|
|
</blockquote>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Namepaces</h2>
|
|
|
|
<p style="MARGIN: 5pt 0in">For clarity, some examples of XML are not complete
|
|
documents and namespace declarations may be omitted from XML fragments. In
|
|
this document, certain namespace prefixes represent certain namespaces.</p>
|
|
|
|
<p style="MARGIN: 5pt 0in">All XMKMS protocol elements are defined using XML
|
|
schema [XML-Schema1][XML-Schema2]. For clarity unqualified elements in schema
|
|
definitions are in the XML schema namespace:</p>
|
|
|
|
<p style="MARGIN: 5pt 0in"> xmlns="<code><span
|
|
style="FONT-SIZE: 10pt; COLOR: black; FONT-FAMILY: 'Courier New'"><a
|
|
href="http://www.w3.org/2000/10/XMLSchema">http://www.w3.org/2000/10/XMLSchema</a></span></code>"</p>
|
|
|
|
<p style="MARGIN: 5pt 0in">References to XML Key Management Specification
|
|
schema defined herein use the prefix "xkms" and are in the namespace:</p>
|
|
|
|
<p style="MARGIN: 5pt 0in 5pt 0.25in">xmlns:xkms="<span
|
|
style="FONT-SIZE: 10pt; FONT-FAMILY: Courier New"><a
|
|
href="http://www.w3.org/2002/03/xkms">http://www.w3.org/2002/03/xkms</a></span>"</p>
|
|
|
|
<p style="MARGIN: 5pt 0in">This namespace is also used for unqualified
|
|
elements in message protocol examples.</p>
|
|
|
|
<p style="MARGIN: 5pt 0in">The XKMS schema specification uses the elements
|
|
already defined in the XML Signature namespace. The "XML Signature
|
|
namespace" is represented by the prefix <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">ds</span></span> and is declared as:</p>
|
|
|
|
<p style="MARGIN: 5pt 0in; TEXT-INDENT: 0.25in">xmlns:ds="<span
|
|
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'"><a
|
|
href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a></span>"</p>
|
|
|
|
<p style="MARGIN: 5pt 0in">The "XML Signature schema" is defined in
|
|
[XML-SIG-XSD] and the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span></span> element (and
|
|
all of its contents) are defined in [XML-SIG §4.4].</p>
|
|
|
|
<blockquote>
|
|
<p class="Code" style="MARGIN: 5pt 0in"><?xml version="1.0"?><br />
|
|
<schema targetNamespace="http://www.w3.org/2002/03/xkms"<br />
|
|
xmlns="http://www.w3.org/2001/XMLSchema" <br />
|
|
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"<br />
|
|
xmlns:xkms="http://www.w3.org/2002/03/xkms" <br />
|
|
elementFormDefault="qualified"
|
|
attributeFormDefault="unqualified"><br />
|
|
<import namespace="http://www.w3.org/2000/09/xmldsig#"<br />
|
|
schemaLocation="xmldsig-core-schema.xsd"/></p>
|
|
</blockquote>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Information Service
|
|
Specification Overview (Non-Normative)</h2>
|
|
|
|
<p>X-KISS allows a client to delegate part or all of the tasks required to
|
|
process XML Signature <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> elements to a
|
|
<em>Trust service</em>. A key objective of the protocol design is to minimize
|
|
the complexity of applications using XML Signature. By becoming a client of
|
|
the trust service, the application is relieved of the complexity and syntax
|
|
of the underlying PKI used to establish trust relationships, which may be
|
|
based upon a different specification such as X.509/PKIX, SPKI or PGP.</p>
|
|
|
|
<p>By design, the XML Signature Specification does not mandate use of a
|
|
particular trust policy. The signer of a document is not required to include
|
|
any key information but may include a <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> element that
|
|
specifies the key itself, a key name, X.509 certificate, a PGP Key Identifier
|
|
etc. Alternatively, a link may be provided to a location where the full <span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span> information may be
|
|
found.</p>
|
|
|
|
<p>The information provided by the signer may therefore be insufficient by
|
|
itself to perform cryptographic verification and decide whether to trust the
|
|
signing key, or the information may not be in a format the client can use.
|
|
For example:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>The Key may be specified by a name only.</li>
|
|
<li>The local trust policy of the client may require additional information
|
|
in order to trust the key.</li>
|
|
<li>The Key may be encoded in an X.509 certificate that the client cannot
|
|
parse.</li>
|
|
</ul>
|
|
|
|
<p>In the case of an encryption operation:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>The client may not know the public key of the recipient.</li>
|
|
</ul>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Registration Service
|
|
Specification Overview (Non-Normative)</h2>
|
|
|
|
<p>X-KRSS describes a protocol for registration of public key information. A
|
|
client of a conforming service may request that the Registration Service bind
|
|
information to a public key. The information bound may include a name, an
|
|
identifier or extended attributes defined by the implementation.</p>
|
|
|
|
<p>The key pair to which the information is bound may be generated in advance
|
|
by the client or, to support key recovery, may be generated on request by the
|
|
service. The Registration protocol may also be used for subsequent recovery
|
|
of a private key.</p>
|
|
|
|
<p>The protocol provides for authentication of the applicant and, in the case
|
|
that the key pair is generated by the client, Proof of Possession (POP) of
|
|
the private key. A means of communicating the private key to the client is
|
|
provided in the case that the private key is generated by the Registration
|
|
Service.</p>
|
|
|
|
<p>This document specifies means of registering RSA and DSA keys and a
|
|
framework for extending the protocol to support other cryptographic
|
|
algorithms such as Diffie-Helleman and Elliptic Curve variants.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Tiered Service Model</h2>
|
|
|
|
<p>Different applications require different levels of PKI service. To support
|
|
this need a tiered implementation model is defined in which applications may
|
|
select the precise level of processing that meets their requirements.</p>
|
|
|
|
<p style="MARGIN-LEFT: 81pt; TEXT-INDENT: -63pt"><strong>Tier 0</strong>
|
|
Processing of the <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:RetrievalMethod></span> element
|
|
of the <span style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span>
|
|
element is by the application. Processing is as defined by the XML Signature
|
|
specification [XML-SIG §4.4.3] and without assistance of a trust service.</p>
|
|
|
|
<p style="MARGIN-LEFT: 81pt; TEXT-INDENT: -63pt"><strong>Tier 1</strong>
|
|
Processing of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span></span> element by the
|
|
application is delegated to a service. The service returns a <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> element that
|
|
describes a public key meeting the criteria specified by the client
|
|
application. Validation of the <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> is performed by
|
|
the client.</p>
|
|
|
|
<p style="MARGIN-LEFT: 81pt; TEXT-INDENT: -63pt"><strong>Tier 2</strong>
|
|
Validation Service<br />
|
|
As in tier 1, but in addition, the service reports further information
|
|
concerning the data specified in a <span
|
|
style="FONT-FAMILY: 'Courier New'"><ds:KeyInfo></span> block.</p>
|
|
|
|
<p>In each case, the trust service shields the client application from the
|
|
complexities of the underlying PKI such as:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>Handling of complex syntax and semantics (e.g. X.509v3).</li>
|
|
<li>Retrieval of information from directory and data repository
|
|
infrastructure.</li>
|
|
<li>Revocation status verification.</li>
|
|
<li>Construction and processing of trust chains.</li>
|
|
</ul>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Structure of this document</h2>
|
|
|
|
<p>The remainder of this document describes the XML Key Information Service
|
|
Specification and XML Key Registration Service Specification.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><strong>Section
|
|
2</strong>: X-KISS Protocol Overview.<br />
|
|
The functional behavior of the X-KISS protocol is described.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><strong>Section
|
|
3</strong>: X-KISS Message Set.<br />
|
|
The semantics of the X-KISS protocol messages are defined.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><strong>Section
|
|
4</strong>: X-KRSS Protocol Overview.<br />
|
|
The functional behavior of the X-KRSS protocol is described.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><strong>Section
|
|
5</strong>: X-KRSS Message Set.<br />
|
|
The semantics of the X-KRSS protocol messages is defined.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><strong>Section
|
|
6</strong>: Cryptographic Algorithm support<br />
|
|
Data formats to support use of the cryptographic algorithms RSA and DSA are
|
|
defined.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Information Service
|
|
Protocol Overview</h1>
|
|
|
|
<p>In the XML Signature Specification, a signer may optionally include
|
|
information about his public signing key ("<span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span>") within the signature
|
|
block. This key information is designed to allow the signer to communicate
|
|
"hints" to a verifier about which public key to select.</p>
|
|
|
|
<p>Another important property of <span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span> is that it may or may
|
|
not be cryptographically bound to the signature itself. This allows the
|
|
<span style="FONT-FAMILY: Courier"><ds:KeyInfo></span> to be
|
|
substituted or supplemented without "breaking" the digital signature.</p>
|
|
|
|
<p>For example Alice signs a document and sends it to Bob with a <span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span> element that specifies
|
|
only the signing Key Data. On receiving the message Bob retrieves additional
|
|
information required to validate the signature and adds this information into
|
|
the <span style="FONT-FAMILY: Courier"><ds:KeyInfo></span> element when
|
|
he passes the document on to Carol (see Figure 1below).</p>
|
|
|
|
<p class="Caption" align="center"><img height="372"
|
|
alt="Substitution of the <ds:KeyInfo> element as a message is passed amongst processors."
|
|
src="./image002.gif" width="420" /></p>
|
|
|
|
<p class="Caption" align="center"><a id="Figure1" name="Figure1">Figure 1:
|
|
Substitution of the <span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span> element as a message
|
|
is passed amongst processors</a></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Tier 0:
|
|
<ds:RetrievalMethod> Processing</h2>
|
|
|
|
<p>A <span style="FONT-FAMILY: Courier"><ds:KeyInfo></span> element may
|
|
include a <em><ds:RetrievalMethod></em> element which is a means to
|
|
convey information available from a remote location. The <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod</span></span>> element
|
|
is a feature of and is defined by the XML Signature Specification. Since it
|
|
is the most basic means of resolving a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:KeyInfo></span></span> element it is
|
|
described here as the 'Tier 0' Key Information service.</p>
|
|
|
|
<p>For example, the signer of a document may wish to refer verifiers to a
|
|
chain of X.509 certificates without having to attach them. <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span>
|
|
consists of a location which in this case, would refer to a location on the
|
|
web from which the certificate chain may be retrieved, a method, and a
|
|
type. </p>
|
|
|
|
<p>The XML Signature Specification defines the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span> as
|
|
follows:</p>
|
|
|
|
<p style="MARGIN: 6pt 0.25in"><em>A</em> <code><em><span
|
|
style="FONT-FAMILY: 'Courier New'">RetrievalMethod</span></em></code>
|
|
<em>element within</em> <code><em><span
|
|
style="FONT-FAMILY: 'Courier New'">Keyinfo</span></em></code> <em>is used to
|
|
convey a reference to</em> <code><em><span
|
|
style="FONT-FAMILY: 'Courier New'">Keyinfo</span></em></code> <em>information
|
|
that is stored at another location. For example, several signatures in a
|
|
document might use a key verified by an X.509v3 certificate chain appearing
|
|
once in the document or remotely outside the document; each signature's</em>
|
|
<code><em><span style="FONT-FAMILY: 'Courier New'">Keyinfo</span></em></code>
|
|
<em>can reference this chain using a single</em> <code><em><span
|
|
style="FONT-FAMILY: 'Courier New'">ds:RetrievalMethod</span></em></code>
|
|
<em>element instead of including the entire chain with a sequence of</em>
|
|
<code><em><span
|
|
style="FONT-FAMILY: 'Courier New'">X509Certificate</span></em></code>
|
|
<em>elements.</em></p>
|
|
|
|
<p style="MARGIN: 6pt 0.25in"><span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">RetrievalMethod</span></em></span><em><span
|
|
style="COLOR: black">uses the same syntax and dereferencing behavior
|
|
as</span> Reference's <span style="COLOR: black">URI (section 4.3.3.1 [of
|
|
[XML-SIG]]) and <u>The Reference Processing Model</u> (section 4.3.3.2 [of
|
|
[XML-SIG]]) except that there is no</span></em> <span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">DigestMethod</span></em></span><em><span
|
|
style="COLOR: black">or</span></em> <span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">DigestValue</span></em></span><em><span
|
|
style="COLOR: black">child elements and presence of the URI is mandatory.
