Movatterモバイル変換

Network Working Group                                          S. BoeyenRequest for Comments: 4386                                  Entrust Inc.Category: Experimental                                   P. Hallam-Baker                                                           VeriSign Inc.                                                           February 2006Internet X.509 Public Key InfrastructureRepository Locator ServiceStatus of This Memo   This memo defines an Experimental Protocol for the Internet   community.  It does not specify an Internet standard of any kind.   Discussion and suggestions for improvement are requested.   Distribution of this memo is unlimited.Copyright Notice   Copyright (C) The Internet Society (2006).Abstract   This document defines a Public Key Infrastructure (PKI) repository   locator service.  The service makes use of DNS SRV records defined in   accordance withRFC 2782.  The service enables certificate-using   systems to locate PKI repositories.Table of Contents1. Overview ........................................................21.1. Conventions Used in This Document ..........................22. SRV RR Definition ...............................................22.1. Assignment of New Protocol Prefixes ........................32.2. Use of Multiple Repositories ...............................32.3. SRV RR Example .............................................33. Security Considerations .........................................44. IANA Considerations .............................................45. Informative References ..........................................4Boeyen & Hallam-Baker         Experimental                      [Page 1]

RFC 4386                        PKIXREP                    February 20061.  Overview   A number of RFCs (including [RFC2559], [RFC2560], and [RFC2585]) have   specified operational protocols for retrieval of PKI data, including   public-key certificates and revocation information, from PKI   repositories.  These RFCs assume that a certificate-using system has   the information necessary to identify, locate, and connect to the PKI   repository with a specific protocol.  Although some tools are   available in protocol-specific environments for this purpose, such as   knowledge references in directory systems, these are restricted for   use with a single protocol and do not share a common means of   publication.  This document provides a solution to this problem   through the use of Service Record (SRV) Resource Records (RRs) in   DNS.  This solution is expected to be particularly useful in   environments where only a domain name is available.  In other   situations (e.g., where a certificate is available that contains the   required information), such a DNS lookup is not needed.   [RFC2782] defines a DNS RR for specifying the location of services   (SRV).  This document defines SRV records for a PKI repository   locator service to enable PKI clients to obtain the necessary   information to connect to a domain's PKI repository, including   information about each protocol that is supported by that domain for   access to its repository.  This document includes the definition of   an SRV RR format for this service and an example of its potential use   in an email environment.1.1.  Conventions Used in This Document   The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT",   "RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase,   as shown) are to be interpreted as described in [RFC2119].   In examples, "C:" and "S:" indicate lines sent by the client and   server, respectively.2.  SRV RR Definition   The format of the SRV RR, whose DNS type code is 33, is:    _Service._Proto.Name TTL Class SRV Priority Weight Port Target   For the PKI repository locator service, this document uses the   symbolic name "PKIXREP".  Note that when used in an SRV RR, this name   MUST be prepended with an "_" character.Boeyen & Hallam-Baker         Experimental                      [Page 2]

RFC 4386                        PKIXREP                    February 2006   The protocols that can be included in PKIXREP SRV RRs are:      Protocol     SRV Prefix      LDAP         _LDAP      HTTP         _HTTP      OCSP         _OCSP2.1.  Assignment of New Protocol Prefixes   Protocol prefix assignments for new PKIX repository protocols SHOULD   be defined in the document that specifies the protocol.2.2.  Use of Multiple Repositories   The existence of multiple repositories MAY be determined by making   separate DNS queries for each of the protocols supported by the   client.   If this approach is found to be unacceptably inefficient due to a   proliferation of repository protocols at a future date, the service   discovery protocol could be extended to allow the repository to   advertise the protocols supported.2.3.  SRV RR Example   This example uses the fictional domain "example.com" as an aid in   understanding the use of SRV records by a certificate-using system.   Assume that Alice is an email client that needs a certificate for a   recipient.  Alice's client system supports LDAP for certificate   retrieval.  Assume the message recipient is Bob and that Bob's email   address is bob@example.com.  Assume that example.test maintains a   "border directory" PKI repository and that Bob's certificate is   available from that directory, "border.example.com", via LDAP.   Alice's client system retrieves, via DNS, the SRV record for   _PKIXREP._LDAP.example.com.      -  The QNAME of the DNS query is _PKIXREP._LDAP.example.com.      - The QCLASS of the DNS query is IN.      -  The QTYPE of the DNS query is SRV.   The result SHOULD include the host address for example.com's border   directory system.Boeyen & Hallam-Baker         Experimental                      [Page 3]

