idnits 2.17.1 draft-gould-eppext-verificationcode-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (September 29, 2015) is 3132 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Downref: Normative reference to an Informational RFC: RFC 7451 Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Gould 3 Internet-Draft VeriSign, Inc. 4 Intended status: Standards Track September 29, 2015 5 Expires: April 1, 2016 7 Verification Code Extension for the Extensible Provisioning Protocol 8 (EPP) 9 draft-gould-eppext-verificationcode-00 11 Abstract 13 This document describes an Extensible Provisioning Protocol (EPP) 14 extension for including a verification code for marking the data for 15 a transform command as being verified by a 3rd party, which is 16 referred to as the Verification Service Provider (VSP). The 17 verification code is digitally signed by the VSP using XML Signature 18 and is "base64" encoded. The XML Signature includes the VSP signer 19 certificate, so the server can verify that the verification code 20 originated from the VSP. 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on April 1, 2016. 39 Copyright Notice 41 Copyright (c) 2015 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 1.1. Conventions Used in This Document . . . . . . . . . . . . 3 58 2. Object Attributes . . . . . . . . . . . . . . . . . . . . . . 3 59 2.1. Verification Code . . . . . . . . . . . . . . . . . . . . 4 60 2.1.1. Signed Code . . . . . . . . . . . . . . . . . . . . . 4 61 2.1.2. Encoded Signed Code . . . . . . . . . . . . . . . . . 6 62 2.2. Verification Profile . . . . . . . . . . . . . . . . . . 11 63 3. EPP Command Mapping . . . . . . . . . . . . . . . . . . . . . 11 64 3.1. EPP Query Commands . . . . . . . . . . . . . . . . . . . 12 65 3.1.1. EPP Command . . . . . . . . . . . . . . . . . 12 66 3.1.2. EPP Command . . . . . . . . . . . . . . . . . 12 67 3.1.3. EPP Command . . . . . . . . . . . . . . . 23 68 3.2. EPP Transform Commands . . . . . . . . . . . . . . . . . 24 69 3.2.1. EPP Command . . . . . . . . . . . . . . . . 24 70 3.2.2. EPP Command . . . . . . . . . . . . . . . . 26 71 3.2.3. EPP Command . . . . . . . . . . . . . . . . . 27 72 3.2.4. EPP Command . . . . . . . . . . . . . . . 27 73 3.2.5. EPP Command . . . . . . . . . . . . . . . . 27 74 4. Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . . 27 75 4.1. Verification Code Extension Schema . . . . . . . . . . . 27 76 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 31 77 5.1. XML Namespace . . . . . . . . . . . . . . . . . . . . . . 31 78 5.2. EPP Extension Registry . . . . . . . . . . . . . . . . . 31 79 6. Security Considerations . . . . . . . . . . . . . . . . . . . 32 80 7. Normative References . . . . . . . . . . . . . . . . . . . . 32 81 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 33 82 Appendix B. Change History . . . . . . . . . . . . . . . . . . . 33 83 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 33 85 1. Introduction 87 This document describes an extension mapping for version 1.0 of the 88 Extensible Provisioning Protocol (EPP) [RFC5730]. This mapping, an 89 extension to EPP object mappings like the EPP domain name mapping 90 [RFC5731], EPP host mapping [RFC5732], and EPP contact mapping 91 [RFC5733], can be used to pass a verification code to one of the EPP 92 transform commands. The domain name object is used for examples in 93 the document. The verification code is signed using XML Signature 94 [W3C.CR-xmldsig-core2-20120124] and is "base64" encoded. The 95 "base64" encoded text of the verification code MUST conform to 97 [RFC2045]. The verification code demonstrates that verification was 98 done by a Verification Service Provider (VSP). 100 The Verification Service Provider (VSP) is a certified party to 101 verify that data is in compliance with the policies of a locality. A 102 locality MAY require the client to have data verified in accordance 103 with local regulations or laws utilizing data sources not available 104 to the server. The VSP has access to the local data sources and is 105 authorized to verify the data. Examples include verifying that the 106 domain name is not prohibited and verifying that the domain name 107 registrant is a valid individual, organization, or business in the 108 locality. The data verified, and the objects and operations that 109 require the verification code to be passed to the server is up to the 110 policies of the locality. The verification code represents a marker 111 that the verification was completed. The data verified by the VSP 112 MUST be stored by the VSP along with the generated verification code 113 to address any compliance issues. The signer certificate and the 114 digital signature of the verification code MUST be verified by the 115 server. 117 1.1. Conventions Used in This Document 119 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 120 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 121 document are to be interpreted as described in RFC 2119 [RFC2119]. 123 XML is case sensitive. Unless stated otherwise, XML specifications 124 and examples provided in this document MUST be interpreted in the 125 character case presented in order to develop a conforming 126 implementation. 128 In examples, "C:" represents lines sent by a protocol client and "S:" 129 represents lines returned by a protocol server. Indentation and 130 white space in examples are provided only to illustrate element 131 relationships and are not a REQUIRED feature of this protocol. 133 "verificationCode-1.0" is used as an abbreviation for 134 "urn:ietf:params:xml:ns:verificationCode-1.0". The XML namespace 135 prefix "verificationCode" is used, but implementations MUST NOT 136 depend on it and instead employ a proper namespace-aware XML parser 137 and serializer to interpret and output the XML documents. 