idnits 2.17.1 draft-snell-atompub-tombstones-10.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The draft header indicates that this document updates RFC4287, but the abstract doesn't seem to mention this, which it should. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords -- however, there's a paragraph with a matching beginning. Boilerplate error? (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). (Using the creation date from RFC4287, updated by this document, for RFC5378 checks: 2004-07-09) -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (June 22, 2010) is 5056 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- ** Obsolete normative reference: RFC 3023 (Obsoleted by RFC 7303) Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 3 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Snell 3 Internet-Draft June 22, 2010 4 Updates: 4287 (if approved) 5 Intended status: Informational 6 Expires: December 24, 2010 8 The Atom "deleted-entry" Element 9 draft-snell-atompub-tombstones-10.txt 11 Abstract 13 This specification adds mechanisms to the Atom Syndication Format 14 which publishers of Atom Feed and Entry documents can use to 15 explicitly identify Atom entries that have been removed. 17 Status of this Memo 19 This Internet-Draft is submitted to IETF in full conformance with the 20 provisions of BCP 78 and BCP 79. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF). Note that other groups may also distribute 24 working documents as Internet-Drafts. The list of current Internet- 25 Drafts is at http://datatracker.ietf.org/drafts/current/. 27 Internet-Drafts are draft documents valid for a maximum of six months 28 and may be updated, replaced, or obsoleted by other documents at any 29 time. It is inappropriate to use Internet-Drafts as reference 30 material or to cite them other than as "work in progress." 32 This Internet-Draft will expire on December 24, 2010. 34 Copyright Notice 36 Copyright (c) 2010 IETF Trust and the persons identified as the 37 document authors. All rights reserved. 39 This document is subject to BCP 78 and the IETF Trust's Legal 40 Provisions Relating to IETF Documents 41 (http://trustee.ietf.org/license-info) in effect on the date of 42 publication of this document. Please review these documents 43 carefully, as they describe your rights and restrictions with respect 44 to this document. Code Components extracted from this document must 45 include Simplified BSD License text as described in Section 4.e of 46 the Trust Legal Provisions and are provided without warranty as 47 described in the Simplified BSD License. 49 Table of Contents 51 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 52 2. Notational Conventions . . . . . . . . . . . . . . . . . . . . 3 53 3. The at:deleted-entry element . . . . . . . . . . . . . . . . . 3 54 4. Deleted Entry Document . . . . . . . . . . . . . . . . . . . . 5 55 5. Digital Signatures . . . . . . . . . . . . . . . . . . . . . . 6 56 6. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . 7 57 7. Security Considerations . . . . . . . . . . . . . . . . . . . 7 58 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 59 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9 60 10. Normative References . . . . . . . . . . . . . . . . . . . . . 9 61 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 11 63 1. Introduction 65 This specification adds mechanisms to the Atom Syndication Format 66 which publishers of Atom Feed and Entry documents can use to 67 explicitly identify Atom entries that have been removed. 69 2. Notational Conventions 71 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 72 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 73 document are to be interpreted as described in BCP 14, [RFC2119] 75 This specification uses XML Namespaces [W3C.REC-xml-names-19990114] 76 to uniquely identify XML element names. It uses the following 77 namespace prefix for the indicated namespace URI; 79 "at": "http://purl.org/atompub/tombstones/1.0" 81 3. The at:deleted-entry element 83 The at:deleted-entry element represents an Atom Entry that has been 84 removed. 86 deletedEntry = element at:deleted-entry { 87 atomCommonAttributes, 88 attribute ref { atomUri }, 89 attribute when { atomDateConstruct }, 90 ( element at:by { atomPersonConstruct}?, 91 & element at:comment {atomTextConstruct}?, 92 & element atom:link*, 93 & element atom:source?, 94 & extensionElement* ) 95 } 97 The at:deleted-entry element MUST contain a ref attribute whose value 98 specifies the value of the atom:id of the entry that has been 99 removed. 101 The at:deleted-entry element MUST contain a when attribute whose 102 value is an [RFC3339] "date-time" specifying the instant the entry 103 was removed. An uppercase "T" character MUST be used to separate 104 date and time, and an uppercase "Z" character MUST be present in the 105 absence of a numeric time zone offset 107 The at:deleted-entry element MAY contain one at:by element used to 108 identify the entity that removed the entry. The at:by element is an 109 Atom Person Construct as defined by Section 3.2 of [RFC4287]. 111 The at:deleted-entry element MAY contain one at:comment element whose 112 value provides additional, language-sensitive information about the 113 deletion operation. The atom:comment element is an Atom Text 114 Construct as defined by Section 3.1 of [RFC4287]. 116 The at:deleted-entry element MAY contain any number of atom:link 117 elements as specified by Section 4.2.7 of [RFC4287]. 