|
|
Note, if the result of dereferencing and transforming the specified URI is a
|
|
node set, then it may need to be to be canonicalized. All of the</span></em>
|
|
<span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">KeyInfo</span></em></span><span
|
|
class="ID"><em>types defined by this specification</em></span><em><span
|
|
style="COLOR: black">(section 4.4 [of [XML-SIG]]) represent octets,
|
|
consequently the Signature application is expected to attempt to canonicalize
|
|
the nodeset via the <u>The Reference Processing Model</u> (section 4.3.3.2
|
|
[of [XML-SIG]])</span></em></p>
|
|
|
|
<p>Schema Definition:</p>
|
|
<pre class="Example"><element name="RetrievalMethod">
|
|
<complexType>
|
|
<sequence>
|
|
<element ref="ds:Transforms" minOccurs="0"/>
|
|
</sequence>
|
|
<attribute name="URI" type="uriReference"/>
|
|
<attribute name="Type" type="uriReference" use="optional"/>
|
|
</complexType>
|
|
</element>
|
|
</pre>
|
|
|
|
<p>In the following example, the signer indicates a web-resident directory
|
|
service (www.PkeyDir.test) where they have published information about their
|
|
public key. </p>
|
|
|
|
<p class="Example"><ds:KeyInfo><br />
|
|
<ds:RetrievalMethod URI="http://www.PKeyDir.test/CheckKey"</p>
|
|
|
|
<p class="Example">
|
|
Type="http://www.w3.org/2000/09/xmldsig#X509Certificate"/><br />
|
|
</ds:KeyInfo></p>
|
|
|
|
<p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">The relying party
|
|
retrieves the additional Key Information by resolving the specified URL
|
|
(Figure 2).</p>
|
|
|
|
<p style="TEXT-ALIGN: center" align="center"><img height="216"
|
|
alt="Tier 0 Protocol allows a <ds:Keyinfo> element to reference external data"
|
|
src="./image004.gif" width="480" border="0" /></p>
|
|
|
|
<p class="Caption" align="center">Figure 2: Tier 0 Protocol allows a <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element to
|
|
reference external data</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Tier 1 <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Locate</span></span> Service</h2>
|
|
|
|
<p>The Tier 1 <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Locate</span></span> service resolves a <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element but
|
|
does NOT REQUIRE the service to make an assertion concerning the validity of
|
|
the binding between the data in the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element.</p>
|
|
|
|
<p>The Trust service MAY resolve the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element using
|
|
local data or MAY relay request to other servers. For example the Trust
|
|
service might resolve a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span> element
|
|
(Figure 3) or act as a gateway to an underlying PKI based on a non-XML
|
|
syntax.</p>
|
|
|
|
<p style="TEXT-ALIGN: center" align="center"><img height="244"
|
|
alt="Diagram shows protocol exchange between a client, a trust service and a remote server (Server A). "
|
|
src="./image006.gif" width="576" border="0" /></p>
|
|
|
|
<p class="Caption" align="center">Figure 3: Tier 1 Protocol Provides Name
|
|
Resolution Service</p>
|
|
|
|
<p>Both the request and/or the response MAY be signed, to both authenticate
|
|
the sender and protect the integrity of the data being transmitted, using an
|
|
XML Signature.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Document
|
|
Signature</h3>
|
|
|
|
<p>The client receives a signed XML document. The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element
|
|
specifies a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span> for an
|
|
X.509 certificate that contains the public key. The client sends the <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element to the
|
|
location service requesting that the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyName></span></span> and <span
|
|
class="ID"><span style="FONT-FAMILY: Courier"><KeyValue></span></span>
|
|
elements be returned.</p>
|
|
|
|
<p>Request:</p>
|
|
|
|
<p class="Example"><Locate></p>
|
|
|
|
<p class="Example"> <Query></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:RetrievalMethod</p>
|
|
|
|
<p class="Example">
|
|
URI="http://www.PKeyDir.test/Certificates/01293122"</p>
|
|
|
|
<p class="Example"> Type="<a
|
|
href="http://www.w3.org/2000/09/xmldsig#SPKIData"><span
|
|
style="COLOR: windowtext; TEXT-DECORATION: none">http://www.w3.org/2000/09/xmldsig#X509Data</span></a>"/></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Query></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Locate></p>
|
|
|
|
<p>The location service resolves the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span>,
|
|
obtaining an X.509v3 certificate. The certificate is parsed to obtain the
|
|
public key value that is returned to the client.</p>
|
|
|
|
<p>The location service DOES NOT report the revocation status or the
|
|
trustworthiness of the certificate. The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyName></span></span> returned is
|
|
obtained from the certificate.</p>
|
|
|
|
<p>Response:</p>
|
|
|
|
<p class="Example"><LocateResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyName>O=XMLTrustCernter.org
|
|
OU="Crypto"</p>
|
|
|
|
<p class="Example"> CN="Alice"</ds:KeyName></p>
|
|
|
|
<p class="Example"> <ds:KeyValue>...</ds:KeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"></LocateResult></p>
|
|
|
|
<p>(For readability, the contents of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyValue></span></span>element are
|
|
omitted from the example above. Full examples are shown in appendices. )</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Data Encryption</h3>
|
|
|
|
<p>The client is attempting to send an encrypted XML document and requires
|
|
the public key encryption parameters of the recipient.</p>
|
|
|
|
<p>Request:</p>
|
|
|
|
<p class="Example"><Locate></p>
|
|
|
|
<p class="Example"> <Query></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyName>Alice
|
|
Cryptographer</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Query></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Locate></p>
|
|
|
|
<p>Response:</p>
|
|
|
|
<p class="Example"><LocateResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyName>Alice
|
|
Cryptographer</ds:KeyName></p>
|
|
|
|
<p class="Example"> <ds:KeyValue>...</ds:KeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"></LocateResult></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Tier 2: Validate Service</h2>
|
|
|
|
<p>The Tier 2 Validate Service allows all that tier one does, and in
|
|
addition, the client may obtain an assertion specifying the status of the
|
|
binding between the public key and other data, for example a name or a set of
|
|
extended attributes. Furthermore the service represents that the status of
|
|
each of the data elements returned is valid and that all are bound to the
|
|
same public key. The client sends to the trust service a prototype containing
|
|
some or all of the elements for which the status of the trust binding is
|
|
required. If the information in the prototype is incomplete, the trust
|
|
service MAY obtain additional data required from an underlying PKI Service.
|
|
Once the validity of the Key Binding has been determined the Trust service
|
|
returns the status result to the client (Figure 4).</p>
|
|
|
|
<p style="TEXT-ALIGN: center" align="center"><img height="265"
|
|
alt="Diagram shows a trust service acting as a gateway to 'PKI services'"
|
|
src="./image008.gif" width="532" border="0" /></p>
|
|
|
|
<p class="Caption" align="center"><a id="Figure-Tier2"
|
|
name="Figure-Tier2">Figure 4: Tier2 Protocol Provides Key Validation
|
|
Service</a></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Document
|
|
Signature</h3>
|
|
|
|
<p>The client of the example in section 2.2.1 has verified the document
|
|
signature. The client now needs to determine whether the binding between the
|
|
name and the public key is both trustworthy and valid.</p>
|
|
|
|
<p>Request:</p>
|
|
|
|
<p class="Example"><Validate></p>
|
|
|
|
<p class="Example"> <Query></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyName>...</ds:KeyName></p>
|
|
|
|
<p class="Example"> <ds:KeyValue>...</ds:KeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Query></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Validate></p>
|
|
|
|
<p>Response:</p>
|
|
|
|
<p class="Example"><ValidateResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <KeyBinding></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>http://www.xmltrustcenter.org/assert/20010120-39</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyName>...</ds:KeyName></p>
|
|
|
|
<p class="Example"> <ds:KeyValue>...</ds:KeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ValidityInterval></p>
|
|
|
|
<p class="Example">
|
|
<NotBefore>2000-09-20T12:00:00</NotBefore></p>
|
|
|
|
<p class="Example">
|
|
<NotAfter>2000-10-20T12:00:00</NotAfter></p>
|
|
|
|
<p class="Example"> </ValidityInterval></p>
|
|
|
|
<p class="Example"> </KeyBinding></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"></ValidateResult></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Validity of the Service
|
|
Response</h2>
|
|
|
|
<p>Clients SHOULD ensure that the response from the service to a Locate or
|
|
Validate operation is valid, meaning that the following criteria are met.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Authenticity</strong>: That the
|
|
response message was issued by a trusted Trust service</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Integrity</strong>: That the response
|
|
message has not been modified</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Correspondence</strong>: The response
|
|
from the Trust service corresponds to the request that was made to the
|
|
client.</p>
|
|
|
|
<p>The appropriate means of validating the service response is dependent on
|
|
the application. It is not necessary for the requests to be authenticated
|
|
with a digital signature if the client supports some other secure means of
|
|
communicating with the Trust service.</p>
|
|
|
|
<p>The authenticity, integrity and correspondence of the response SHOULD be
|
|
ensured using one or more of the following methods:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>Authenticating the response messages using the XML Signature
|
|
Specification.</li>
|
|
<li>Transport layer security (e.g. SSL, TLS, WTLS)</li>
|
|
<li>Packet layer security (e.g. IPSEC)</li>
|
|
</ul>
|
|
|
|
<p>In the case that signed response messages are employed, the means by which
|
|
the client determines that the signing key is trustworthy is outside the
|
|
scope of this specification. Possible mechanisms include:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>A root key embedded in the client application</li>
|
|
<li>A trustworthy signing key exchanged using mechanisms described in the
|
|
Tier 3 Trust Assertion Service Specification.</li>
|
|
<li>A signing key obtained using some other retrieval mechanism such as
|
|
DNSSEC, PKIX or SPKI.</li>
|
|
</ul>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Information Service
|
|
Message Set</h1>
|
|
|
|
<p>The protocol consists of pairs of messages, with an application sending a
|
|
request message to a trust service and the service responding with another
|
|
message. </p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Common Data Elements</h2>
|
|
|
|
<p>The content and format of messages are defined using the W3C XML Schema
|
|
specification [XML-Schema1][XML-Schema2]. All values are encoded as element
|
|
data. The XKMS specification itself uses only a restricted set of types, but
|
|
element values may potentially use any type definable within XML Schemas.