139 2. Object Attributes 141 This extension adds additional elements to EPP object mappings like 142 the EPP domain name mapping [RFC5731], EPP host mapping [RFC5732], 143 and EPP contact mapping [RFC5733]. Only those new elements are 144 described here. 146 2.1. Verification Code 148 The Verification Code is a formatted token, referred to as the 149 Verification Code Token, that is digitally signed by a Verification 150 Service Provider (VSP) using XML Signature 151 [W3C.CR-xmldsig-core2-20120124], using the process described in 152 Section 2.1.1, and is then "base64" encoded, as defined in 153 Section 2.1.2. The Verification Code Token syntax is specified using 154 Augmented Backus-Naur Form (ABNF) grammar [RFC5234] as follows: 156 Verification Code Token ABNF 158 token = vsp-id "-" verification-id ; Verification Code Token 159 vsp-id = 1*DIGIT ; VSP Identifier 160 verification-id = 1*(DIGIT / ALPHA) ; Verification Identifier 162 For a VSP given VSP Identifier "1" and with a Verification Identifier 163 of "abc123", the resulting Verification Code Token is "1-abc123". 164 The Verification Identifier MUST be unique within a VSP and the VSP 165 Identifier MUST be unique across supporting VSP's, so the 166 Verification Code Token MUST be unique to an individual verification. 167 The VSP Identifiers MAY require registration within an IANA registry. 169 2.1.1. Signed Code 171 The is the fragment of XML that is 172 digitally signed using XML Signature [W3C.CR-xmldsig-core2-20120124]. 173 The includes a required "id" attribute 174 of type XSD ID for use with an IDREF URI from the Signature element. 175 The certificate of the issuer MUST be included with the Signature so 176 it that can be chained with the issuer's certificate by the 177 validating client. 179 The element includes a REQUIRED "type" 180 attribute for use in defining the type of the signed code. It is up 181 to the VSP and the server to define the valid values for the "type" 182 attribute. Examples of possible "type" attribute values include 183 "domain" for verification of the domain name, "registrant" for 184 verification of the registrant contact, or "domain-registrant" for 185 verification of both the domain name and the registrant. The typed 186 signed code is used to indicate the verifications that are done by 187 the VSP. The "type" attribute values MAY require registration within 188 an IANA registry. 190 A element subsitutes for the 191 abstract element to define a 192 concrete definition of a signed code. The 193 element can be replaced by 194 other signed code definitions using the XML schema subsitution groups 195 feature. 197 The child elements of the element 198 include: 200 Contains the Verification Code Token as 201 defined by the ABNF in Section 2.1. 202 XML Signature [W3C.CR-xmldsig-core2-20120124] for the 203 . Use of a namespace prefix, like 204 "dsig", is recommended for the XML Signature 205 [W3C.CR-xmldsig-core2-20120124] elements. 207 Example of a "domain" typed signed code using the 208 element and XML Signature 209 [W3C.CR-xmldsig-core2-20120124]: 211 215 1-abc111 216 217 218 219 221 223 224 225 227 228 230 wgyW3nZPoEfpptlhRILKnOQnbdtU6ArM7ShrAfHgDFg= 231 232 233 234 235 jMu4PfyQGiJBF0GWSEPFCJjmywCEqR2h4LD+ge6XQ+JnmKFFCuCZS/3SLKAx0L1w 236 QDFO2e0Y69k2G7/LGE37X3vOflobFM1oGwja8+GMVraoto5xAd4/AF7eHukgAymD 237 o9toxoa2h0yV4A4PmXzsU6S86XtCcUE+S/WM72nyn47zoUCzzPKHZBRyeWehVFQ+ 238 jYRMIAMzM57HHQA+6eaXefRvtPETgUO4aVIVSugc4OUAZZwbYcZrC6wOaQqqqAZi 239 30aPOBYbAvHMSmWSS+hFkbshomJfHxb97TD2grlYNrQIzqXk7WbHWy2SYdA+sI/Z 240 ipJsXNa6osTUw1CzA7jfwA== 241 242 243 244 245 MIIESTCCAzGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBiMQswCQYDVQQGEwJVUzEL 246 MAkGA1UECBMCQ0ExFDASBgNVBAcTC0xvcyBBbmdlbGVzMRMwEQYDVQQKEwpJQ0FO 247 TiBUTUNIMRswGQYDVQQDExJJQ0FOTiBUTUNIIFRFU1QgQ0EwHhcNMTMwMjA4MDAw 248 MDAwWhcNMTgwMjA3MjM1OTU5WjBsMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0Ex 249 FDASBgNVBAcTC0xvcyBBbmdlbGVzMRcwFQYDVQQKEw5WYWxpZGF0b3IgVE1DSDEh 250 MB8GA1UEAxMYVmFsaWRhdG9yIFRNQ0ggVEVTVCBDRVJUMIIBIjANBgkqhkiG9w0B 251 AQEFAAOCAQ8AMIIBCgKCAQEAo/cwvXhbVYl0RDWWvoyeZpETVZVVcMCovUVNg/sw 252 WinuMgEWgVQFrz0xA04pEhXCFVv4evbUpekJ5buqU1gmQyOsCKQlhOHTdPjvkC5u 253 pDqa51Flk0TMaMkIQjs7aUKCmA4RG4tTTGK/EjR1ix8/D0gHYVRldy1YPrMP+ou7 254 5bOVnIos+HifrAtrIv4qEqwLL4FTZAUpaCa2BmgXfy2CSRQbxD5Or1gcSa3vurh5 255 sPMCNxqaXmIXmQipS+DuEBqMM8tldaN7RYojUEKrGVsNk5i9y2/7sjn1zyyUPf7v 256 L4GgDYqhJYWV61DnXgx/Jd6CWxvsnDF6scscQzUTEl+hywIDAQABo4H/MIH8MAwG 257 A1UdEwEB/wQCMAAwHQYDVR0OBBYEFPZEcIQcD/Bj2IFz/LERuo2ADJviMIGMBgNV 258 HSMEgYQwgYGAFO0/7kEh3FuEKS+Q/kYHaD/W6wihoWakZDBiMQswCQYDVQQGEwJV 259 UzELMAkGA1UECBMCQ0ExFDASBgNVBAcTC0xvcyBBbmdlbGVzMRMwEQYDVQQKEwpJ 260 Q0FOTiBUTUNIMRswGQYDVQQDExJJQ0FOTiBUTUNIIFRFU1QgQ0GCAQEwDgYDVR0P 261 AQH/BAQDAgeAMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6Ly9jcmwuaWNhbm4ub3Jn 262 L3RtY2guY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQB2qSy7ui+43cebKUKwWPrzz9y/ 263 IkrMeJGKjo40n+9uekaw3DJ5EqiOf/qZ4pjBD++oR6BJCb6NQuQKwnoAz5lE4Ssu 264 y5+i93oT3HfyVc4gNMIoHm1PS19l7DBKrbwbzAea/0jKWVzrvmV7TBfjxD3AQo1R 265 bU5dBr6IjbdLFlnO5x0G0mrG7x5OUPuurihyiURpFDpwH8KAH1wMcCpXGXFRtGKk 266 wydgyVYAty7otkl/z3bZkCVT34gPvF70sR6+QxUy8u0LzF5A/beYaZpxSYG31amL 267 AdXitTWFipaIGea9lEGFM0L9+Bg7XzNn4nVLXokyEB3bgS4scG6QznX23FGk 268 269 270 271 272 274 2.1.2. Encoded Signed Code 276 The element contains one or more 277 encoded form of the digitally signed 278 element, described in Section 2.1.1. 280 The child elements of the 281 element include: 283 One or more elements 284 that is an encoded form of the digitally signed 285 element, described in 286 Section 2.1.1, with the encoding defined by the "encoding" 287 attribute with the default "encoding" value of "base64". The 288 "base64" encoded text of the 289 element MUST conform to [RFC2045]. 