RFC 4386                        PKIXREP                    February 2006   Note that if example.com operated its service on a number of hosts,   more than one SRV RR would be returned.  In this case,RFC 2782   defines the procedure to be followed in determining which of these   should be accessed first.3.  Security Considerations   Security issues regarding PKI repositories themselves are outside the   scope of this document.  For LDAP repositories, for example, specific   security considerations are addressed inRFC 2559.   Security issues with respect to the use of SRV records in general are   addressed inRFC 2782, and these issues apply to the use of SRV   records in the context of the PKIXREP service defined here.4.  IANA Considerations   This document reserves the use of "_PKIXREP" service label.  Since   this relates to a service that may pass messages over a number of   different message transports, each message must be associated with a   specific transport.   In order to ensure that the association between "_PKIXREP" and their   respective underlying services is deterministic, the IANA has created   a new registry: PKIX SRV Protocol Labels.   For this registry, an entry shall consist of a label name and a   pointer to a specification describing how the protocol named in the   label uses SRV.  Specifications should conform to the requirements   listed in [RFC2434] for "specification required".5.  Informative References   [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate             Requirement Levels",BCP 14,RFC 2119, March 1997.   [RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an             IANA Considerations Section in RFCs",BCP 26,RFC 2434,             October 1998.   [RFC2559] Boeyen, S., Howes, T., and P. Richard, "Internet X.509             Public Key Infrastructure Operational Protocols - LDAPv2",RFC 2559, April 1999.   [RFC2560] Myers, M., Ankney, R., Malpani, A., Galperin, S., and C.             Adams, "X.509 Internet Public Key Infrastructure Online             Certificate Status Protocol - OCSP",RFC 2560, June 1999.Boeyen & Hallam-Baker         Experimental                      [Page 4]

RFC 4386                        PKIXREP                    February 2006   [RFC2585] Housley, R. and P. Hoffman, "Internet X.509 Public Key             Infrastructure Operational Protocols: FTP and HTTP",RFC2585, May 1999.   [RFC2782] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for             specifying the location of services (DNS SRV)",RFC 2782,             February 2000.Authors' Addresses   Sharon Boeyen   Entrust   1000 Innovation Drive   Ottawa, Ontario   Canada K2K 3E7   EMail: sharon.boeyen@entrust.com   Phillip M. Hallam-Baker   VeriSign Inc.   401 Edgewater Place, Suite 280   Wakefield MA 01880   EMail: pbaker@VeriSign.comBoeyen & Hallam-Baker         Experimental                      [Page 5]

RFC 4386                        PKIXREP                    February 2006Full Copyright Statement   Copyright (C) The Internet Society (2006).   This document is subject to the rights, licenses and restrictions   contained inBCP 78, and except as set forth therein, the authors   retain all their rights.   This document and the information contained herein are provided on an   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.Intellectual Property   The IETF takes no position regarding the validity or scope of any   Intellectual Property Rights or other rights that might be claimed to   pertain to the implementation or use of the technology described in   this document or the extent to which any license under such rights   might or might not be available; nor does it represent that it has   made any independent effort to identify any such rights.  Information   on the procedures with respect to rights in RFC documents can be   found inBCP 78 andBCP 79.   Copies of IPR disclosures made to the IETF Secretariat and any   assurances of licenses to be made available, or the result of an   attempt made to obtain a general license or permission for the use of   such proprietary rights by implementers or users of this   specification can be obtained from the IETF on-line IPR repository athttp://www.ietf.org/ipr.   The IETF invites any interested party to bring to its attention any   copyrights, patents or patent applications, or other proprietary   rights that may cover technology that may be required to implement   this standard.  Please address the information to the IETF at   ietf-ipr@ietf.org.Acknowledgement   Funding for the RFC Editor function is provided by the IETF   Administrative Support Activity (IASA).Boeyen & Hallam-Baker         Experimental                      [Page 6]