|
|
XKMS is compatible with the object serialization format defined within SOAP
|
|
(see Appendix A ) but does not use some aspects of that format. In
|
|
particular, sequences of elements are expressed as sequences of elements
|
|
without reference to the SOAP array encoding.</p>
|
|
|
|
<p>The following common data elements are used in the message set:</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Imported Elements</h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element is
|
|
defined in the XML Signature Specification schema and that specification
|
|
governs its format and use.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element
|
|
communicates data using both attributes and elements. Arbitrary extension
|
|
elements are permitted.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">AssertionStatus</h3>
|
|
|
|
<p>The enumerated type <span
|
|
style="FONT-FAMILY: Courier">AssertionStatus</span> is used to report the
|
|
status of an assertion such as a key binding. The following values are
|
|
defined:</p>
|
|
<dl>
|
|
<dt>Valid</dt>
|
|
<dd>The binding is definitively valid.</dd>
|
|
<dt>Invalid</dt>
|
|
<dd>The binding is definitively invalid.</dd>
|
|
<dt>Indeterminate</dt>
|
|
<dd>The status of the assertion cannot be determined.</dd>
|
|
</dl>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier">AssertionStatus</span> type is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><simpleType name="AssertionStatus"></p>
|
|
|
|
<p class="Code"> <restriction base="string"></p>
|
|
|
|
<p class="Code"> <enumeration value="Valid"/></p>
|
|
|
|
<p class="Code"> <enumeration value="Invalid"/></p>
|
|
|
|
<p class="Code"> <enumeration value="Indeterminate"/></p>
|
|
|
|
<p class="Code"> </restriction></p>
|
|
|
|
<p class="Code"></simpleType></p>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><status></span> element of
|
|
the <span style="FONT-FAMILY: Courier"><KeyBinding></span> element has
|
|
the type <span style="FONT-FAMILY: Courier">AssertionStatus</span>.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">RequestAbstractType</h3>
|
|
|
|
<blockquote>
|
|
<p class="Code" style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in"><complexType
|
|
name="RequestAbstractType" abstract="true"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:Respond" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
<attribute name="MajorVersion" type="integer" use="required"/><br
|
|
/>
|
|
<attribute name="MinorVersion" type="integer" use="required"/><br
|
|
/>
|
|
</complexType></p>
|
|
</blockquote>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Respond</h3>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><Respond></span> element in
|
|
the request specifies one or more strings included in the request that
|
|
specify data elements to be provided in the <span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span> element of the
|
|
response. Each string is a single identifier corresponding to a sub-element
|
|
of the XML Signature Specification <span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span> element [XML-SIG] or
|
|
the private key information defined in section 6.3.2. The XML Signature
|
|
elements are described here for convenience. The normative reference is the
|
|
specification [XML-SIG].</p>
|
|
|
|
<p>The Service SHOULD return a requested data element if it is available. The
|
|
Service MAY return additional data elements that were not requested. In
|
|
particular, the service MAY return data elements specified in the request
|
|
with the response.</p>
|
|
|
|
<p>Defined identifiers include:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="Structures and their Identifiers"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-LEFT: 3.65pt; BORDER-LEFT: medium none; WIDTH: 450.1pt; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellpadding="0" width="600" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="158"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal"><strong>Identifier</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="206"><p><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></strong></span>
|
|
<strong>Element</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="235"><p><strong>Description</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">KeyName</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:KeyName></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>Key Name</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">KeyValue</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:KeyValue></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>Public key parameters</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">X509Cert</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:X509Data></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">X509 Certificate
|
|
v3 that authenticates the specified key</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">X509Chain</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:X509Data>*</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>X509 Certificate v3 chain that
|
|
authenticates the specified key</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">X509CRL</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:X509Data></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>X509 Certificate Revocation List v2</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">OCSP</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:X509Data></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>PKIX OCSP token that validates an X509v3
|
|
certificate that authenticates the key</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">RetrievalMethod</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>Retrieval Method data</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">MgmtData</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:MgmtData></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>Management Data</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">PGP</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:PGPData></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>PGP key signing data</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">PGPWeb</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:PGPData>*</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p>Collection of PGP key signing data</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">SPKI</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p><span
|
|
style="FONT-FAMILY: Courier"><ds:SPKIData>*</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">SPKI key
|
|
signing</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">Multiple</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="206"><p> </p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="235"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">Specifies that
|
|
the Trust Service SHOULD return multiple answers to the client if
|
|
more than one valid answer is available.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.65in; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="158"><p><span
|
|
style="FONT-FAMILY: Courier">Private</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 2.15in; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="206"><p> </p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 176.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="235"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">Request that the
|
|
encrypted private key be returned in the response. [Used in the
|
|
X-KRSS protocol]</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p>For example, a client that has no X.509 processing capability might
|
|
perform a <span style="FONT-FAMILY: Courier">Locate</span> operation to
|
|
obtain the public key parameters and name information from a <span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span> element that specifies
|
|
only a certificate. The <span style="FONT-FAMILY: Courier">Respond</span>
|
|
element values in this case would be "<span
|
|
style="FONT-FAMILY: Courier">KeyName</span>" and "<span
|
|
style="FONT-FAMILY: Courier">KeyValue</span>".</p>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><Respond></span> element is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="Respond" type="string"/></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">ResultAbstractType</h3>
|
|
|
|
<blockquote>
|
|
<p class="Code" style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in"><complexType
|
|
name="ResultAbstractType" abstract="true"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:Result"/><br />
|
|
</sequence><br />
|
|
<attribute name="MajorVersion" type="integer" use="required"/><br
|
|
/>
|
|
<attribute name="MinorVersion" type="integer" use="required"/><br
|
|
/>
|
|
</complexType></p>
|
|
</blockquote>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <<span
|
|
class="ID">Result></span></h3>
|
|
|
|
<p>The enumerated type ResultCode is used to return result codes from each
|
|
interface. It has the following possible values:</p>
|
|
<dl>
|
|
<dt>Success</dt>
|
|
<dd>The operation succeeded.</dd>
|
|
<dt>NoMatch</dt>
|
|
<dd>No match was found for the search prototype provided.</dd>
|
|
<dt>Incomplete</dt>
|
|
<dd>Only part of the information requested could be provided.</dd>
|
|
<dt>Failure</dt>
|
|
<dd>The operation failed for unspecified reasons.</dd>
|
|
<dt>Refused</dt>
|
|
<dd>The operation was refused.</dd>
|
|
<dt>Pending</dt>
|
|
<dd>The operation was queued for future processing.</dd>
|
|
</dl>
|
|
|
|
<p>ResultCode is defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="Result" type="xkms:ResultCode"/></p>
|
|
|
|
<p class="Code"><simpleType name="ResultCode"><br />
|
|
<restriction base="string"><br />
|
|
<enumeration value="Success"/><br />
|
|
<enumeration value="NoMatch"/><br />
|
|
<enumeration value="NotFound"/><br />
|
|
<enumeration value="Incomplete"/><br />
|
|
<enumeration value="Failure"/><br />
|
|
<enumeration value="Refused"/><br />
|
|
<enumeration value="Pending"/><br />
|
|
</restriction><br />
|
|
</simpleType></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <Reason></h3>
|
|
|
|
<p>One or more strings that specify the reason(s) for a particular assertion
|
|
status.</p>
|
|
|
|
<p>If the Trust service returns the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">AssertionStatus</span></span> value <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Valid</span></span>, the <span
|
|
class="ID"><Reason></span> element lists the status aspects that have
|
|
been affirmatively verified to be <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Valid</span></span>. If the service returns the
|
|
<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">AssertionStatus</span></span> value <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Invalid</span></span> the
|
|
Reason element lists the aspects of status that have been determined to be
|
|
either <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Invalid</span></span> or <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Indeterminate</span></span>. If the service
|
|
returns the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">AssertionStatus</span></span> value <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Indeterminate</span></span> the
|
|
Reason element lists the aspects of status that have been determined to be
|
|
<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Indeterminate</span></span>.</p>
|
|
|
|
<p>[TBS use this in the schema!]</p>
|
|
|
|
<p>The status aspects are defined in the table below. For convenience the
|
|
equivalent X509 processing steps are given:</p>
|
|
|
|
<div align="center">
|
|
|
|
<center>
|
|
|
|
<table summary="Status and Description"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; WIDTH: 438pt; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellspacing="0" cellpadding="0" width="584" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.75in; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="168"><p><strong>Aspect</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 153.9pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="205"><p><strong>Description</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 158.1pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="211"><p><strong>X.509 Equivalent</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.75in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="168"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">IssuerTrust</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 153.9pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="205"><p>The assertion issuer is considered to be
|
|
trustworthy by the Trust service.</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 158.1pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="211"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">Certificate path
|
|
anchored by trusted root successfully constructed</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.75in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="168"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Status</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 153.9pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="205"><p>The Trust service has affirmatively
|
|
verified the status of the assertion with an authoritative source</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 158.1pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="211"><p>Certificate status validated using CRL or
|
|
OCSP</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.75in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="168"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">ValidityInterval</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 153.9pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="205"><p>The request was made within the validity
|
|
interval of the assertion</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 158.1pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="211"><p>The request was made at a time when the
|
|
certificate chain was valid</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.75in; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="168"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Signature</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 153.9pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="205"><p>Signature on signed data provided by the
|
|
client in the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element
|
|
(e.g. <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">X509Data</span></span> element) was
|
|
successfully verified.</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 158.1pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="211"><p>Certificate Signature verified</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</center>
|
|
</div>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Locate Service</h3>
|
|
|
|
<p>The Locate service accepts as input a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element that
|
|
specifies a public key and returns one or more <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> elements that
|
|
relate to the same public key. The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> elements
|
|
returned are specified by the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Respond</span></span> element in the request.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Request Message</h3>
|
|
|
|
<p>The request message consists of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Locate</span></span> element defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="LocateRequest"
|
|
type="xkms:LocateRequestType"/><br />
|
|
<complexType name="LocateRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:TransactionID" minOccurs="0"/><br />
|
|
<element ref="xkms:KeyInfoQuery"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType><br />
|
|
<element name="TransactionID" type="string"/><br />
|
|
<element name="KeyInfoQuery" type="ds:KeyInfoType"/></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Query</span></strong></span><br />
|
|
A single complex structure containing a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element that
|
|
specifies the public key for which additional data is requested.</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Respond</span></strong></span><br />
|
|
A sequence of identifiers that specify data elements that the client requests
|
|
returned in the response.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><LocateResult></span></span> element
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="LocateResult"
|
|
type="xkms:LocateResultType"/><br />
|
|
<complexType name="LocateResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:TransactionID" minOccurs="0"/><br />
|
|
<element ref="ds:KeyInfo" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Answer</span></strong></span><br />
|
|
A sequence of <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">strings</span></span> that contain <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> elements that
|
|
provide the information specified by the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Respond</span></span> attribute, for the public
|
|
key identified by the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Query</span></span> element.</p>
|
|
|
|
<p>The response message returns a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">ResultCode</span></span> depending on the
|
|
success of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Locate</span></span> operation as follows:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="Result Codes"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellpadding="0" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.15in; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="110"><p><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">ResultCode</span></strong></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="162"><p><strong>Number of Elements</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 210.25pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="280"><p><strong>Description</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="110"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Success</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>At least one element</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 210.25pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="280"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">The locate
|
|
operation succeeded. All the information requested was available.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="110"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">NoMatch</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>No elements</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 210.25pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="280"><p>The locate operation succeeded but returned
|
|
no matches.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.15in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="110"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Incomplete</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>At least one element</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 210.25pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="280"><p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">The locate
|
|
operation succeeded. Some of the information requested was not
|
|
available.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.15in; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="110"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Failure</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="162"><p>No elements</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 210.25pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="280"><p>The locate operation failed.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Faults</h3>
|
|
|
|
<p>TBS</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Validate Service</h2>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Validate</span></span> service allows the client
|
|
to query the binding between a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element and
|
|
other data such as an identifier. The client supplies a prototype for the
|
|
<span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> assertion
|
|