291 Example element that contains 292 one "base64" encoded contained in the 293 element: 295 298 299 ICAgICAgPHZlcmlmaWNhdGlvbkNvZGU6c2lnbmVkQ29kZQogICAgICAgIHhtbG5z 300 OnZlcmlmaWNhdGlvbkNvZGU9CiAgICAgICAgICAidXJuOmlldGY6cGFyYW1zOnht 301 bDpuczp2ZXJpZmljYXRpb25Db2RlLTEuMCIKICAgICAgICAgIGlkPSJzaWduZWRD 302 b2RlIj4KICAgCQk8dmVyaWZpY2F0aW9uQ29kZTpjb2RlPjEtYWJjMTIzPC92ZXJp 303 ZmljYXRpb25Db2RlOmNvZGU+CiAgPFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3 304 dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+CiAgIDxTaWduZWRJbmZvPgogICAg 305 PENhbm9uaWNhbGl6YXRpb25NZXRob2QKIEFsZ29yaXRobT0iaHR0cDovL3d3dy53 306 My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICA8U2lnbmF0dXJlTWV0 307 aG9kCiBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNp 308 Zy1tb3JlI3JzYS1zaGEyNTYiLz4KICAgIDxSZWZlcmVuY2UgVVJJPSIjc2lnbmVk 309 Q29kZSI+CiAgICAgPFRyYW5zZm9ybXM+CiAgICAgIDxUcmFuc2Zvcm0KIEFsZ29y 310 aXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3Bl 311 ZC1zaWduYXR1cmUiLz4KICAgICA8L1RyYW5zZm9ybXM+CiAgICAgPERpZ2VzdE1l 312 dGhvZAogQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVu 313 YyNzaGEyNTYiLz4KIDxEaWdlc3RWYWx1ZT53Z3lXM25aUG9FZnBwdGxoUklMS25P 314 UW5iZHRVNkFyTTdTaHJBZkhnREZnPTwvRGlnZXN0VmFsdWU+CiAgICA8L1JlZmVy 315 ZW5jZT4KICAgPC9TaWduZWRJbmZvPgogICA8U2lnbmF0dXJlVmFsdWU+CiBqTXU0 316 UGZ5UUdpSkJGMEdXU0VQRkNKam15d0NFcVIyaDRMRCtnZTZYUStKbm1LRkZDdUNa 317 Uy8zU0xLQXgwTDF3CiBRREZPMmUwWTY5azJHNy9MR0UzN1gzdk9mbG9iRk0xb0d3 318 amE4K0dNVnJhb3RvNXhBZDQvQUY3ZUh1a2dBeW1ECiBvOXRveG9hMmgweVY0QTRQ 319 bVh6c1U2Uzg2WHRDY1VFK1MvV003Mm55bjQ3em9VQ3p6UEtIWkJSeWVXZWhWRlEr 320 CiBqWVJNSUFNek01N0hIUUErNmVhWGVmUnZ0UEVUZ1VPNGFWSVZTdWdjNE9VQVpa 321 d2JZY1pyQzZ3T2FRcXFxQVppCiAzMGFQT0JZYkF2SE1TbVdTUytoRmtic2hvbUpm 322 SHhiOTdURDJncmxZTnJRSXpxWGs3V2JIV3kyU1lkQStzSS9aCiBpcEpzWE5hNm9z 323 VFV3MUN6QTdqZndBPT0KICAgPC9TaWduYXR1cmVWYWx1ZT4KICAgPEtleUluZm8+ 324 CiAgICA8WDUwOURhdGE+CiAgICA8WDUwOUNlcnRpZmljYXRlPgogTUlJRVNUQ0NB 325 ekdnQXdJQkFnSUJBakFOQmdrcWhraUc5dzBCQVFzRkFEQmlNUXN3Q1FZRFZRUUdF 326 d0pWVXpFTAogTUFrR0ExVUVDQk1DUTBFeEZEQVNCZ05WQkFjVEMweHZjeUJCYm1k 327 bGJHVnpNUk13RVFZRFZRUUtFd3BKUTBGTwogVGlCVVRVTklNUnN3R1FZRFZRUURF 328 eEpKUTBGT1RpQlVUVU5JSUZSRlUxUWdRMEV3SGhjTk1UTXdNakE0TURBdwogTURB 329 d1doY05NVGd3TWpBM01qTTFPVFU1V2pCc01Rc3dDUVlEVlFRR0V3SlZVekVMTUFr 330 R0ExVUVDQk1DUTBFeAogRkRBU0JnTlZCQWNUQzB4dmN5QkJibWRsYkdWek1SY3dG 331 UVlEVlFRS0V3NVdZV3hwWkdGMGIzSWdWRTFEU0RFaAogTUI4R0ExVUVBeE1ZVm1G 332 c2FXUmhkRzl5SUZSTlEwZ2dWRVZUVkNCRFJWSlVNSUlCSWpBTkJna3Foa2lHOXcw 333 QgogQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBby9jd3ZYaGJWWWwwUkRXV3ZveWVa 334 cEVUVlpWVmNNQ292VVZOZy9zdwogV2ludU1nRVdnVlFGcnoweEEwNHBFaFhDRlZ2 335 NGV2YlVwZWtKNWJ1cVUxZ21ReU9zQ0tRbGhPSFRkUGp2a0M1dQogcERxYTUxRmxr 336 MFRNYU1rSVFqczdhVUtDbUE0Ukc0dFRUR0svRWpSMWl4OC9EMGdIWVZSbGR5MVlQ 337 ck1QK291NwogNWJPVm5Jb3MrSGlmckF0ckl2NHFFcXdMTDRGVFpBVXBhQ2EyQm1n 338 WGZ5MkNTUlFieEQ1T3IxZ2NTYTN2dXJoNQogc1BNQ054cWFYbUlYbVFpcFMrRHVF 339 QnFNTTh0bGRhTjdSWW9qVUVLckdWc05rNWk5eTIvN3NqbjF6eXlVUGY3dgogTDRH 340 Z0RZcWhKWVdWNjFEblhneC9KZDZDV3h2c25ERjZzY3NjUXpVVEVsK2h5d0lEQVFB 341 Qm80SC9NSUg4TUF3RwogQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRUZQWkVj 342 SVFjRC9CajJJRnovTEVSdW8yQURKdmlNSUdNQmdOVgogSFNNRWdZUXdnWUdBRk8w 343 LzdrRWgzRnVFS1MrUS9rWUhhRC9XNndpaG9XYWtaREJpTVFzd0NRWURWUVFHRXdK 344 VgogVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGREFTQmdOVkJBY1RDMHh2Y3lCQmJtZGxi 345 R1Z6TVJNd0VRWURWUVFLRXdwSgogUTBGT1RpQlVUVU5JTVJzd0dRWURWUVFERXhK 346 SlEwRk9UaUJVVFVOSUlGUkZVMVFnUTBHQ0FRRXdEZ1lEVlIwUAogQVFIL0JBUURB 347 Z2VBTUM0R0ExVWRId1FuTUNVd0k2QWhvQitHSFdoMGRIQTZMeTlqY213dWFXTmhi 348 bTR1YjNKbgogTDNSdFkyZ3VZM0pzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFC 349 MnFTeTd1aSs0M2NlYktVS3dXUHJ6ejl5LwogSWtyTWVKR0tqbzQwbis5dWVrYXcz 350 REo1RXFpT2YvcVo0cGpCRCsrb1I2QkpDYjZOUXVRS3dub0F6NWxFNFNzdQogeTUr 351 aTkzb1QzSGZ5VmM0Z05NSW9IbTFQUzE5bDdEQktyYndiekFlYS8waktXVnpydm1W 352 N1RCZmp4RDNBUW8xUgogYlU1ZEJyNklqYmRMRmxuTzV4MEcwbXJHN3g1T1VQdXVy 353 aWh5aVVScEZEcHdIOEtBSDF3TWNDcFhHWEZSdEdLawogd3lkZ3lWWUF0eTdvdGts 354 L3ozYlprQ1ZUMzRnUHZGNzBzUjYrUXhVeTh1MEx6RjVBL2JlWWFacHhTWUczMWFt 355 TAogQWRYaXRUV0ZpcGFJR2VhOWxFR0ZNMEw5K0JnN1h6Tm40blZMWG9reUVCM2Jn 356 UzRzY0c2UXpuWDIzRkdrCiAgIDwvWDUwOUNlcnRpZmljYXRlPgogICA8L1g1MDlE 357 YXRhPgogICA8L0tleUluZm8+CiAgPC9TaWduYXR1cmU+CgkJPC92ZXJpZmljYXRp 358 b25Db2RlOnNpZ25lZENvZGU+Cg== 359 360 362 Example element that contains 363 two elements ;. 365 366 367 368 369 371 domain.example 372 jd1234 373 sh8013 374 sh8013 375 376 2fooBAR 377 378 379 380 381 384 385 ICAgICAgPHZlcmlmaWNhdGlvbkNvZGU6c2lnbmVkQ29kZQogICAgICAgIHhtbG5z 386 OnZlcmlmaWNhdGlvbkNvZGU9CiAgICAgICAgICAidXJuOmlldGY6cGFyYW1zOnht 387 bDpuczp2ZXJpZmljYXRpb25Db2RlLTEuMCIKICAgICAgICAgIGlkPSJzaWduZWRD 388 b2RlIj4KICAgCQk8dmVyaWZpY2F0aW9uQ29kZTpjb2RlPjEtYWJjMTIzPC92ZXJp 389 ZmljYXRpb25Db2RlOmNvZGU+CiAgPFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3 390 dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+CiAgIDxTaWduZWRJbmZvPgogICAg 391 PENhbm9uaWNhbGl6YXRpb25NZXRob2QKIEFsZ29yaXRobT0iaHR0cDovL3d3dy53 392 My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICA8U2lnbmF0dXJlTWV0 393 aG9kCiBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNp 394 Zy1tb3JlI3JzYS1zaGEyNTYiLz4KICAgIDxSZWZlcmVuY2UgVVJJPSIjc2lnbmVk 395 Q29kZSI+CiAgICAgPFRyYW5zZm9ybXM+CiAgICAgIDxUcmFuc2Zvcm0KIEFsZ29y 396 aXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3Bl 397 ZC1zaWduYXR1cmUiLz4KICAgICA8L1RyYW5zZm9ybXM+CiAgICAgPERpZ2VzdE1l 398 dGhvZAogQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVu 399 YyNzaGEyNTYiLz4KIDxEaWdlc3RWYWx1ZT53Z3lXM25aUG9FZnBwdGxoUklMS25P 400 UW5iZHRVNkFyTTdTaHJBZkhnREZnPTwvRGlnZXN0VmFsdWU+CiAgICA8L1JlZmVy 401 ZW5jZT4KICAgPC9TaWduZWRJbmZvPgogICA8U2lnbmF0dXJlVmFsdWU+CiBqTXU0 402 UGZ5UUdpSkJGMEdXU0VQRkNKam15d0NFcVIyaDRMRCtnZTZYUStKbm1LRkZDdUNa 