119 The at:deleted-entry element MAY contain one atom:source element as 120 defined by Section 4.2.11 of [RFC4287]. Within the context of an at: 121 deleted-entry element, the atom:source element is intended to allow 122 the aggregation of at:deleted-entry element from different feeds 123 while retaining information about an at:deleted-entry's source feed. 124 When an at:deleted-entry element appears in a Feed document other 125 than it's source Feed or when an at:deleted-entry element that has a 126 source Feed document is used in the context of a Deleted Entry 127 Document, it MUST contain an atom:source element. 129 An Atom feed MAY contain any number of at:deleted-entry elements, but 130 MUST NOT contain more than one with the same combination of ref and 131 when attribute values. 133 135 ... 136 137 141 142 145 146 John Doe 147 jdoe@example.org 148 149 Removed comment spam 150 151 ... 152 154 An Atom feed MAY contain atom:entry elements and at:deleted-entry 155 elements sharing the same atom:id value. Atom processors SHOULD 156 ignore any at:deleted-entry elements sharing an atom:id value with an 157 atom:entry whose atom:updated element specifies a date and time more 158 recent than or equal to the at:deleted-entry element's when value. 160 Implementors should note that the at:deleted-entry element is 161 informative in nature only and may be ignored by Atom processors. 162 The presence of an at:deleted-entry element does not guarantee that 163 the atom:entry to which it is referring will no longer be available. 165 Elements and attributes from other XML vocabularies MAY be used 166 within an at:deleted-entry element following the same model defined 167 by Section 6 of [RFC4287]. Processors encountering such markup MUST 168 NOT stop processing or signal an error. It might be the case that 169 the Processor is able to process the foreign markup correctly and 170 does so. When unknown markup is encountered as a child of at: 171 deleted-entry, Processors MAY bypass the markup and any textual 172 content and MUST NOT change their behavior as a result of the 173 markup's presence. 175 This specification allows the use of IRIs [RFC3987] in precisely the 176 same manner specified in Section 2 of [RFC4287]. 178 Any element defined by this specification MAY have an xml:base 179 attribute [W3C.REC-xmlbase-20010627]. When xml:base is used, it 180 serves the function described in section 5.1.1 of [RFC3986], 181 establishing the base URI (or IRI) for resolving any relative 182 references found within the effective scope of the xml:base 183 attribute. 185 Any element defined by this specification MAY have an xml:lang 186 attribute, whose content indicates the natural language for the 187 element and its descendents. Requirements regarding the content and 188 interpretation of xml:lang are specified in XML 1.0 189 [W3C.REC-xml-20040204], Section 2.12. 191 4. Deleted Entry Document 193 A "Deleted Entry Document" represents exactly one at:deleted-entry 194 element outside the context of an Atom feed. It's root is the at: 195 deleted-entry element. 197 namespace at = "http://purl.org/atompub/tombstones/1.0" 198 start = at:deleted-entry 200 Deleted Entry Documents are specified in terms of the XML Information 201 Set, serialized as XML 1.0 [W3C.REC-xml-20040204] and identified with 202 the "application/atomdeleted+xml" media type. Deleted Entry 203 Documents MUST be well-formed XML. This specification does not 204 define a DTD for Deleted Entry Documents, and hence does not require 205 them to be valid (in the sense used by XML). 207 5. Digital Signatures 209 The at:deleted-entry element MAY have an Enveloped Signature, as 210 described by XML-Signature and Syntax Processing 211 [W3C.REC-xmldsig-core-20020212]. 213 Processors MUST NOT reject an at:deleted-entry containing such a 214 signature because they are not capable of verifying it; they MUST 215 continue processing and MAY inform the user of their failure to 216 validate the signature. 218 In other words, the presence of an element with the namespace URI 219 "http://www.w3.org/2000/09/xmldsig#" and a local name of "Signature" 220 as a child of the document element MUST NOT cause an Processor to 221 fail merely because of its presence. 223 Section 6.5.1 of [W3C.REC-xmldsig-core-20020212] requires support for 224 Canonical XML [W3C.REC-xml-c14n-20010315]. However, many 225 implementers do not use it because signed XML documents enclosed in 226 other XML documents have their signatures broken. Thus, Processors 227 that verify signed at:deleted-entry elements MUST be able to 228 canonicalize with the exclusive XML canonicalization method 229 identified by the URI "http://www.w3.org/2001/10/xml-exc-c14n#", as 230 specified in Exclusive XML Canonicalization 231 [W3C.REC-xml-exc-c14n-20020718]. 233 Intermediaries such as aggregators may need to add an atom:source 234 element to an at:deleted-entry that does not contain its own atom: 235 source element. If such an entry is signed, the addition will break 236 the signature. Thus, a publisher of individually-signed at:deleted- 237 entry's should strongly consider adding an atom:source element to 238 those elements before signing them. Implementers should also be 239 aware of the issues concerning the use of markup in the "xml:" 240 namespace as it interacts with canonicalization. 242 Section 4.4.2 of [W3C.REC-xmldsig-core-20020212] requires support for 243 DSA signatures and recommends support for RSA signatures. However, 244 because of the much greater popularity in the market of RSA versus 245 DSA, Atom Processors that verify signed Atom Documents MUST be able 246 to verify RSA signatures, but do not need be able to verify DSA 247 signatures. Due to security issues that can arise if the keying 248 material for message authentication code (MAC) authentication is not 249 handled properly, Atom Documents SHOULD NOT use MACs for signatures. 