requested. The prototype may specify either a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyId></span></span> or a <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> element or
|
|
both. The server returns one or more <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> assertions that
|
|
meet the criteria specified in the request.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></h3>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><KeyBinding></span> element
|
|
asserts a binding between data elements that relate to a public key including
|
|
<span style="FONT-FAMILY: Courier"><KeyName></span>, <span
|
|
style="FONT-FAMILY: Courier"><KeyID></span>, <span
|
|
style="FONT-FAMILY: Courier"><KeyValue></span> and <span
|
|
style="FONT-FAMILY: Courier"><X509Data></span>. Furthermore, the
|
|
Service represents <em>to the client accessing the service and to that client
|
|
alone</em> that the binding between the data elements is <em>valid</em> under
|
|
whatever trust policy the service offers to that client.</p>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><Query></span> and <span
|
|
style="FONT-FAMILY: Courier"><Prototype></span> elements share the same
|
|
type definition as <span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span> which is defined by
|
|
the following schema:</p>
|
|
|
|
<p class="Code"><element name="KeyBinding"
|
|
type="xkms:KeyBindingType"/><br />
|
|
<complexType name="KeyBindingType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:TransactionID" minOccurs="0"/><br />
|
|
<element ref="xkms:Status"/><br />
|
|
<element ref="xkms:KeyID" minOccurs="0"/><br />
|
|
<element ref="ds:KeyInfo" minOccurs="0"/><br />
|
|
<element ref="xkms:PassPhrase" minOccurs="0"/><br />
|
|
<element ref="xkms:ProcessInfo" minOccurs="0"/><br />
|
|
<element ref="xkms:ValidityInterval" minOccurs="0"/><br />
|
|
<element ref="xkms:KeyUsage" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
<attribute name="Id" type="ID" use="optional"/><br />
|
|
</complexType></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <font
|
|
face="Courier"><Status></font></h3>
|
|
|
|
<blockquote>
|
|
<p class="Code" style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in"><element
|
|
name="Status" type="xkms:AssertionStatus"/></p>
|
|
</blockquote>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <font
|
|
face="Courier"><KeyId></font></h3>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><KeyId></span> element
|
|
specifies a URI identifier for the key. The URI MAY be a name (URN), a
|
|
locator (URL) or anything else permitted by the URI specification. The <span
|
|
style="FONT-FAMILY: Courier"><KeyId></span> element is distinct from
|
|
the <span style="FONT-FAMILY: Courier"><ds:KeyName></span> element of
|
|
<span style="FONT-FAMILY: Courier"><ds:Keyinfo></span> in that the
|
|
<span style="FONT-FAMILY: Courier"><KeyName></span> element is not
|
|
required to be a URI.</p>
|
|
|
|
<p>When the <span style="FONT-FAMILY: Courier"><KeyId></span> element
|
|
in a <span style="FONT-FAMILY: Courier"><KeyBinding></span> specifies a
|
|
URL a binding is asserted to the specified address and protocol. For example
|
|
if the URL specifies an email address it is asserted that the specified key
|
|
MAY be used by a security enhancement. Similarly a <span
|
|
style="FONT-FAMILY: Courier"><KeyId></span> contained in a <span
|
|
style="FONT-FAMILY: Courier"><Prototype></span> or <span
|
|
style="FONT-FAMILY: Courier"><Query></span> specifies an intention to
|
|
use the specified key with the protocol indicated.</p>
|
|
|
|
<p>The following table shows the correspondence between commonly used URL
|
|
prefixes and security bindings:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="URI Methods"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellpadding="0" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.95in; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="187"><p><strong>Method</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 290.7pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="388"><p><strong>Security Enhancement</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.95in; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="187"><p><span
|
|
style="FONT-FAMILY: Courier">https://<em>host</em>/<em>data</em></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 290.7pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="388"><p>SSL / TLS. Key is bound to the host name
|
|
<span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">host</span></em></span>.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 1.95in; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="187"><p><span
|
|
style="FONT-FAMILY: Courier">mailto://<em>user</em>@<em>host</em></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 290.7pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="388"><p>S/MIME email security, Key is bound to the
|
|
username <span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">user</span></em><span
|
|
style="FONT-FAMILY: Courier">@<em>host</em></span></span></p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><KeyId></span> element is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="KeyID" type="anyURI"/></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><PassPhrase></span></h3>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><PassPhrase></span> element
|
|
contains a MAC output value encoded as a base64 string.</p>
|
|
|
|
<p>On initial registration the <span
|
|
style="FONT-FAMILY: Courier"><PassPhrase></span> value is obtained by
|
|
first performing the MAC calculation on the pass phrase value, then
|
|
performing a second MAC calculation on the result.</p>
|
|
|
|
<p>To prove knowledge of the pass phrase in a subsequent revocation request
|
|
the <span style="FONT-FAMILY: Courier"><PassPhrase></span> value is
|
|
obtained by performing the MAC calculation on the pass phrase value.</p>
|
|
|
|
<p>Details of the MAC output value calculation are provided in section 6
|
|
below.</p>
|
|
|
|
<p class="Code"><element name="PassPhrase" type="string"/></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><ProcessInfo></span></h3>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><ProcessInfo></span> element
|
|
MAY be used to specify processing information associated with a key binding
|
|
that end clients SHOULD treat as opaque data. The element is defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="ProcessInfo"
|
|
type="xkms:ProcessInfoType"/></p>
|
|
|
|
<p class="Code"><complexType name="ProcessInfoType"><br />
|
|
<sequence minOccurs="0" maxOccurs="unbounded"><br />
|
|
<any namespace="##other"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><ValidityInterval></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ValidityInterval></span></span> element
|
|
specifies limits on the validity of the assertion. It is defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="ValidityInterval"
|
|
type="xkms:ValidityIntervalType"/><br />
|
|
<complexType name="ValidityIntervalType"><br />
|
|
<attribute name="xkms:NotBefore" type="dateTime"/><br />
|
|
<attribute name="xkms:NotOnOrAfter" type="dateTime"/><br />
|
|
</complexType></p>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier"><ValidityInterval></span>
|
|
element contains the following attributes.</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="Validity Interval Attributes"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; WIDTH: 83.62%; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellpadding="0" width="83%" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 20.42%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="20%"><p>Attribute</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.68%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="18%"><p>Type</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 60.9%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="60%"><p>Description</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 20.42%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="20%"><p><span
|
|
style="FONT-FAMILY: Courier">NotBefore</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.68%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="18%"><p><span
|
|
style="FONT-FAMILY: Courier">dateTime</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 60.9%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="60%"><p>Time instant at which the validity interval
|
|
begins</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 20.42%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="20%"><p><span
|
|
style="FONT-FAMILY: Courier">NotOnOrAfter</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.68%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="18%"><p><span
|
|
style="FONT-FAMILY: Courier">dateTime</span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 60.9%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="60%"><p>Time instant at which the validity interval
|
|
has ended</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p>All dateTime values MUST fully specify the date.</p>
|
|
|
|
<p>The <span style="FONT-FAMILY: Courier">NotBefore</span> and <span
|
|
style="FONT-FAMILY: Courier">NotAfter</span> attributes are optional. If the
|
|
value is omitted it is unspecified. If the <span
|
|
style="FONT-FAMILY: Courier">NotBefore</span> attribute is unspecified the
|
|
assertion is valid on any date up to but excluding the date specified in the
|
|
<span style="FONT-FAMILY: Courier">NotAfter</span> attribute . If the <span
|
|
style="FONT-FAMILY: Courier">NotAfter</span> attribute is unspecified the
|
|
assertion is valid from the <span
|
|
style="FONT-FAMILY: Courier">NotBefore</span> attribute with no expiry. If
|
|
neither element is specified the assertion is valid at any time.</p>
|
|
|
|
<p>In accordance with the XML Schema Specifications, all time instances are
|
|
interpreted in Universal Coordinated Time unless they explicitly indicate a
|
|
time zone.</p>
|
|
|
|
<p>Implementations MUST NOT generate time instances that specify leap
|
|
seconds.</p>
|
|
|
|
<p>For purposes of comparison, the time interval <span
|
|
style="FONT-FAMILY: Courier">NotBefore</span> to <span
|
|
style="FONT-FAMILY: Courier">NotAfter</span> begins at the earliest time
|
|
instant compatible with the specification of <span
|
|
style="FONT-FAMILY: Courier">NotBefore</span> and <em><u>has ended</u></em>
|
|
at the <em><u>earliest</u></em> time instant compatible with the
|
|
specification of <span style="FONT-FAMILY: Courier">NotAfter</span></p>
|
|
|
|
<p>For example if the time interval specified is <span class="ID"><em><span
|
|
style="FONT-FAMILY: Courier">day</span></em></span><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">T12:03:02</span></span> to <span
|
|
class="ID"><em><span style="FONT-FAMILY: Courier">day</span></em></span><span
|
|
class="ID"><span style="FONT-FAMILY: Courier">T12:05:12</span></span> the
|
|
times <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">12:03:02.00</span></span> and <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">12:05:11.9999</span></span> are
|
|
within the time interval. The time <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">12:05:12.0000</span></span> is outside the time
|
|
interval.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><KeyUsage></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyUsage></span></span> element specifies
|
|
one or more intended uses of the key. If no <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyUsage></span></span> is specified all
|
|
uses are permitted. The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyUsage></span></span> element is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="KeyUsage" type="xkms:KeyUsageType"/><br
|
|
/>
|
|
<simpleType name="KeyUsageType"><br />
|
|
<restriction base="string"><br />
|
|
<enumeration value="Encryption"/><br />
|
|
<enumeration value="Signature"/><br />
|
|
<enumeration value="Exchange"/><br />
|
|
</restriction><br />
|
|
</simpleType></p>
|
|
|
|
<p>If a key usage is specified that the algorithm does not support (e.g. use
|
|
of a DSA key for encryption) the element MUST be ignored.</p>
|
|
|
|
<p>The following identifiers are defined:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="Key Usage Identifiers"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; WIDTH: 82.38%; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellpadding="0" width="82%" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 22.7%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="22%"><p><strong>Identifier</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 77.3%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="77%"><p><strong>Description</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 22.7%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="22%"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Encryption</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 77.3%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="77%"><p>The key pair may be used for encryption and
|
|
decryption</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 22.7%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="22%"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Signature</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 77.3%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="77%"><p>The key pair may be used for signature and
|
|
verification</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 22.7%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="22%"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Exchange</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 77.3%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="77%"><p>The key pair may be used for key
|
|
exchange</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Request Message</h3>
|
|
|
|
<p>The request message consists of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><Validate></span></span> element defined
|
|
by the following schema:</p>
|
|
|
|
<p class="Code"><element name="ValidateRequest"
|
|
type="xkms:ValidateRequestType"/><br />
|
|
<complexType name="ValidateRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBindingQuery"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType><br />
|
|
<element name="KeyBindingQuery" type="xkms:KeyBindingType"/></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Query</span></strong></span><br />
|
|
A single <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></span> structure that is to be
|
|
completed and validated.</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Respond</span></strong></span><br />
|
|
A sequence of identifiers that specify data elements that the client requests
|
|
be returned in the response.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ValidateResult></span></span> element
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="ValidateResult"
|
|
type="xkms:ValidateResultType"/><br />
|
|
<complexType name="ValidateResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Answer</span></strong></span><br />
|
|
A sequence of <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> structures that
|
|
contain the results of the validation. If no results are found the sequence
|
|
is empty and the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ResultCode></span></span><span
|
|
class="ID"><span style="FONT-FAMILY: Courier">NoMatch</span></span> returned.
|
|
In some circumstances a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Locate</span></span> operation MAY return
|
|
multiple matching results.</p>
|
|
|
|
<p>The response message returns a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ResultCode></span></span> depending on
|
|
the success of the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Validate</span></span> operation as follows:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="Result Codes"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-LEFT: 2.9pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 86.55pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="115"><p><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">ResultCode</span></strong></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="162"><p><strong>Number of Elements</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 175.75pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="bottom" width="234"><p><strong>Description</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 86.55pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="115"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Success</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>At least one element</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 175.75pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="234"><p>The validate operation succeeded. all the
|
|
information requested was available.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 86.55pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="115"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">NoMatch</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>No elements</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 175.75pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="234"><p>The validate operation succeeded but
|
|
returned no matches.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 86.55pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="115"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Incomplete</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="162"><p>At least one element</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 175.75pt; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="234"><p>The validate operation succeeded. Some of
|
|
the information requested was not available.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 86.55pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="115"><p><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Failure</span></span></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 121.5pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="162"><p>No elements</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 175.75pt; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="234"><p>The validate operation failed.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p>Note that the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Validate</span></span> operation returns the
|
|
<span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ResultCode></span></span><span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Success</span></span> even if
|
|
the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> assertion was
|
|
found to be <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Invalid</span></span> or <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Indeterminate</span></span>. The <<span
|
|
class="ID"><span style="FONT-FAMILY: Courier">ResultCode></span></span>
|
|
reflects the success or failure of the service query and not the information
|
|
returned by that query.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Faults</h3>
|
|
|
|
<p>When the protocol is expressed in SOAP, all <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ResultCode></span></span> <span
|
|
class="ID">values</span> other than <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Success</span></span>, <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Incomplete</span></span> and <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">NoMatch</span></span> are
|
|
expressed using the SOAP <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Fault</span></span> element <span
|
|
class="ID">with a</span> <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">faultcode</span></span> <span
|
|
class="ID">of</span> <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">soap:Server</span></span><span class="ID">. See
|
|
the [SOAP] specification for further details.</span> The service MAY return
|
|
the descriptive text set out in section 3.3.8 above.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Registration Service
|
|
Protocol Overview</h1>
|
|
|
|
<p>The XML Key Registration Service Specification permits management of
|
|
information that is bound to a public key pair.</p>
|
|
|
|
<p>The service specification supports the following operation:</p>
|
|
|
|
<p class="Label"><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Register</span></strong></span><br />
|
|
Information is bound to a public key pair through a XKMS <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> element.