403 Uy8zU0xLQXgwTDF3CiBRREZPMmUwWTY5azJHNy9MR0UzN1gzdk9mbG9iRk0xb0d3 404 amE4K0dNVnJhb3RvNXhBZDQvQUY3ZUh1a2dBeW1ECiBvOXRveG9hMmgweVY0QTRQ 405 bVh6c1U2Uzg2WHRDY1VFK1MvV003Mm55bjQ3em9VQ3p6UEtIWkJSeWVXZWhWRlEr 406 CiBqWVJNSUFNek01N0hIUUErNmVhWGVmUnZ0UEVUZ1VPNGFWSVZTdWdjNE9VQVpa 407 d2JZY1pyQzZ3T2FRcXFxQVppCiAzMGFQT0JZYkF2SE1TbVdTUytoRmtic2hvbUpm 408 SHhiOTdURDJncmxZTnJRSXpxWGs3V2JIV3kyU1lkQStzSS9aCiBpcEpzWE5hNm9z 409 VFV3MUN6QTdqZndBPT0KICAgPC9TaWduYXR1cmVWYWx1ZT4KICAgPEtleUluZm8+ 410 CiAgICA8WDUwOURhdGE+CiAgICA8WDUwOUNlcnRpZmljYXRlPgogTUlJRVNUQ0NB 411 ekdnQXdJQkFnSUJBakFOQmdrcWhraUc5dzBCQVFzRkFEQmlNUXN3Q1FZRFZRUUdF 412 d0pWVXpFTAogTUFrR0ExVUVDQk1DUTBFeEZEQVNCZ05WQkFjVEMweHZjeUJCYm1k 413 bGJHVnpNUk13RVFZRFZRUUtFd3BKUTBGTwogVGlCVVRVTklNUnN3R1FZRFZRUURF 414 eEpKUTBGT1RpQlVUVU5JSUZSRlUxUWdRMEV3SGhjTk1UTXdNakE0TURBdwogTURB 415 d1doY05NVGd3TWpBM01qTTFPVFU1V2pCc01Rc3dDUVlEVlFRR0V3SlZVekVMTUFr 416 R0ExVUVDQk1DUTBFeAogRkRBU0JnTlZCQWNUQzB4dmN5QkJibWRsYkdWek1SY3dG 417 UVlEVlFRS0V3NVdZV3hwWkdGMGIzSWdWRTFEU0RFaAogTUI4R0ExVUVBeE1ZVm1G 418 c2FXUmhkRzl5SUZSTlEwZ2dWRVZUVkNCRFJWSlVNSUlCSWpBTkJna3Foa2lHOXcw 419 QgogQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBby9jd3ZYaGJWWWwwUkRXV3ZveWVa 420 cEVUVlpWVmNNQ292VVZOZy9zdwogV2ludU1nRVdnVlFGcnoweEEwNHBFaFhDRlZ2 421 NGV2YlVwZWtKNWJ1cVUxZ21ReU9zQ0tRbGhPSFRkUGp2a0M1dQogcERxYTUxRmxr 422 MFRNYU1rSVFqczdhVUtDbUE0Ukc0dFRUR0svRWpSMWl4OC9EMGdIWVZSbGR5MVlQ 423 ck1QK291NwogNWJPVm5Jb3MrSGlmckF0ckl2NHFFcXdMTDRGVFpBVXBhQ2EyQm1n 424 WGZ5MkNTUlFieEQ1T3IxZ2NTYTN2dXJoNQogc1BNQ054cWFYbUlYbVFpcFMrRHVF 425 QnFNTTh0bGRhTjdSWW9qVUVLckdWc05rNWk5eTIvN3NqbjF6eXlVUGY3dgogTDRH 426 Z0RZcWhKWVdWNjFEblhneC9KZDZDV3h2c25ERjZzY3NjUXpVVEVsK2h5d0lEQVFB 427 Qm80SC9NSUg4TUF3RwogQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRUZQWkVj 428 SVFjRC9CajJJRnovTEVSdW8yQURKdmlNSUdNQmdOVgogSFNNRWdZUXdnWUdBRk8w 429 LzdrRWgzRnVFS1MrUS9rWUhhRC9XNndpaG9XYWtaREJpTVFzd0NRWURWUVFHRXdK 430 VgogVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGREFTQmdOVkJBY1RDMHh2Y3lCQmJtZGxi 431 R1Z6TVJNd0VRWURWUVFLRXdwSgogUTBGT1RpQlVUVU5JTVJzd0dRWURWUVFERXhK 432 SlEwRk9UaUJVVFVOSUlGUkZVMVFnUTBHQ0FRRXdEZ1lEVlIwUAogQVFIL0JBUURB 433 Z2VBTUM0R0ExVWRId1FuTUNVd0k2QWhvQitHSFdoMGRIQTZMeTlqY213dWFXTmhi 434 bTR1YjNKbgogTDNSdFkyZ3VZM0pzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFC 435 MnFTeTd1aSs0M2NlYktVS3dXUHJ6ejl5LwogSWtyTWVKR0tqbzQwbis5dWVrYXcz 436 REo1RXFpT2YvcVo0cGpCRCsrb1I2QkpDYjZOUXVRS3dub0F6NWxFNFNzdQogeTUr 437 aTkzb1QzSGZ5VmM0Z05NSW9IbTFQUzE5bDdEQktyYndiekFlYS8waktXVnpydm1W 438 N1RCZmp4RDNBUW8xUgogYlU1ZEJyNklqYmRMRmxuTzV4MEcwbXJHN3g1T1VQdXVy 439 aWh5aVVScEZEcHdIOEtBSDF3TWNDcFhHWEZSdEdLawogd3lkZ3lWWUF0eTdvdGts 440 L3ozYlprQ1ZUMzRnUHZGNzBzUjYrUXhVeTh1MEx6RjVBL2JlWWFacHhTWUczMWFt 441 TAogQWRYaXRUV0ZpcGFJR2VhOWxFR0ZNMEw5K0JnN1h6Tm40blZMWG9reUVCM2Jn 442 UzRzY0c2UXpuWDIzRkdrCiAgIDwvWDUwOUNlcnRpZmljYXRlPgogICA8L1g1MDlE 443 YXRhPgogICA8L0tleUluZm8+CiAgPC9TaWduYXR1cmU+CgkJPC92ZXJpZmljYXRp 444 b25Db2RlOnNpZ25lZENvZGU+Cg== 445 446 447 PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48dmVyaWZpY2F0 448 aW9uQ29kZTpzaWduZWRDb2RlIHhtbG5zOnZlcmlmaWNhdGlvbkNvZGU9InVybjpp 449 ZXRmOnBhcmFtczp4bWw6bnM6dmVyaWZpY2F0aW9uQ29kZS0xLjAiIGlkPSJzaWdu 450 ZWRDb2RlIiB0eXBlPSJyZWdpc3RyYW50Ij48dmVyaWZpY2F0aW9uQ29kZTpjb2Rl 451 PjEtYWJjMjIyPC92ZXJpZmljYXRpb25Db2RlOmNvZGU+PGRzaWc6U2lnbmF0dXJl 452 IHhtbG5zOmRzaWc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMi 453 Pjxkc2lnOlNpZ25lZEluZm8+PGRzaWc6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBB 454 bGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnL1RSLzIwMDEvUkVDLXhtbC1jMTRu 455 LTIwMDEwMzE1I1dpdGhDb21tZW50cyIvPjxkc2lnOlNpZ25hdHVyZU1ldGhvZCBB 456 bGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Et 457 c2hhMSIvPjxkc2lnOlJlZmVyZW5jZSBVUkk9IiNzaWduZWRDb2RlIj48ZHNpZzpU 458 cmFuc2Zvcm1zPjxkc2lnOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cu 459 dzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PC9k 460 c2lnOlRyYW5zZm9ybXM+PGRzaWc6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0 461 cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8+PGRzaWc6RGln 462 ZXN0VmFsdWU+SFg2TU1WUWdnSStzNG9tT3haYjBGTW1VSlBRdk15WmUybDVEdEhh 463 QlZMND08L2RzaWc6RGlnZXN0VmFsdWU+PC9kc2lnOlJlZmVyZW5jZT48L2RzaWc6 464 U2lnbmVkSW5mbz48ZHNpZzpTaWduYXR1cmVWYWx1ZT5VOUhPNVlYVWE0ZUsyYXRz 465 U1RuQk1DU3dXM0dWUzZnUEtkaDBZTlZicERud1d4b1BtYlR2YkVsNDE4NFlKZ3Uw 466 WXB3RkROMmZLY3JVCk1YV0hncE56K0oycTh6MWpTcVJMUEw0UmpnRWw0eGhiOXl5 467 cExOZC8xQXJXRVlhWWZEdUc1S3FYV05MRG5YVzJoQkEzK0R5Wk82MFQKcTVPd0R5 468 ZVFSVlNPVWNXVE9FOTJsSlZ4M014Q1V6d1hoL0ZOSTlPbGtXK0ZPNVZNNTZlTmZq 469 UEhkUlJVdjdzQzRmM0NnWmFaSWFXNQp2RmJnTmJodFJVa0hsSVhnYVNGWDgvcFdV 470 RXFIY0dLTUxnRU1nbHBnQ3RtOFlIcXVqb0tXUk0yUDNiK2h3ZTRsU0hSWVRjK0pB 471 eEluClU4RDc1WnliWThnSWFuZUprS2dwVTk2T0tJTGQ5L0l0UVhaeHZnPT08L2Rz 472 aWc6U2lnbmF0dXJlVmFsdWU+PGRzaWc6S2V5SW5mbz48ZHNpZzpYNTA5RGF0YT48 473 ZHNpZzpYNTA5Q2VydGlmaWNhdGU+TUlJRGlUQ0NBbkdnQXdJQkFnSUVmcXE2SFRB 474 TkJna3Foa2lHOXcwQkFRc0ZBREIxTVJBd0RnWURWUVFHRXdkVmJtdHViM2R1TVJB 475 dwpEZ1lEVlFRSUV3ZFZibXR1YjNkdU1SQXdEZ1lEVlFRSEV3ZFZibXR1YjNkdU1S 476 QXdEZ1lEVlFRS0V3ZFZibXR1YjNkdU1SQXdEZ1lEClZRUUxFd2RWYm10dWIzZHVN 477 Umt3RndZRFZRUURFeEIyWlhKcFptbGpZWFJwYjI1RGIyUmxNQjRYRFRFMU1EWXhO 478 VEl4TURBeU1sb1gKRFRNMU1EWXhNREl4TURBeU1sb3dkVEVRTUE0R0ExVUVCaE1I 479 Vlc1cmJtOTNiakVRTUE0R0ExVUVDQk1IVlc1cmJtOTNiakVRTUE0RwpBMVVFQnhN 480 SFZXNXJibTkzYmpFUU1BNEdBMVVFQ2hNSFZXNXJibTkzYmpFUU1BNEdBMVVFQ3hN 481 SFZXNXJibTkzYmpFWk1CY0dBMVVFCkF4TVFkbVZ5YVdacFkyRjBhVzl1UTI5a1pU 482 Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUpjY2pY 483 cmsKUWFJL2lHUEZ3WmVITjFnRFVhcTltVnJmQis2eWR5Qmdoc2FHVFZoaERIOFNO 484 TmtpamxIMkxCQ3J3TjhjVjhQZ1BPOXRwbG9rR2F5UwpxNktFaHZtTk03b1dsZk5L 485 SkdSdGNidGMzTnJuYzhiUUJacU1xcFo0UlNRTmh5QWh6Ri85UmErd3RFc0JWeGF3 486 VDc1L2J0SDZ1YytmClJOdE5FcmhJdVlJUmN0WTZIRmRaR3BlS3cxYnlYK0RsNkJP 