|
|
Generation of the public key pair by either the client or the server is
|
|
supported.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Register</span></span> request does not in
|
|
itself place any requirement on the Registration Service to communicate that
|
|
information to any other party.</p>
|
|
|
|
<p>In most applications, however, a Registration Service will provide key
|
|
information to other trust services such as those described in the XKMS
|
|
specification or a separate underlying PKI such as PKIX.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Linkage to an Underlying
|
|
PKI</h2>
|
|
|
|
<p>Linkage to such an underlying PKI is considered to be an intrinsic
|
|
property of the Registration Service rather than a parameter that the client
|
|
application may negotiate. To be useful such a negotiation service would need
|
|
to express more than the syntax of the credentials issued.</p>
|
|
|
|
<p>If necessary, Registration Services may offer links to multiple underlying
|
|
PKIs through separate service address URIs. For example:</p>
|
|
|
|
<p
|
|
style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in">http://register.xmltrustcenter.org/pgp<br
|
|
/>
|
|
Obtain a PGP credential</p>
|
|
|
|
<p
|
|
style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in">http://register.xmltrustcenter.org/x509/public_class2<br
|
|
/>
|
|
Obtain an X.509v3 credential in the "Trust Center Public Class 2"
|
|
hierarchy</p>
|
|
|
|
<p
|
|
style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in">http://register.xmltrustcenter.org/private/AKEHJQ<br
|
|
/>
|
|
Obtain an X.509v3 credential in a private hierarchy, the details of which the
|
|
client application does not understand</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:Keyinfo></span></span> elements <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:X509Data></span></span>, <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:PGPData></span></span> and <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:SPKIData></span></span> MAY be used to
|
|
return credentials issued in an underlying PKI. Alternatively the client may
|
|
request that a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ds:RetrievalMethod></span></span> element
|
|
be returned in the response to allow retrieval of the credential to be
|
|
generated (e.g. an X.509v3 certificate).</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Registration</h2>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Register</span></span> request is used to assert
|
|
a binding of information to a public key pair. Generation of the public key
|
|
pair MAY be performed by either the client or the Registration service.</p>
|
|
|
|
<p>The Registration request message consists of a prototype of the requested
|
|
assertion. The Registration Service MAY require the client to provide
|
|
additional information to authenticate the request. If the public key pair is
|
|
generated by the client, the service MAY require the client to provide Proof
|
|
of Possession of the private key.</p>
|
|
|
|
<p>The Registration service MAY accept the name specified in the prototype or
|
|
MAY substitute its own name.</p>
|
|
|
|
<p>On receipt of a registration request, the registration service verifies
|
|
the authentication and POP information provided (if any). If the registration
|
|
service accepts the request an assertion is registered. This assertion MAY
|
|
include some, all or none of the information provided by the prototype
|
|
assertion and MAY include additional information.</p>
|
|
|
|
<p>The Registration Service MAY return part or all of the registered
|
|
assertion to the client.</p>
|
|
|
|
<p style="TEXT-ALIGN: center" align="center"><img height="216"
|
|
alt="Diagram shows the data passed from the client to the server for registration"
|
|
src="./image010.gif" width="480" border="0" /></p>
|
|
|
|
<p class="Caption" align="center">Figure 5: Registration of a KeyBinding</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Registration of
|
|
Client-Generated Key Pair</h3>
|
|
|
|
<p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">Alice requests
|
|
registration of an RSA key pair for her email address <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Alice@cryptographer.test</span></span>. Alice
|
|
has previously received from the trust service the code "024837" with which
|
|
to authenticate her request. Alice selects the pass phrase "Help I have
|
|
revealed my key" to authenticate herself should it be necessary to revoke the
|
|
registration at a later date.</p>
|
|
|
|
<p class="BodyTextKeep"
|
|
style="PAGE-BREAK-AFTER: auto; LINE-HEIGHT: normal">The X-KRSS request
|
|
message consists of the following <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><Register></span></span> element:</p>
|
|
|
|
<p class="Example"><Register></p>
|
|
|
|
<p class="Example"> <Prototype Id="keybinding"></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> <ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7E</p>
|
|
|
|
<p class="Example">
|
|
fdxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</p>
|
|
|
|
<p class="Example"> </ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <PassPhrase><em><span
|
|
style="COLOR: red">Pass</span></em></PassPhrase></p>
|
|
|
|
<p class="Example"> </Prototype></p>
|
|
|
|
<p class="Example"> <AuthInfo></p>
|
|
|
|
<p class="Example"> <AuthUserInfo></p>
|
|
|
|
<p class="Example"> <ProofOfPossession></p>
|
|
|
|
<p class="Example"> <ds:Signature URI="#keybinding"</p>
|
|
|
|
<p class="Example"> [RSA-Sign (KeyBinding, Private)]
|
|
/></p>
|
|
|
|
<p class="Example"> </ProofOfPossession></p>
|
|
|
|
<p class="Example"> <KeyBindingAuth></p>
|
|
|
|
<p class="Example"> <ds:Signature URI="#keybinding"</p>
|
|
|
|
<p class="Example"> [HMAC-SHA1 (KeyBinding, Auth)] /></p>
|
|
|
|
<p class="Example"> </KeyBindingAuth></p>
|
|
|
|
<p class="Example"> </AuthUserInfo></p>
|
|
|
|
<p class="Example"> </AuthInfo></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName<string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> <string>RetrievalMethod</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Register></p>
|
|
|
|
<p>Where:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><em>Auth</em> = HMAC-SHA1 ("024837", 0x1)<br />
|
|
<em>Pass</em> = HMAC-SHA1 (HMAC-SHA1 ("<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">helpihaverevealedmykey</span></span>", 0x2),
|
|
0x3)</p>
|
|
|
|
<p>For clarity, the details of the signature elements are omitted. In each
|
|
case the signature scope is the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> element and the
|
|
signature scope is specified by reference. The MAC function used in this case
|
|
is HMAC-SHA1 as defined in [RFC-2104]. The notation <em>f(m, k)</em> is used
|
|
to indicate the message <em>m</em> signed under the key <em>k</em>. Further
|
|
details are provided in section 6.1 .</p>
|
|
|
|
<p>The service accepts the registration and returns the following
|
|
response:</p>
|
|
|
|
<p class="Example"><RegisterResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:RetrievalMethod</p>
|
|
|
|
<p class="Example">
|
|
URI="http://www.PKeyDir.test/Certificates/01293122"</p>
|
|
|
|
<p class="Example"> Type="<a
|
|
href="http://www.w3.org/2000/09/xmldsig#SPKIData"><span
|
|
style="COLOR: windowtext; TEXT-DECORATION: none">http://www.w3.org/2000/09/xmldsig#X509Data</span></a>"/></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7Ef</p>
|
|
|
|
<p class="Example">
|
|
dxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"></RegisterResult></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Registration of
|
|
Service-Generated Key Pair</h3>
|
|
|
|
<p>The request for registration of a service generated key pair omits the
|
|
public key data and requests that private key data be returned with the
|
|
response.</p>
|
|
|
|
<p class="Example"><Register></p>
|
|
|
|
<p class="Example"> <Prototype Id="keybinding"></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </KeyInfo></p>
|
|
|
|
<p class="Example"> <PassPhrase><em><span
|
|
style="COLOR: red">Pass</span></em></PassPhrase></p>
|
|
|
|
<p class="Example"> </Prototype></p>
|
|
|
|
<p class="Example"> <AuthInfo></p>
|
|
|
|
<p class="Example"> <AuthServerInfo></p>
|
|
|
|
<p class="Example"> <KeyBindingAuth></p>
|
|
|
|
<p class="Example"> <ds:Signature URI="#keybinding"</p>
|
|
|
|
<p class="Example"> <em>[HMAC-SHA1 (Prototype, Auth)]</em>
|
|
/></p>
|
|
|
|
<p class="Example"> </KeyBindingAuth></p>
|
|
|
|
<p class="Example"> </AuthServerInfo></p>
|
|
|
|
<p class="Example"> </AuthInfo></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> <string>Private</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Register></p>
|
|
|
|
<p>Where</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><em>Auth</em> = HMAC-SHA1 ("<span
|
|
class="ID"><span style="FONT-FAMILY: Courier">024837</span></span>", 0x1)<br
|
|
/>
|
|
<em>Pass</em> = HMAC-SHA1 (HMAC-SHA1 ("<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">helpihaverevealedmykey</span></span>", 0x2),
|
|
0x3)</p>
|
|
|
|
<p>The response includes both the public key data and the encrypted private
|
|
key:</p>
|
|
|
|
<p class="Example"><RegisterResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <KeyBinding></p>
|
|
|
|
<p class="Example"> <Status>Valid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oY</p>
|
|
|
|
<p class="Example">
|
|
q7EfdxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</p>
|
|
|
|
<p class="Example"> </ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <KeyBinding></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"> <Private> Base64 ( 3DES ( <em>RSAPrivate</em>,
|
|
<em>Enc</em>)) </Private></p>
|
|
|
|
<p class="Example"></RegisterResult></p>
|
|
|
|
<p>Where:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><em>Enc</em> = HMAC-SHA1 ("<span
|
|
class="ID"><span style="FONT-FAMILY: Courier">024837</span></span>", 0x4)<br
|
|
/>
|
|
<em>RSAPrivate</em> =</p>
|
|
|
|
<p class="Example"><RSAKeyPair></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7EfdxSXAidr</p>
|
|
|
|
<p class="Example"> uAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw
|
|
</ds:Modulus></p>
|
|
|
|
<p class="Example"> <PublicExponent>AQAB</PublicExponent></p>
|
|
|
|
<p class="Example">
|
|
<PrivateExponent><em>whatever</em></PrivateExponent></p>
|
|
|
|
<p class="Example"> <P><em>whatever</em></P></p>
|
|
|
|
<p class="Example"> <Q><em>whatever</em></Q></p>
|
|
|
|
<p class="Example"></RSAKeyPair></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Revocation</h2>
|
|
|
|
<p>A Registration service MAY permit clients to revoke previously issued
|
|
assertions. A revocation request is made in the same manner as the initial
|
|
registration of a key except that:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The status of the
|
|
<span class="ID"><span style="FONT-FAMILY: Courier">KeyBinding</span></span>
|
|
or <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">KeyAssertion</span></span> prototype is <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Invalid</span></span>.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> If the Registration
|
|
service has no record of the assertion the result code <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">NotFound</span></span> is returned.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Revocation</h3>
|
|
|
|
<p>For some reason Alice requests the Registration Service revoke the binding
|
|
for her public key. Alice authenticates herself using by signing her request
|
|
with the corresponding private key. Alice could have used the pass phrase she
|
|
established during registration instead.</p>
|
|
|
|
<p>The request message is:</p>
|
|
|
|
<p class="Example"><Register></p>
|
|
|
|
<p class="Example"> <Prototype Id="keybinding"></p>
|
|
|
|
<p class="Example"> <Status>Invalid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyId></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7E</p>
|
|
|
|
<p class="Example">
|
|
fdxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Prototype></p>
|
|
|
|
<p class="Example"> <AuthInfo></p>
|
|
|
|
<p class="Example"> <AuthUserInfo></p>
|
|
|
|
<p class="Example"> <ProofOfPossession></p>
|
|
|
|
<p class="Example"> <ds:Signature URI="#keybinding"</p>
|
|
|
|
<p class="Example"> [RSA-Sign (KeyBinding, Private)]
|
|
/></p>
|
|
|
|
<p class="Example"> </ProofOfPossession></p>
|
|
|
|
<p class="Example"> </AuthUserInfo></p>
|
|
|
|
<p class="Example"> </AuthInfo></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Register></p>
|
|
|
|
<p>The service responds that the key binding has been revoked:</p>
|
|
|
|
<p class="Example"><RequestResult></p>
|
|
|
|
<p class="Example"> <Result>Success</Result></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <Status>Invalid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7E</p>
|
|
|
|
<p class="Example">
|
|
fdxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"></RegisterResult></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Recovery</h2>
|
|
|
|
<p>A Registration service MAY permit clients to request key recovery. A key
|
|
recovery request is made in the same manner as the initial registration of a
|
|
key except that:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The key recovery
|
|
service is likely to require time to respond to the recovery request and MAY
|
|
return a <<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">ResultCode></span></span> of <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">Pending</span></span>.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> If the Registration
|
|
service has no record of the assertion the result code <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">NotFound</span></span> is returned.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Example: Key Recovery</h3>
|
|
|
|
<p>Alice has forgotten the private key she registered earlier. She first
|
|
contacts the administrator of the key recovery service using an out-of-band
|
|
authentication procedure determined by site policy. The key recovery
|
|
administrator issues to Alice (using an out of band method) the key recovery
|
|
authorization code "A8C8S H93HU C9H29 8Y43U H9J3 I23". In this case the code
|
|
is read over the telephone and so it would be inconvenient to be required to
|
|
specify spacing between the code blocks or capitalization.</p>
|
|
|
|
<p>The request parameters for the key recovery are:</p>
|
|
|
|
<p class="Example"><Register></p>
|
|
|
|
<p class="Example"> <Prototype></p>
|
|
|
|
<p class="Example"> <Status>Indeterminate</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyId></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Prototype></p>
|
|
|
|
<p class="Example"> <AuthInfo></p>
|
|
|
|
<p class="Example"> <PassPhraseAuth><em><span
|
|
style="COLOR: red">Auth</span></em></PassPhraseAuth></p>
|
|
|
|
<p class="Example"> </AuthInfo></p>
|
|
|
|
<p class="Example"> <Respond></p>
|
|
|
|
<p class="Example"> <string>KeyName</string></p>
|
|
|
|
<p class="Example"> <string>KeyValue</string></p>
|
|
|
|
<p class="Example"> <string>Private</string></p>
|
|
|
|
<p class="Example"> </Respond></p>
|
|
|
|
<p class="Example"></Register></p>
|
|
|
|
<p>Where</p>
|
|
|
|
<p> <em>Auth</em> = HMAC-SHA1 ("<span class="ID"><span
|
|
style="FONT-FAMILY: Courier">a8c8sh93huc9h298y43uh9j3i23</span></span>",
|
|
0x1)</p>
|
|
|
|
<p>The registration service policy is to revoke a private key whenever key
|
|
recovery is performed. The service returns the revoked key binding and the
|
|
private key parameters:</p>
|
|
|
|
<p class="Example"><RegisterResult></p>
|
|
|
|
<p class="Example"> <Answer></p>
|
|
|
|
<p class="Example"> <Status>Invalid</Status></p>
|
|
|
|
<p class="Example">
|
|
<KeyID>mailto:Alice@cryptographer.test</KeyID></p>
|
|
|
|
<p class="Example"> <ds:KeyInfo></p>
|
|
|
|
<p class="Example"> <ds:KeyValue></p>
|
|
|
|
<p class="Example"> <ds:RSAKeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7E</p>