487 L3ZLdnQ4NDllY1R3aEZIcDUwWGh2NFVTL0Z5aWVLaGs3dDdHRnJGRlQKL2NCTGsy 488 WmxFa1lLcFlEU2dlc2lseFg2QkpTZVdCbXZLQzlTL2pBZDhNWmRHVUg2aHNHRXBl 489 U1BmZkZQV3FWcXl6V0p5bG91OXF4ZQpnUTZjOFo2SVpXZkUzakxSOUVySDhzOTFD 490 Mm1pTFZrQ0F3RUFBYU1oTUI4d0hRWURWUjBPQkJZRUZIY0JLdk03dmk3dUZNTUx5 491 ZE43CmVGVXF2YzVVTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBVjB2cmlrSWRB 492 d2l4THZ0NUx5eXpTNFdTU1d0dVlWL2JQMVg3NzVMRmYKSWh3a2xoMENidk5rYXlK 493 Tms2Tnp0eDlSc1AwNWZndkxrZER1N0V5cnRzY3I1ZVdETG1WMGtKMWE1N1Z4bnJh 494 aEdLTnM2Wit1Ui9pSApMaTJXb3liWEpFT2N0NWtJSjFzL05CeUUrdkdGdjFoTmJz 495 dVVVUEVCYWVtaWpYUFROOWxxZE9uM1FIbktobXhsa1czYS9KbmhtT20vCkRWYTE0 496 NDJXTVVUSlUyVFlWVldtdUs2NFkwQXFrN2FldzkvVzIzZEcrT2xhOW9VYnBrSXJr 497 dDRDN3hRa0d5SXN2eUo3bi91OFhBRDIKbno1T1cvek5GWnlrZDAzT2N3M240NkZx 498 c1IwVDlBbFBEWHQxUjlmMjZMd1lxdjk3dWtVNEcrMVRJNHorV0F2TCtVRk9FVnNu 499 PC9kc2lnOlg1MDlDZXJ0aWZpY2F0ZT48L2RzaWc6WDUwOURhdGE+PC9kc2lnOktl 500 eUluZm8+PC9kc2lnOlNpZ25hdHVyZT48L3ZlcmlmaWNhdGlvbkNvZGU6c2lnbmVk 501 Q29kZT4= 502 503 504 505 ABC-12345 506 507 509 2.2. Verification Profile 511 A Verification Profile defines the set of verification code types, 512 the commands that the verification code types are required, 513 supported, or not supported, and the grace period by which the 514 verification code types MUST be set. A server MAY support many 515 verificaton profiles, each with a unique name and a unique 516 verification policy that is implemented by the server. Each client 517 MAY have zero or more server assigned verification profiles that will 518 enforce the required verification policies. Most likely a client 519 will be assigned zero or one server assigned verification profile, 520 but overlapping profiles is possible. Overlapping verification 521 profiles MUST be treated as an logical "and" of the policies by the 522 server. If no verification profile is assigned to the client, no 523 additional verification is required by the client. 525 3. EPP Command Mapping 527 A detailed description of the EPP syntax and semantics can be found 528 in the EPP core protocol specification [RFC5730]. 530 3.1. EPP Query Commands 532 EPP provides three commands to retrieve object information: 533 to determine if an object is known to the server, to retrieve 534 detailed information associated with an object, and to 535 retrieve object transfer status information. 537 3.1.1. EPP Command 539 This extension does not add any elements to the EPP command 540 or response described in the [RFC5730]. 542 3.1.2. EPP Command 544 This extension defines additional elements to extend the EPP 545 command of an object mapping like the EPP domain name mapping 546 [RFC5731], EPP host mapping [RFC5732], and EPP contact mapping 547 [RFC5733]. 549 The EPP command is used to retrieve the verification 550 information. The verification information is based on the 551 verification profile, as defined in Section 2.2, set in the server 552 for the client. The element is an empty 553 element that indicates that the client requests the verification 554 information. The OPTIONAL "profile" attribute can be used by the 555 client to explicitly specify a verification profile, as defined in 556 Section 2.2, to base the verification information on. It is up to 557 server policy on the set of verification profiles that the client is 558 allowed to explicitly specify, and if the client is not allowed, the 559 server MUST return the 2201 error response. 561 Example domain command with the 562 extension to retrieve the verification information for the domain 563 "domain.example", using the profiles associated with the client: 565 C: 566 C: 567 C: 568 C: 569 C: 571 C: domain.example 572 C: 573 C: 574 C: 575 C: 578 C: 579 C: ABC-12345 580 C: 581 C: 583 Example domain command with the 584 extension to retrieve the verification information for the domain 585 "domain.example", using the profiles associated with the client and 586 with the authorization information to retrieve the verification codes 587 from the non-sponsoring client: 589 C: 590 C: 591 C: 592 C: 593 C: 595 C: domain.example 596 C: 597 C: 2fooBAR 598 C: 599 C: 600 C: 601 C: 602 C: 605 C: 606 C: ABC-12345 607 C: 608 C: 609 Example domain command with the 610 extension to retrieve the verification information for the domain 611 "domain.example", using the the "sample" profile: 613 C: 614 C: 615 C: 616 C: 617 C: 619 C: domain.example 620 C: 621 C: 622 C: 623 C: 627 C: 628 C: ABC-12345 629 C: 630 C: 632 If the query was successful, the server replies with a 633 element along with the regular EPP 634 . The element contains the 635 following child elements: 637 The status of the verification for the 638 object, using all of the verification profiles assigned to the 639 client. There are three possible values for the status: 641 nonCompliant The object is non-compliant according to the 642 verification profiles. If at least one of the profiles is 643 "nonCompliant", the object is "nonCompliant". 644 pendingCompliance The object is not in compliance with the 645 verification profiles, but has a grace period to set the 646 required set of verification codes, as reflected by the due 647 date of the verification code type. If at least one of the 648 profiles is "pendingComplaince" and none of the profiles is 649 "nonCompliant", the object is "pendingCompliance". 650 compliant The object is compliant with the verification 651 profiles. If All of the profiles for the object are 652 "complaint" or if the object has no assignd profiles, the 653 object is "compliant". 654 Zero or more OPTIONAL 655 elements that defines the verification 656 status of the object based on the profile. The required "name" 657 attribute defines the name of the profile. The 658 element contains the following child 659 elements: 661 The status of the verification for the 662 object and the profile. There are three possible values for 663 the status: 665 nonCompliant The object is non-compliant according to the 666 verification profile. 667 pendingCompliance The object is not in compliance with the 668 verification profile, but has a grace period to set the 669 required set of verification codes, as reflected by the 670 due date of the verification code type. 671 compliant The object is compliant with the verification 672 profile. 673 OPTIONAL list of missing verification 674 code types. The element is 675 returned only if there is at least one missing verification 676 code type and based on server policy. The 677 element contains the following 678 child elements: 680 One or more 681 elements that is empty with the REQUIRED "type" attribute 682 that indicates the verification code type and the 683 REQUIRED "due" attribute that indicates when the 684 verification code type was or is due. Past due 685 verification code types will result in the 686 element being set to 687 "nonCompliant". 688 OPTIONAL list of set verification codes. 689 The element is returned only if there 690 is at least one set verification code. The 691 element contains the following child 692 elements: 694 One or more 695 elements containing the verification code with a REQUIRED 696 "type" attribute that indicates the code type and a 697 REQUIRED "date" attribute that indicates when the 698 verification code was set. The inclusion of the code 699 value is up server policy, so if the server determines 700 that the code value cannot be exposed to a non-sponsoring 701 client, the element MUST be 702 empty. 704 Example domain response using the 705 extension for a compliant domain using the "sample" profile, and with 706 the two verification codes, from the sponsoring or authorized client: 708 S: 709 S: 710 S: 711 S: 712 S: Command completed successfully 713 S: 714 S: 715 S: 717 S: domain.example 718 S: DOMAIN-REP 719 S: 720 S: ClientX 721 S: ClientY 722 S: 2010-04-03T22:00:00.0Z 723 S: 724 S: 2015-04-03T22:00:00.0Z 725 S: 726 S: 727 S: 2fooBAR 728 S: 729 S: 730 S: 731 S: 732 S: 735 S: compliant 736 S: 737 S: 738 S: compliant 739 S: 740 S: 741 S: 1-abc333 743 S: 744 S: 1-abc444 746 S: 747 S: 748 S: 749 S: 750 S: 751 S: 752 S: ABC-12345 753 S: 54322-XYZ 754 S: 755 S: 756 S: 757 Example domain response using the 758 extension for a compliant domain using the "sample" profile, and with 759 the two verification code types, from the non-sponsoring client: 761 S: 762 S: 763 S: 764 S: 765 S: Command completed successfully 766 S: 767 S: 768 S: 770 S: domain.example 771 S: DOMAIN-REP 772 S: 773 S: ClientX 774 S: ClientY 775 S: 2010-04-03T22:00:00.0Z 776 S: 777 S: 2015-04-03T22:00:00.0Z 778 S: 779 S: 780 S: 781 S: 782 S: 785 S: compliant 786 S: 787 S: 788 S: compliant 789 S: 790 S: 791 S: 793 S: 795 S: 796 S: 797 S: 798 S: 799 S: 800 S: ABC-12345 801 S: 54322-XYZ 802 S: 803 S: 804 S: 805 Example domain response using the 806 extension for a non-compliant domain using the "sample" profile, and 807 with the verification code types missing along with their due dates: 809 S: 810 S: 811 S: 812 S: 813 S: Command completed successfully 814 S: 815 S: 816 S: 818 S: domain.example 819 S: DOMAIN-REP 820 S: 821 S: ClientX 822 S: ClientY 823 S: 2010-04-03T22:00:00.0Z 824 S: 825 S: 2015-04-03T22:00:00.0Z 826 S: 827 S: 828 S: 829 S: 830 S: 833 S: nonCompliant 834 S: 835 S: 836 S: nonCompliant 837 S: 838 S: 839 S: 842 S: 845 S: 846 S: 847 S: 848 S: 849 S: 850 S: ABC-12345 851 S: 54322-XYZ 852 S: 853 S: 854 S: 856 Example domain response using the 857 extension for a pending compliance domain using the "sample" profile, 858 with the verification code type missing along with the due date, and 859 with set verification code: 861 S: 862 S: 863 S: 864 S: 865 S: Command completed successfully 866 S: 867 S: 868 S: 870 S: domain.example 871 S: DOMAIN-REP 872 S: 873 S: ClientX 874 S: ClientY 875 S: 2010-04-03T22:00:00.0Z 876 S: 877 S: 2015-04-03T22:00:00.0Z 878 S: 879 S: 880 S: 881 S: 882 S: 885 S: pendingCompliance 886 S: 887 S: 888 S: pendingCompliance 889 S: 890 S: 891 S: 894 S: 895 S: 896 S: 1-abc333 898 S: 899 S: 900 S: 901 S: 902 S: 903 S: 904 S: ABC-12345 905 S: 54322-XYZ 906 S: 907 S: 908 S: 909 Example domain response using the 910 extension for a client that does not have a verification profile 911 assigned: 913 S: 914 S: 915 S: 916 S: 917 S: Command completed successfully 918 S: 919 S: 920 S: 922 S: domain.example 923 S: DOMAIN-REP 924 S: 925 S: ClientX 926 S: ClientY 927 S: 2010-04-03T22:00:00.0Z 928 S: 929 S: 2015-04-03T22:00:00.0Z 930 S: 931 S: 932 S: 933 S: 934 S: 937 S: compliant 938 S: 939 S: 940 S: 941 S: 942 S: ABC-12345 943 S: 54322-XYZ 944 S: 945 S: 946 S: 948 3.1.3. EPP Command 950 This extension does not add any elements to the EPP query 951 command or response described in the [RFC5730]. 953 3.2. EPP Transform Commands 955 EPP provides five commands to transform objects: to create 956 an instance of an object, to delete an instance of an 957 object, to extend the validity period of an object, 958 to manage object sponsorship changes, and to 959 change information associated with an object. 961 3.2.1. EPP Command 963 This extension defines additional elements to extend the EPP 964 command of an object mapping like the EPP domain name mapping 965 [RFC5731], EPP host mapping [RFC5732], and EPP contact mapping 966 [RFC5733]. 