|
|
|
|
<p class="Example">
|
|
fdxSXAidruAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</ds:Modulus></p>
|
|
|
|
<p class="Example">
|
|
<ds:Exponent>AQAB</ds:Exponent></p>
|
|
|
|
<p class="Example"> </ds:RSAKeyValue></p>
|
|
|
|
<p class="Example"> </ds:KeyValue></p>
|
|
|
|
<p class="Example">
|
|
<ds:KeyName>mailto:Alice@cryptographer.test</ds:KeyName></p>
|
|
|
|
<p class="Example"> </ds:KeyInfo></p>
|
|
|
|
<p class="Example"> </Answer></p>
|
|
|
|
<p class="Example"> <Private> Base64 ( 3DES ( <em>RSAPrivate</em>,
|
|
<em>Enc</em>)) </Private></p>
|
|
|
|
<p class="Example"></RegisterResult></p>
|
|
|
|
<p>Where:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><em>Enc</em> = HMAC-SHA1 ("<span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier">a8c8sh93huc9h298y43uh9j3i23</span></span>",
|
|
0x4)<br />
|
|
<em>RSAPrivate</em> = "</p>
|
|
|
|
<p class="Example"><RSAKeyPair></p>
|
|
|
|
<p class="Example">
|
|
<ds:Modulus>998/T2PUN8HQlnhf9YIKdMHHGM7HkJwA56UD0a1oYq7EfdxSXAidr</p>
|
|
|
|
<p class="Example"> uAszNqBoOqfarJIsfcVKLob1hGnQ/l6xw</ds:Modulus></p>
|
|
|
|
<p class="Example"> <PublicExponent>AQAB</PublicExponent></p>
|
|
|
|
<p class="Example">
|
|
<PrivateExponent><em>whatever</em></PrivateExponent></p>
|
|
|
|
<p class="Example"> <P><em>whatever</em></P></p>
|
|
|
|
<p class="Example"> <Q><em>whatever</em></Q></p>
|
|
|
|
<p class="Example"></RSAKeyPair>"</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Request Authentication</h2>
|
|
|
|
<p>The Service SHOULD ensure that all requests are valid.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Authenticity</strong>: The request
|
|
message originated from the specified party.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Integrity</strong>: The request
|
|
message has not been modified.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.25in"><strong>Possession</strong>: If a public key
|
|
is specified in a registration request, proof that the request is authorized
|
|
by a party that has access to the corresponding private key.</p>
|
|
|
|
<p>Registration services set their own authentication policy. This
|
|
specification defines an authentication mechanism that employs a shared
|
|
secret established out of band between the client and the Registration
|
|
Service.</p>
|
|
|
|
<p>Services SHOULD require that clients demonstrate Proof of Possession of
|
|
the private key components of a public key if a request is made to register a
|
|
valid assertion bound to that public key.</p>
|
|
|
|
<p>Services SHOULD accept Proof of Possession of the private key component of
|
|
a public key to effect revocation of any assertion bound to that key.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Key Registration Service
|
|
Message Set</h1>
|
|
|
|
<p>The protocol operations consist of a remote procedure call that consists
|
|
of a single request message sent by the client to the Registration Service
|
|
followed by a single response message sent by the server to the client. </p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Registration</h2>
|
|
|
|
<p>The Request message specifies a <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><Prototype></span></span> element that has
|
|
the type <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></span> and provides the
|
|
prototype for the key binding to be registered.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><Prototype></span></span> element may
|
|
contain only partial information, a key without a name or a name without a
|
|
key. In this case, the client is requesting that the Registration Service
|
|
provide the additional information required to complete the binding.</p>
|
|
|
|
<p>For example, the client may not specify the public key parameters because
|
|
the public and private key pair is to be generated by the Registration
|
|
Service.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><Auth</span><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Info></span></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthInfo></span></span> element contains
|
|
data that authenticates the request. The form of the authentication data
|
|
depends upon:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The means of
|
|
authentication used;</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The public key
|
|
algorithm used; and</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The party that
|
|
generates the key pair (client or service).</p>
|
|
|
|
<p>The information MAY include a proof of possession for a public key that is
|
|
registered and MAY include information that authenticates the request through
|
|
a cryptographic binding to the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Prototype</span></span> element.</p>
|
|
|
|
<p>If the private key is generated by the user the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthInfo></span></span> element contains
|
|
an <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthUserInfo></span></span> element. If
|
|
the private key is generated by the Trust Service the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthInfo></span></span> element contains
|
|
an <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthServerInfo></span></span> element as
|
|
described in the following schema:</p>
|
|
|
|
<p class="Code"><element name="AuthInfo" type="xkms:AuthInfoType"/><br
|
|
/>
|
|
<complexType name="AuthInfoType"><br />
|
|
<choice><br />
|
|
<element ref="xkms:AuthUserInfo"/><br />
|
|
<element ref="xkms:AuthServerInfo"/><br />
|
|
</choice><br />
|
|
</complexType></p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthUserInfo></span></span> and <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthServerInfo></span></span> elements
|
|
are defined in section 6 below.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Register Request Message</h3>
|
|
|
|
<p>The request message consists of the <span
|
|
style="FONT-FAMILY: Courier"><RegisterRequest></span> element defined
|
|
by the following schema:</p>
|
|
|
|
<p class="Code"><element name="RegisterRequest"
|
|
type="xkms:RegisterRequestType"/><br />
|
|
<complexType name="RegisterRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:Prototype"/><br />
|
|
<element ref="xkms:AuthInfo"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Prototype</span></strong></span></dt>
|
|
<dd>A single <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></span> structure that
|
|
specifies elements that the client requests be registered.</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">AuthInfo</span></strong></span></dt>
|
|
<dd>An XML document node that provides information that authenticates the
|
|
request.</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Register Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span
|
|
style="FONT-FAMILY: Courier"><RegisterResult></span> element defined by
|
|
the following schema:</p>
|
|
|
|
<p class="Code"><element name="RegisterResult"
|
|
type="xkms:RegisterResultType"/><br />
|
|
<complexType name="RegisterResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
<element ref="xkms:Private" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType><br />
|
|
<element name="Prototype" type="xkms:KeyBindingType"/></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></strong></span>
|
|
(Optional)</dt>
|
|
<dd>If present specifies the key binding that was registered by the
|
|
service</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Private</span></strong></span> (Optional)</dt>
|
|
<dd>Additional information provided by the server that MAY provide values
|
|
for private key parameters generated by the Registration Service</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Reissue Request Message</h3>
|
|
|
|
<p>The request message consists of the <span
|
|
style="FONT-FAMILY: Courier"><ReissueRequest></span> element defined by
|
|
the following schema:</p>
|
|
|
|
<p class="Code"><element name="ReissueRequest"
|
|
type="xkms:ReissueRequestType"/><br />
|
|
<complexType name="ReissueRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding"/><br />
|
|
<element ref="xkms:AuthUserInfo"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Prototype</span></strong></span></dt>
|
|
<dd>A single <span style="FONT-FAMILY: Courier">KeyBinding</span>
|
|
structure that specifies elements that the client requests be
|
|
registered.</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">AuthInfo</span></strong></span></dt>
|
|
<dd>An XML document node that provides information that authenticates the
|
|
request.</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Reissue Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span
|
|
style="FONT-FAMILY: Courier">RegisterResult</span> element defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="ReissueResult"
|
|
type="xkms:ReissueResultType"/><br />
|
|
<complexType name="ReissueResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><strong>KeyBinding</strong></span></span>
|
|
<strong>(Optional)</strong></dt>
|
|
<dd>If present specifies the key binding that was registered by the
|
|
service</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Revoke Request Message</h3>
|
|
|
|
<p>The request message consists of the <span
|
|
style="FONT-FAMILY: Courier"><RevokeRequest></span> element defined by
|
|
the following schema:</p>
|
|
|
|
<p class="Code"><element name="RevokeRequest"
|
|
type="xkms:RevokeRequestType"/><br />
|
|
<complexType name="RevokeRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding"/><br />
|
|
<element ref="xkms:AuthUserInfo"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Prototype</span></strong></span></dt>
|
|
<dd>A single <span style="FONT-FAMILY: Courier">KeyBinding</span>
|
|
structure that specifies elements that the client requests be
|
|
registered.</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">AuthInfo</span></strong></span></dt>
|
|
<dd>An XML document node that provides information that authenticates the
|
|
request.</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Revoke Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span
|
|
style="FONT-FAMILY: Courier"><Revoke</span><span
|
|
style="FONT-FAMILY: Courier">Result></span> element defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="RevokeResult"
|
|
type="xkms:RevokeResultType"/><br />
|
|
<complexType name="RevokeResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></strong></span>
|
|
(Optional)</dt>
|
|
<dd>If present specifies the key binding that was registered by the
|
|
service</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Private</span></strong></span> (Optional)</dt>
|
|
<dd>Additional information provided by the server that MAY provide values
|
|
for private key parameters generated by the Registration Service</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Recover Request Message</h3>
|
|
|
|
<p>The request message consists of the <span
|
|
style="FONT-FAMILY: Courier"><RecoverRequest></span> element defined by
|
|
the following schema:</p>
|
|
|
|
<p class="Code"><element name="RecoverRequest"
|
|
type="xkms:RecoverRequestType"/><br />
|
|
<complexType name="RecoverRequestType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:RequestAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding"/><br />
|
|
<element ref="xkms:AuthUserInfo"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Prototype</span></strong></span></dt>
|
|
<dd>A single <span style="FONT-FAMILY: Courier">KeyBinding</span>
|
|
structure that specifies elements that the client requests be
|
|
registered.</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">AuthInfo</span></strong></span></dt>
|
|
<dd>An XML document node that provides information that authenticates the
|
|
request.</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Recover Response Message</h3>
|
|
|
|
<p>The Response Message consists of a <span
|
|
style="FONT-FAMILY: Courier">RecoverResult</span> element defined by the
|
|
following schema:</p>
|
|
|
|
<p class="Code"><element name="RecoverResult"
|
|
type="xkms:RecoverResultType"/><br />
|
|
<complexType name="RecoverResultType"><br />
|
|
<complexContent><br />
|
|
<extension base="xkms:ResultAbstractType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBinding" minOccurs="0"
|
|
maxOccurs="unbounded"/><br />
|
|
<element ref="xkms:Private" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</extension><br />
|
|
</complexContent><br />
|
|
</complexType></p>
|
|
|
|
<p>The following elements are defined:</p>
|
|
<dl>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">KeyBinding</span></strong></span>
|
|
(Optional)</dt>
|
|
<dd>If present specifies the key binding that was registered by the
|
|
service</dd>
|
|
<dt><span class="ID"><strong><span
|
|
style="FONT-FAMILY: Courier">Private</span></strong></span> (Optional)</dt>
|
|
<dd>Additional information provided by the server that MAY provide values
|
|
for private key parameters generated by the Registration Service</dd>
|
|
</dl>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Faults</h3>
|
|
|
|
<p>When the protocol is expressed in SOAP, all <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">ResultCode</span></span> <span
|
|
class="ID">values</span> other than <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Success</span></span>, <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Incomplete</span></span> and <span
|
|
class="ID"><span style="FONT-FAMILY: Courier">NoMatch</span></span> are
|
|
expressed using the SOAP <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">Fault</span></span> element <span
|
|
class="ID">with a</span> <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">faultcode</span></span> <span
|
|
class="ID">of</span> <span class="ID"><span
|
|
style="FONT-FAMILY: Courier">soap:Server</span></span><span class="ID">. See
|
|
the [SOAP] specification for further details.</span> The service MAY return
|
|
the descriptive text set out in section 3.2.2 above.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Cryptographic Algorithm
|
|
Specific Parameters</h1>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Use of Limited-Use Shared
|
|
Secret Data</h2>
|
|
|
|
<p>It is frequently necessary or desirable to use a limited use shared secret
|
|
for authentication (i.e. a one time use PIN or pass phrase) to authenticate
|
|
registration request messages. In particular a private key cannot be used for
|
|
authentication until the corresponding public key has been registered.</p>
|
|
|
|
<p>In addition it is desirable that private key parameters generated or
|
|
recovered by the registration service be returned encrypted. It is convenient
|
|
to use symmetric data for this purpose.</p>
|
|
|
|
<p>Since human users are the most demanding in terms of interface
|
|
requirements the handling of symmetric key data is designed for the needs of
|
|
clients supporting human users directly. Symmetric keying data is typically
|
|
issued to a human user in the form of a text string which may in some
|
|
circumstances be read over a telephone line. The authentication data itself
|
|
MAY be randomly generated and represent an underlying numeric value, or MAY
|
|
be a password or phrase. In either case it is most convenient to present the
|
|
value to the human user as a string of characters in a character set the
|
|
particular user understands.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> All shared string
|
|
values are encoded as XML</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> All space and
|
|
control characters are removed.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> All upper case
|
|
characters in the Latin-1 alphabet (A-Z) are converted to lower case.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> No other
|
|
characters, including accented characters are converted</p>
|
|
|
|
<p>Keying material is derived from the shared string using a MAC function.
|
|
Different MAC keying values are used according to the use of the symmetric
|
|
key derived as follows:</p>
|
|
|
|
<div align="center">
|
|
|
|
<table summary="MAC Keyring Values"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; WIDTH: 73.38%; BORDER-BOTTOM: medium none; BORDER-COLLAPSE: collapse"
|
|
cellspacing="0" cellpadding="0" width="73%" border="1">
|
|
<tbody>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.28%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="18%"><p style="TEXT-ALIGN: center"
|
|
align="center"><strong>Value</strong></p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: green 1.5pt solid; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 81.72%; PADDING-TOP: 0in; BORDER-BOTTOM: green 0.75pt solid"
|
|
valign="top" width="81%"><p style="TEXT-ALIGN: center"
|
|
align="center"><strong>Application</strong></p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.28%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="18%"><p style="TEXT-ALIGN: center"
|
|
align="center">0x1</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 81.72%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="81%"><p>Authentication</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.28%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="18%"><p style="TEXT-ALIGN: center"
|
|
align="center">0x2</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 81.72%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="81%"><p>Encoding of Pass Phrase - Pass 1</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.28%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="18%"><p style="TEXT-ALIGN: center"
|
|
align="center">0x3</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 81.72%; PADDING-TOP: 0in; BORDER-BOTTOM: medium none"
|
|
valign="top" width="81%"><p>Encoding of Pass Phrase - Pass 2</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 18.28%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="18%"><p style="TEXT-ALIGN: center"
|
|
align="center">0x4</p>
|
|
</td>
|
|
<td
|
|
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 5.4pt; BORDER-TOP: medium none; PADDING-LEFT: 5.4pt; PADDING-BOTTOM: 0in; BORDER-LEFT: medium none; WIDTH: 81.72%; PADDING-TOP: 0in; BORDER-BOTTOM: green 1.5pt solid"
|
|
valign="top" width="81%"><p>Encryption of private key data</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
<p>If the output of the MAC function provides more keying material than is
|
|
required for a cryptographic operation (i.e. encryption, MAC), the lowest
|
|
significant bits are used.</p>
|
|
|
|
<p>If the output of the MAC function provides less keying material than is
|
|
required the first MAC output value is used to supply the least significant
|
|
160 bits of keying material. A second MAC output value is then obtained by
|
|
applying the MAC function to the shared string again, this time the MAC
|
|
keying value is obtained by XOR-ing the first output with the previous keying
|
|
value. This process may be repeated as many times as necessary to produce a
|
|
sufficient amount of keying material.</p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><PassPhraseAuth></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><PassPhraseAuth></span></span> element
|
|
contains a plaintext limited use shared secret that is used to authenticate
|
|
the request.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><PassPhraseAuth></span></span> element is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="PassPhraseAuth" type="string"/></p>
|
|
|
|
<p><strong>NB: This element is provided to support applications in which the
|
|
authentication scheme requires the server to have plaintext access to the
|
|
authentication data. The authentication data is not securely bound to the
|
|
request and thus the element MUST NOT be employed except in circumstances
|
|
where the message or transport protocol provides adequate protection of both
|
|
confidentiality and integrity. See section 7.3 below for more
|
|
details.</strong></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span class="ID"
|
|
style="FONT-FAMILY: Courier"><KeyBindingAuth</span><span class="ID"><span
|
|
style="FONT-FAMILY: Courier">></span></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBindingAuth></span></span> element
|
|
contains a XML Signature element that is used to authenticate the <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> request using a
|
|
previously established key. The signature scope is the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> prototype using
|
|
the public key that is to be registered.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBindingAuth></span></span> element is
|
|
defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="KeyBindingAuth"
|
|
type="xkms:KeyBindingAuthType"/><br />
|
|
<complexType name="KeyBindingAuthType"><br />
|
|
<sequence><br />
|
|
<element ref="ds:Signature" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Element <span
|
|
style="FONT-FAMILY: Courier"><ProofOfPossession></span></h3>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ProofOfPossession></span></span> element
|
|
contains a XML Signature element. The signature scope is the <span
|
|
class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> prototype using
|
|
the public key that is to be registered. The private key component of the
|
|
public key contained within the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><KeyBinding></span></span> is used to
|
|
generate the signature.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><ProofOfPossession></span></span> element
|
|
is defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="ProofOfPossession"
|
|
type="xkms:ProofOfPossessionType"/><br />
|
|
<complexType name="ProofOfPossessionType"><br />
|
|
<sequence><br />
|
|
<element ref="ds:Signature" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Registration of User-Generated
|
|
RSA or DSA Keys</h2>
|
|
|
|
<p>If an RSA or DSA key pair generated by the user is to be registered, the
|
|
registration service MAY be required by its registration policy to ensure
|
|
that:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The party that made
|
|
the request has possession of the specified private key</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The party that made
|
|
the request is authorized to assert the specified binding to a public key.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthUserInfoType></span></span> element
|
|
type has the following schema definition:</p>
|
|
|
|
<p class="Code"><element name="AuthUserInfo"
|
|
type="xkms:AuthUserInfoType"/><br />
|
|
<complexType name="AuthUserInfoType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:ProofOfPossession" minOccurs="0"/><br />
|
|
<element ref="xkms:KeyBindingAuth" minOccurs="0"/><br />
|
|
<element ref="xkms:PassPhraseAuth" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Registration of
|
|
Service-Generated RSA Keys</h2>
|
|
|
|
<p>If the RSA key pair is generated by the registration service the
|
|
registration MAY be required by its registration policy to ensure that:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> The party that made
|
|
the request is authorized to assert the specified binding to a public key.</p>
|
|
|
|
<p>In addition the Registration Service MUST communicate the private key
|
|
parameters to the user. The Registration Service SHOULD ensure that the
|
|
confidentiality of the private key is protected.</p>
|
|
|
|
<p>The <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><AuthServerInfo></span></span> element is
|
|
used for this request as defined by the following schema:</p>
|
|
|
|
<p class="Code"><element name="AuthServerInfo"
|
|
type="xkms:AuthServerInfoType"/><br />
|
|
<complexType name="AuthServerInfoType"><br />
|
|
<sequence><br />
|
|
<element ref="xkms:KeyBindingAuth" minOccurs="0"/><br />
|
|
<element ref="xkms:PassPhraseAuth" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<p>Registration of service-generated DSA keys is not supported. A DSA key can
|
|
only be used for signature. Key recovery of signature keys has only limited
|
|
application. The principal reason to perform server generation of key pairs
|
|
is to support Key Recovery. </p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Encoding of RSA Private Key
|
|
Parameters</h3>
|
|
|
|
<p>The service MAY return the RSA public and private key parameters to the
|
|
client.</p>
|
|
|
|
<p>The public and private parameters for the RSA algorithm are generated from
|
|
the parameters <em>p</em> and <em>q</em>. Although private key operations may
|
|
be performed using the private modulus alone knowledge of the generator
|
|
parameters permits optimizations such as the Chinese Remainder Theorem to be
|
|
applied. Accordingly the private key element permits these to be
|
|
specified.</p>
|
|
|
|
<p>The XML schema for this structure is:</p>
|
|
|
|
<p class="Code"><element name="Private" type="ds:CryptoBinary"/><br />
|
|
<element name="RSAKeyPair" type="xkms:RSAKeyPairType"/><br />
|
|
<complexType name="RSAKeyPairType"><br />
|
|
<sequence><br />
|
|
<element name="Modulus" type="ds:CryptoBinary"/><br />
|
|
<element name="PublicExponent" type="ds:CryptoBinary"/><br />
|
|
<element name="PrivateExponent" type="ds:CryptoBinary"/><br />
|
|
<element name="P" type="ds:CryptoBinary" minOccurs="0"/><br />
|
|
<element name="Q" type="ds:CryptoBinary" minOccurs="0"/><br />
|
|
</sequence><br />
|
|
</complexType></p>
|
|
|
|
<h3 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Encryption of Private Key
|
|
Parameters</h3>
|
|
|
|
<p style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">The Private Key Parameters are
|
|
encrypted using the XML Encryption specification [XML-ENC].</p>
|
|
|
|
<p style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">[TBS give examples, specify
|
|
keying arrangements]</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Security Considerations</h1>
|
|
|
|
<p>Implementations SHOULD consider the following security issues.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Replay Attacks</h2>
|
|
|
|
<p>Implementations SHOULD ensure that replay of a previous XKMS response is
|
|
not possible.</p>
|
|
|
|
<p>The precise mechanism by which replay attacks are prevented is left to the
|
|
implementation. For example generic mechanism built into the object exchange
|
|
protocol if specified MAY be used.</p>
|
|
|
|
<p>A generally applicable means of preventing a replay attack is to place a
|
|
token in each message that demonstrates to the recipient that the message is
|
|
'fresh', for example:</p>
|
|
<ul style="MARGIN-TOP: 0in" type="disc">
|
|
<li>A message origination time that the recipient verifies by checking that
|
|
it is sufficiently recent.</li>
|
|
<li>A nonce, that is a piece of random data that was previously issued by
|
|
the user.</li>
|
|
<li>A message serial number</li>
|
|
</ul>
|
|
|
|
<p>Freshness tokens MAY be encoded as XML Signature Properties.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Denial of Service</h2>
|
|
|
|
<p>Trust Services SHOULD take measures to prevent or mitigate denial of
|
|
service attacks. In particular Trust Services SHOULD NOT perform an unlimited
|
|
number of resource intensive operations unless the request comes from an
|
|
authenticated source. Potentially resource intensive operations include:</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> CPU intensive
|
|
cryptographic operations, including signature verification and key
|
|
exchange.</p>
|
|
|
|
<p style="MARGIN-LEFT: 0.5in; TEXT-INDENT: -0.25in"><span
|
|
style="FONT-FAMILY: Symbol">·<span
|
|
style="FONT: 7pt 'Times New Roman'"> </span></span> Resolution of
|
|
URLs.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Recovery Policy</h2>
|
|
|
|
<p>Key recovery policy is left as an implementation decision.</p>
|
|
|
|
<p>Depending on the implementation and application a key recovery operation
|
|
MAY involve an unacceptable loss of confidence in the security of a private
|
|
key component. This may lead to the possibility of repudiation of a signed
|
|
document or of accountability in the case of an encrypted document.</p>
|
|
|
|
<p>Services SHOULD carefully assess the extent to which a recovery operation
|
|
compromises a private key and apply sufficient controls such as the
|
|
revocation of the underlying key binding as appropriate.</p>
|
|
|
|
<h2 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Security of Limited Use Shared
|
|
Secret</h2>
|
|
|
|
<p>If a limited use shared secret is used care must be taken to ensure that
|
|
the secret is not revealed to an attacker. A means of protecting the
|
|
confidentiality of the shared secret SHOULD be employed. This MAY be a
|
|
message level or transport level protocol that protects <em>both</em>
|
|
encryption <em>and integrity</em> such as SSL.</p>
|
|
|
|
<p>Note that merely encrypting the shared secret <em>does not provide
|
|
adequate security</em> since the <span class="ID"><span
|
|
style="FONT-FAMILY: Courier"><PassPhraseAuth></span></span> element is
|
|
not cryptographically bound to the message.</p>
|
|
|
|
<h1 style="MARGIN-LEFT: 0in; TEXT-INDENT: 0in">Acknowledgments</h1>
|
|
|
|
<p>The authors also acknowledge the extensive assistance provided in the
|
|
design stage of this specification by David Solo (CitiGroup), and the
|
|
contributions of Steve Farrell (Baltimore), Mack Hicks (Bank of America),
|
|
Andrew Layman (Microsoft), Dr Paul Boisen (NSA), Dan Guinan, Marc Hayes,
|
|
Alex Deacon, Mingliang Pei (VeriSign).</p>
|
|
|
|
<h1 style="PAGE-BREAK-BEFORE: always">Appendix A Schema and Web Service
|
|
Contract</h1>
|
|
|
|
<p>This appendix describes specific instructions for use of the SOAP binding.