968 The EPP command provides a transform operation that allows a 969 client to create an object. In addition to the EPP command elements 970 described in an object mapping like [RFC5731], the command MAY 971 contain a child element, as 972 defined in Section 2.1.2, that identifies the extension namespace for 973 the client to provide proof of verification by a Verification Service 974 Provider (VSP). The server MAY support multiple policies for the 975 passing of the element based on 976 the client profile, which include: 978 required The client MUST pass a valid 979 element containing the 980 required set of verification codes. If a 981 element is not passed or the 982 required set of verification codes is not included, the server 983 MUST return an EPP error result code of 2306. If an invalid 984 element is passed, the 985 server MUST return an EPP error result code of 2005. 986 optional The client MAY pass a valid 987 element. If an invalid 988 element is passed, the 989 server MUST return an EPP error result code of 2005. 990 not supported The client MUST NOT pass a 991 element. If a 992 element is passed, the 993 server MUST return an EPP error result code of 2102. 995 Example command to create a domain object with a 996 verification code: 998 C: 999 C: 1000 C: 1001 C: 1002 C: 1004 C: domain.example 1005 C: jd1234 1006 C: sh8013 1007 C: sh8013 1008 C: 1009 C: 2fooBAR 1010 C: 1011 C: 1012 C: 1013 C: 1014 C: 1017 C: 1018 C:ICAgICAgPHZlcmlmaWNhdGlvbkNvZGU6c2lnbmVkQ29kZQogICAgICAgIHhtbG5z 1019 C:OnZlcmlmaWNhdGlvbkNvZGU9CiAgICAgICAgICAidXJuOmlldGY6cGFyYW1zOnht 1020 C:bDpuczp2ZXJpZmljYXRpb25Db2RlLTEuMCIKICAgICAgICAgIGlkPSJzaWduZWRD 1021 C:b2RlIj4KICAgCQk8dmVyaWZpY2F0aW9uQ29kZTpjb2RlPjEtYWJjMTIzPC92ZXJp 1022 C:ZmljYXRpb25Db2RlOmNvZGU+CiAgPFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3 1023 C:dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+CiAgIDxTaWduZWRJbmZvPgogICAg 1024 C:PENhbm9uaWNhbGl6YXRpb25NZXRob2QKIEFsZ29yaXRobT0iaHR0cDovL3d3dy53 1025 C:My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICA8U2lnbmF0dXJlTWV0 1026 C:aG9kCiBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNp 1027 C:Zy1tb3JlI3JzYS1zaGEyNTYiLz4KICAgIDxSZWZlcmVuY2UgVVJJPSIjc2lnbmVk 1028 C:Q29kZSI+CiAgICAgPFRyYW5zZm9ybXM+CiAgICAgIDxUcmFuc2Zvcm0KIEFsZ29y 1029 C:aXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3Bl 1030 C:ZC1zaWduYXR1cmUiLz4KICAgICA8L1RyYW5zZm9ybXM+CiAgICAgPERpZ2VzdE1l 1031 C:dGhvZAogQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVu 1032 C:YyNzaGEyNTYiLz4KIDxEaWdlc3RWYWx1ZT53Z3lXM25aUG9FZnBwdGxoUklMS25P 1033 C:UW5iZHRVNkFyTTdTaHJBZkhnREZnPTwvRGlnZXN0VmFsdWU+CiAgICA8L1JlZmVy 1034 C:ZW5jZT4KICAgPC9TaWduZWRJbmZvPgogICA8U2lnbmF0dXJlVmFsdWU+CiBqTXU0 1035 C:UGZ5UUdpSkJGMEdXU0VQRkNKam15d0NFcVIyaDRMRCtnZTZYUStKbm1LRkZDdUNa 1036 C:Uy8zU0xLQXgwTDF3CiBRREZPMmUwWTY5azJHNy9MR0UzN1gzdk9mbG9iRk0xb0d3 1037 C:amE4K0dNVnJhb3RvNXhBZDQvQUY3ZUh1a2dBeW1ECiBvOXRveG9hMmgweVY0QTRQ 1038 C:bVh6c1U2Uzg2WHRDY1VFK1MvV003Mm55bjQ3em9VQ3p6UEtIWkJSeWVXZWhWRlEr 1039 C:CiBqWVJNSUFNek01N0hIUUErNmVhWGVmUnZ0UEVUZ1VPNGFWSVZTdWdjNE9VQVpa 1040 C:d2JZY1pyQzZ3T2FRcXFxQVppCiAzMGFQT0JZYkF2SE1TbVdTUytoRmtic2hvbUpm 1041 C:SHhiOTdURDJncmxZTnJRSXpxWGs3V2JIV3kyU1lkQStzSS9aCiBpcEpzWE5hNm9z 1042 C:VFV3MUN6QTdqZndBPT0KICAgPC9TaWduYXR1cmVWYWx1ZT4KICAgPEtleUluZm8+ 1043 C:CiAgICA8WDUwOURhdGE+CiAgICA8WDUwOUNlcnRpZmljYXRlPgogTUlJRVNUQ0NB 1044 C:ekdnQXdJQkFnSUJBakFOQmdrcWhraUc5dzBCQVFzRkFEQmlNUXN3Q1FZRFZRUUdF 1045 C:d0pWVXpFTAogTUFrR0ExVUVDQk1DUTBFeEZEQVNCZ05WQkFjVEMweHZjeUJCYm1k 1046 C:bGJHVnpNUk13RVFZRFZRUUtFd3BKUTBGTwogVGlCVVRVTklNUnN3R1FZRFZRUURF 1047 C:eEpKUTBGT1RpQlVUVU5JSUZSRlUxUWdRMEV3SGhjTk1UTXdNakE0TURBdwogTURB 1048 C:d1doY05NVGd3TWpBM01qTTFPVFU1V2pCc01Rc3dDUVlEVlFRR0V3SlZVekVMTUFr 1049 C:R0ExVUVDQk1DUTBFeAogRkRBU0JnTlZCQWNUQzB4dmN5QkJibWRsYkdWek1SY3dG 1050 C:UVlEVlFRS0V3NVdZV3hwWkdGMGIzSWdWRTFEU0RFaAogTUI4R0ExVUVBeE1ZVm1G 1051 C:c2FXUmhkRzl5SUZSTlEwZ2dWRVZUVkNCRFJWSlVNSUlCSWpBTkJna3Foa2lHOXcw 1052 C:QgogQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBby9jd3ZYaGJWWWwwUkRXV3ZveWVa 1053 C:cEVUVlpWVmNNQ292VVZOZy9zdwogV2ludU1nRVdnVlFGcnoweEEwNHBFaFhDRlZ2 1054 C:NGV2YlVwZWtKNWJ1cVUxZ21ReU9zQ0tRbGhPSFRkUGp2a0M1dQogcERxYTUxRmxr 1055 C:MFRNYU1rSVFqczdhVUtDbUE0Ukc0dFRUR0svRWpSMWl4OC9EMGdIWVZSbGR5MVlQ 1056 C:ck1QK291NwogNWJPVm5Jb3MrSGlmckF0ckl2NHFFcXdMTDRGVFpBVXBhQ2EyQm1n 1057 C:WGZ5MkNTUlFieEQ1T3IxZ2NTYTN2dXJoNQogc1BNQ054cWFYbUlYbVFpcFMrRHVF 1058 C:QnFNTTh0bGRhTjdSWW9qVUVLckdWc05rNWk5eTIvN3NqbjF6eXlVUGY3dgogTDRH 1059 C:Z0RZcWhKWVdWNjFEblhneC9KZDZDV3h2c25ERjZzY3NjUXpVVEVsK2h5d0lEQVFB 1060 C:Qm80SC9NSUg4TUF3RwogQTFVZEV3RUIvd1FDTUFBd0hRWURWUjBPQkJZRUZQWkVj 1061 C:SVFjRC9CajJJRnovTEVSdW8yQURKdmlNSUdNQmdOVgogSFNNRWdZUXdnWUdBRk8w 1062 C:LzdrRWgzRnVFS1MrUS9rWUhhRC9XNndpaG9XYWtaREJpTVFzd0NRWURWUVFHRXdK 1063 C:VgogVXpFTE1Ba0dBMVVFQ0JNQ1EwRXhGREFTQmdOVkJBY1RDMHh2Y3lCQmJtZGxi 1064 C:R1Z6TVJNd0VRWURWUVFLRXdwSgogUTBGT1RpQlVUVU5JTVJzd0dRWURWUVFERXhK 1065 C:SlEwRk9UaUJVVFVOSUlGUkZVMVFnUTBHQ0FRRXdEZ1lEVlIwUAogQVFIL0JBUURB 1066 C:Z2VBTUM0R0ExVWRId1FuTUNVd0k2QWhvQitHSFdoMGRIQTZMeTlqY213dWFXTmhi 1067 C:bTR1YjNKbgogTDNSdFkyZ3VZM0pzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFC 1068 C:MnFTeTd1aSs0M2NlYktVS3dXUHJ6ejl5LwogSWtyTWVKR0tqbzQwbis5dWVrYXcz 1069 C:REo1RXFpT2YvcVo0cGpCRCsrb1I2QkpDYjZOUXVRS3dub0F6NWxFNFNzdQogeTUr 1070 C:aTkzb1QzSGZ5VmM0Z05NSW9IbTFQUzE5bDdEQktyYndiekFlYS8waktXVnpydm1W 1071 C:N1RCZmp4RDNBUW8xUgogYlU1ZEJyNklqYmRMRmxuTzV4MEcwbXJHN3g1T1VQdXVy 1072 C:aWh5aVVScEZEcHdIOEtBSDF3TWNDcFhHWEZSdEdLawogd3lkZ3lWWUF0eTdvdGts 1073 C:L3ozYlprQ1ZUMzRnUHZGNzBzUjYrUXhVeTh1MEx6RjVBL2JlWWFacHhTWUczMWFt 1074 C:TAogQWRYaXRUV0ZpcGFJR2VhOWxFR0ZNMEw5K0JnN1h6Tm40blZMWG9reUVCM2Jn 1075 C:UzRzY0c2UXpuWDIzRkdrCiAgIDwvWDUwOUNlcnRpZmljYXRlPgogICA8L1g1MDlE 1076 C:YXRhPgogICA8L0tleUluZm8+CiAgPC9TaWduYXR1cmU+CgkJPC92ZXJpZmljYXRp 1077 C:b25Db2RlOnNpZ25lZENvZGU+Cg== 1078 C: 1079 C: 1080 C: 1081 C: ABC-12345 1082 C: 1083 C: 1085 This extension does not add any elements to the EPP response 1086 described in the [RFC5730]. 1088 3.2.2. EPP Command 1090 This extension defines additional elements to extend the EPP 1091 command and response in the same fashion as defined for the EPP 1092 Command (Section 3.2.1). 