|
|
Ideally the means of authenticating SOAP messages will be specified in the
|
|
SOAP specification.</p>
|
|
|
|
<p>If an XML Signature is used the scope of the signature is the <font
|
|
face="Courier"><SOAP-ENV:Envelope></font> element.</p>
|
|
|
|
<h2><a id="A.1-XKMS-Schema" name="A.1-XKMS-Schema">A.1 XKMS Schema</a></h2>
|
|
|
|
<p class="Code">TBS</p>
|
|
|
|
<h2><a id="A.2-Web-Service-Definition" name="A.2-Web-Service-Definition">A.2
|
|
Web Service Definition</a></h2>
|
|
|
|
<p>The following Web Service Definition Language definitions are
|
|
<em>normative</em>. The Service, and associated Port, elements define a
|
|
specific implementation and are exemplary only. In this case, a service is
|
|
located at http://service.xmltrustcenter.org/Test/KeySrvc.asmx.</p>
|
|
|
|
<p class="code">TBS</p>
|
|
|
|
<h1><a id="SampleProtocolExchanges" name="SampleProtocolExchanges">Appendix B
|
|
Sample Protocol Exchanges</a></h1>
|
|
|
|
<h2><a id="Tier1Example1" name="Tier1Example1">B.1 Tier 1 Example 1</a></h2>
|
|
|
|
<p>This example shows the formatting of the X-KISS request and response for
|
|
the first example in section 2.2 above.</p>
|
|
|
|
<p><strong>Request Message</strong></p>
|
|
|
|
<p class="Example">TBS</p>
|
|
|
|
<p
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"><strong>Server
|
|
Response</strong></p>
|
|
|
|
<p class="Example"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none">TBS</p>
|
|
|
|
<h3><a id="Tier1Example2" name="Tier1Example2">B.2 Tier 1 Example
|
|
2</a></h3>
|
|
|
|
<p>This example shows the formatting of the X-KISS request and response for
|
|
the second example in section 2.2 above.</p>
|
|
|
|
<p><strong>Request Message</strong></p>
|
|
|
|
<p class="Example">TBS</p>
|
|
|
|
<p
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"><strong>Server
|
|
Response</strong></p>
|
|
|
|
<p class="Example"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none">TBS</p>
|
|
|
|
<h2><a id="Tier2" name="Tier2">B.3 Tier 2</a></h2>
|
|
|
|
<p>This example shows the formatting of the X-KISS request and response for
|
|
the example in section 2.2.1 above.</p>
|
|
|
|
<p><strong>Request Message</strong></p>
|
|
|
|
<p class="Example">TBS</p>
|
|
|
|
<p
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"><strong>Server
|
|
Response</strong></p>
|
|
|
|
<p class="Example"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none">TBS</p>
|
|
|
|
<h2>B.4 Registration of Client Generated Key Pair</h2>
|
|
|
|
<p><strong>Request Message</strong></p>
|
|
|
|
<p class="Example">TBS</p>
|
|
|
|
<p
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"><strong>Server
|
|
Response</strong></p>
|
|
|
|
<p class="Example"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none">TBS</p>
|
|
|
|
<h2><a id="RegistrationServerKey" name="RegistrationServerKey">B.5
|
|
Registration of server generated key</a></h2>
|
|
|
|
<p><strong>Request Message</strong></p>
|
|
|
|
<p class="Example">TBS</p>
|
|
|
|
<p
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"><strong>Server
|
|
Response</strong></p>
|
|
|
|
<p class="Example"
|
|
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; MARGIN-TOP: 6pt; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none">TBS</p>
|
|
|
|
<h1 style="PAGE-BREAK-BEFORE: always">Appendix D References</h1>
|
|
|
|
<p class="Ref"><strong>[<a id="ref-KEYWORDS"
|
|
name="ref-KEYWORDS">KEYWORDS</a>]</strong> <a
|
|
href="http://www.ietf.org/rfc/rfc2119.txt">RFC 2119: Key words for use in
|
|
RFCs to Indicate Requirement Levels.</a> Best Current Practice. S. Bradner.
|
|
March 1997.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="PKCS1" name="PKCS1">PKCS1</a>]</strong>
|
|
Kaliski, B., <em>PKCS #1: RSA Encryption Version 2.</em>0, RSA Laboratories,
|
|
also IETF RFC 2437, October 1998.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="RFC-2104"
|
|
name="RFC-2104">RFC-2104</a>]</strong> Krawczyk, H., Bellare, M. and R.
|
|
Canetti, <em>HMAC: Keyed Hashing for Message Authentication</em>, IETF RFC
|
|
2104, February 1997.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="SOAP" name="SOAP">SOAP</a>]</strong> D. Box, D
|
|
Ehnebuske, G. Kakivaya, A. Layman, N. Mendelsohn, H. Frystyk Nielsen, S
|
|
Thatte, D. Winer. <em>Simple Object Access Protocol (SOAP) 1.1</em>, W3C Note
|
|
08 May 2000, <a
|
|
href="http://www.w3.org/TR/SOAP/">http://www.w3.org/TR/SOAP/</a></p>
|
|
|
|
<p class="Ref"><strong>[<a id="WSDL" name="WSDL">WSDL</a>]</strong> E.
|
|
Christensen, F. Curbera, G. Meredith, S. Weerawarana, <em>Web Services
|
|
Description Language 1.1 (WSDL) 1.0</em>. W3C Note 15 March 2001, <a
|
|
href="http://www.w3.org/TR/2001/NOTE-wsdl-20010315">http://www.w3.org/TR/2001/NOTE-wsdl-20010315</a></p>
|
|
|
|
<p class="Ref"><strong>[<a id="XTASS" name="XTASS">XTASS</a>]</strong> P.
|
|
Hallam-Baker, <em>XML Trust Assertion Service Specification</em>, To Be
|
|
Published, January 2001</p>
|
|
|
|
<p class="Ref"><strong>[<a id="XML-SIG" name="XML-SIG">XML-SIG</a>]</strong>
|
|
D. Eastlake, J. R., D. Solo, M. Bartel, J. Boyer , B. Fox , E. Simon.
|
|
<em>XML-Signature Syntax and Processing</em>, World Wide Web Consortium. <a
|
|
href="http://www.w3.org/TR/xmldsig-core/">http://www.w3.org/TR/xmldsig-core/</a></p>
|
|
|
|
<p class="Ref"><strong>[<a id="XML-SIG-XSD"
|
|
name="XML-SIG-XSD">XML-SIG-XSD</a>]</strong> XML Signature Schema available
|
|
from <a
|
|
href="http://www.w3.org/TR/2000/CR-xmldsig-core-20001031/xmldsig-core-schema.xsd">http://www.w3.org/TR/2000/CR-xmldsig-core-20001031/xmldsig-core-schema.xsd</a>.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="XML-Enc" name="XML-Enc">XML-Enc</a>]</strong>
|
|
<em>XML Encryption Specification</em>, In development.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="ref-XML-NS"
|
|
name="ref-XML-NS">XML-NS</a>]</strong> <a
|
|
href="http://www.w3.org/TR/1999/REC-xml-names-19990114/">Namespaces in
|
|
XML</a>. T. Bray, D. Hollander, A. Layman. W3C Recommendation, January
|
|
1999.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="ref-XML-schema"
|
|
name="ref-XML-schema">XML-schema</a>]</strong> <a
|
|
href="http://www.w3.org/TR/2001/REC-xmlschema-1-20010502/">XML Schema Part 1:
|
|
Structures</a> D. Beech, M. Maloney, N. Mendelsohn. W3C Recommendation, May
|
|
2001.</p>
|
|
|
|
<p class="Ref"><strong>[<a id="XML-Schema1"
|
|
name="XML-Schema1">XML-Schema1</a>]</strong> H. S. Thompson, D. Beech, M.
|
|
Maloney, N. Mendelsohn. <em>XML Schema Part 1: Structures</em>, W3C Working
|
|
Draft 22 September 2000, <a
|
|
href="http://www.w3.org/TR/2000/WD-xmlschema-1-20000922/">http://www.w3.org/TR/2000/WD-xmlschema-1-20000922/</a>,
|
|
latest draft at <a
|
|
href="http://www.w3.org/TR/xmlschema-1/">http://www.w3.org/TR/xmlschema-1/</a></p>
|
|
|
|
<p class="Ref"><strong>[<a id="XML-Schema2"
|
|
name="XML-Schema2">XML-Schema2</a>]</strong> P. V. Biron, A. Malhotra,
|
|
<em>XML Schema Part 2: Datatypes</em>; W3C Working Draft 22 September 2000,
|
|
<span style="COLOR: black"><a
|
|
href="http://www.w3.org/TR/2000/WD-xmlschema-2-20000922/">http://www.w3.org/TR/2000/WD-xmlschema-2-20000922/</a></span>,
|
|
latest draft at <a
|
|
href="http://www.w3.org/TR/xmlschema-2/">http://www.w3.org/TR/xmlschema-2/</a></p>
|
|
</body>
|
|
</html>
|