1094 3.2.3. EPP Command 1096 This extension defines additional elements to extend the EPP 1097 command and response in the same fashion as defined for the EPP 1098 Command (Section 3.2.1). 1100 3.2.4. EPP Command 1102 This extension defines additional elements to extend the EPP 1103 command and response in the same fashion as defined for 1104 the EPP Command (Section 3.2.1). 1106 3.2.5. EPP Command 1108 This extension defines additional elements to extend the EPP 1109 command and response in the same fashion as defined for the EPP 1110 Command (Section 3.2.1). 1112 4. Formal Syntax 1114 One schema is presented here that is the EPP Verification Code 1115 Extension schema. 1117 The formal syntax presented here is a complete schema representation 1118 of the object mapping suitable for automated validation of EPP XML 1119 instances. The BEGIN and END tags are not part of the schema; they 1120 are used to note the beginning and ending of the schema for URI 1121 registration purposes. 1123 4.1. Verification Code Extension Schema 1125 BEGIN 1126 1127 1136 1137 1138 Extensible Provisioning Protocol v1.0 1139 Verification Code Extension. 1140 1141 1142 1145 1146 1150 1151 1153 1154 1158 1159 1160 1161 1162 1164 1165 1166 1167 1168 1169 1171 1172 1173 1174 1176 1177 1178 1180 1181 1184 1185 1186 1189 1191 1193 1194 1195 1196 1198 1199 1200 1202 1203 1205 1206 1207 1208 1209 1210 1211 1213 1214 1216 1217 1218 1220 1223 1224 1226 1227 1228 1230 1233 1236 1237 1239 1241 1242 1243 1244 1245 1246 1247 1249 1250 1251 1252 1254 1255 1256 1258 1259 1260 1263 1264 1266 1267 1268 1269 1271 1272 1273 1275 1276 1277 1280 1281 1283 1284 END 1286 5. IANA Considerations 1288 5.1. XML Namespace 1290 This document uses URNs to describe XML namespaces and XML schemas 1291 conforming to a registry mechanism described in [RFC3688]. 1293 Registration request for the verificationCode namespace: 1295 URI: ietf:params:xml:ns:verificationCode-1.0 1296 Registrant Contact: See the "Author's Address" section of this 1297 document. 1298 XML: None. Namespace URIs do not represent an XML specification. 1300 Registration request for the verificationCode XML schema: 1302 URI: ietf:params:xml:ns:verificationCode-1.0 1303 Registrant Contact: See the "Author's Address" section of this 1304 document. 1305 XML: See the "Formal Syntax" section of this document. 1307 5.2. EPP Extension Registry 1309 The EPP extension described in this document should be registered by 1310 the IANA in the EPP Extension Registry described in [RFC7451]. The 1311 details of the registration are as follows: 1313 Name of Extension: "Verification Code Extension for the Extensible 1314 Provisioning Protocol (EPP)" 1316 Document status: Standards Track 1318 Reference: (insert reference to RFC version of this document) 1320 Registrant Name and Email Address: IESG, 1322 TLDs: Any 1324 IPR Disclosure: None 1326 Status: Active 1328 Notes: None 1330 6. Security Considerations 1332 The mapping extension described in this document is based on the 1333 security services described by EPP [RFC5730] and protocol layers used 1334 by EPP. The security considerations described in these other 1335 specifications apply to this specification as well. 1337 XML Signature [W3C.CR-xmldsig-core2-20120124] is used in this 1338 extension to verify that the Verification Code originated from a 1339 trusted Verification Service Provider (VSP) and that it wasn't 1340 tampered with in transit from the VSP to the client to the server. 1341 To support multiple VSP keys, the VSP certificate chain MUST be 1342 included in the elements of the Signed Code 1343 (Section 2.1.1) and MUST chain up and be verified by the server 1344 against a set of trusted certificates. 1346 It is RECOMMENDED that signed codes do not include white-spaces 1347 between the XML elements in order to mitigate risks of invalidating 1348 the digital signature when transferring of signed codes between 1349 applications takes place. 1351 Use of XML canonicalization SHOULD be used when generating the signed 1352 code. SHA256/RSA-SHA256 SHOULD be used for digesting and signing. 1353 The size of the RSA key SHOULD be at least 2048 bits. 1355 7. Normative References 1357 [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail 1358 Extensions (MIME) Part One: Format of Internet Message 1359 Bodies", RFC 2045, November 1996. 1361 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1362 Requirement Levels", BCP 14, RFC 2119, March 1997. 1364 [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, 1365 January 2004. 1367 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 1368 Specifications: ABNF", STD 68, RFC 5234, January 2008. 1370 [RFC5730] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", 1371 STD 69, RFC 5730, August 2009. 1373 [RFC5731] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) 1374 Domain Name Mapping", STD 69, RFC 5731, August 2009. 1376 [RFC5732] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) 1377 Host Mapping", STD 69, RFC 5732, August 2009. 1379 [RFC5733] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) 1380 Contact Mapping", STD 69, RFC 5733, August 2009. 1382 [RFC7451] Hollenbeck, S., "Extension Registry for the Extensible 1383 Provisioning Protocol", RFC 7451, February 2015. 1385 [W3C.CR-xmldsig-core2-20120124] 1386 Cantor, S., Roessler, T., Eastlake, D., Yiu, K., Reagle, 1387 J., Solo, D., Datta, P., and F. Hirsch, "XML Signature 1388 Syntax and Processing Version 2.0", World Wide Web 1389 Consortium CR CR-xmldsig-core2-20120124, January 2012, 1390 . 1392 Appendix A. Acknowledgements 1394 Appendix B. Change History 1396 Author's Address 1398 James Gould 1399 VeriSign, Inc. 1400 12061 Bluemont Way 1401 Reston, VA 20190 1402 US 1404 Email: jgould@verisign.com 1405 URI: http://www.verisign.com