251 6. Encryption 253 The root of a Deleted Entry Document (the at:deleted-entry element) 254 MAY be encrypted, using the mechanisms described by XML Encryption 255 Syntax and Processing [W3C.REC-xmlenc-core-20021210]. 257 Section 5.1 of [W3C.REC-xmlenc-core-20021210] requires support of 258 TripleDES, AES-128, and AES-256. Processors that decrypt Deleted 259 Entry Documents MUST be able to decrypt with AES-128 in Cipher Block 260 Chaining (CBC) mode. 262 Encryption based on [W3C.REC-xmlenc-core-20021210] does not ensure 263 integrity of the original document. There are known cryptographic 264 attacks where someone who cannot decrypt a message can still change 265 bits in a way where part or all the decrypted message makes sense but 266 has a different meaning. Thus, Processors that decrypt Deleted Entry 267 Documents SHOULD check the integrity of the decrypted document by 268 verifying the hash in the signature (if any) in the document, or by 269 verifying a hash of the document within the document (if any). 271 When a Deleted Entry Document is to be both signed and encrypted, it 272 is generally a good idea to first sign the document, then encrypt the 273 signed document. This provides integrity to the base document while 274 encrypting all the information, including the identity of the entity 275 that signed the document. Note that, if MACs are used for 276 authentication, the order MUST be that the document is signed and 277 then encrypted, and not the other way around. 279 7. Security Considerations 281 As specified in [RFC4287], Atom processors should be aware of the 282 potential for spoofing attacks where an attacker publishes atom:entry 283 or atom:deleted-entry elements using the same atom:id values as 284 entries from other Atom feeds. An attacker may attempt to trick an 285 application into believing that a given entry has either been removed 286 from or added to a feed. To mitigate this issue, Atom processors are 287 advised to ignore at:deleted-entry elements referencing entries that 288 have not previously appeared within the containing Feed document and 289 should take steps to verify the origin of the Atom feed before 290 considering the entries to be removed. 292 The at:deleted-entry element can be encrypted and signed using 293 [W3C.REC-xmlenc-core-20021210] and [W3C.REC-xmldsig-core-20020212], 294 respectively, and are subject to the security considerations implied 295 by their use. 297 Digital signatures provide authentication, message integrity, and 298 non-repudiation with proof of origin. Encryption provides data 299 confidentiality. 301 An application supporting the use of digitally signed atom:entry and 302 at:deleted-entry elements should be aware of the potential issues 303 that could arise if a at:deleted-entry element indicating the 304 deletion of an atom:entry element has been signed using a different 305 key than what was used to sign the atom:entry, or when an unsigned 306 at:deleted-entry is used to indicate the deletion of a signed atom: 307 entry. Either case can potentially indicate a form of spoofing 308 attack. Processors must take steps to verify the validity of the at: 309 deleted-entry element. 311 8. IANA Considerations 313 A Deleted Entry Document, when serialized as XML 1.0, can be 314 identified with the following media type: 316 MIME media type name: application 317 MIME subtype name: atomdeleted+xml 318 Mandatory parameters: None. 319 Optional parameters: 320 "charset": This parameter has semantics identical to the charset 321 parameter of the "application/xml" media type as specified in 322 [RFC3023]. 323 Encoding considerations: Identical to those of "application/xml" as 324 described in [RFC3023], Section 3.2. 325 Security considerations: As defined in this specification. 326 In addition, as this media type uses the "+xml" convention, it 327 shares the same security considerations as described in [RFC3023], 328 Section 10. 329 Interoperability considerations: There are no known interoperability 330 issues. 331 Published specification: This specification. 332 Applications that use this media type: No known applications 333 currently use this media type. 335 Additional information: 337 Magic number(s): As specified for "application/xml" in [RFC3023], 338 Section 3.2. 339 File extension: .atomdeleted 340 Fragment identifiers: As specified for "application/xml" in 341 [RFC3023], Section 5. 342 Base URI: As specified in [RFC3023], Section 6. 343 Macintosh File Type code: TEXT 344 Person and email address to contact for further information: 345 James M Snell 346 Intended usage: COMMON 347 Author/Change controller: IESG 349 9. Acknowledgements 351 The author gratefully acknowledges the feedback from the members of 352 the Atom Publishing Format and Protocol working group during the 353 development of this specification. 355 10. Normative References 357 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 358 Requirement Levels", BCP 14, RFC 2119, March 1997. 360 [RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media 361 Types", RFC 3023, January 2001. 363 [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the 364 Internet: Timestamps", RFC 3339, July 2002. 366 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 367 Resource Identifier (URI): Generic Syntax", STD 66, 368 RFC 3986, January 2005. 370 [RFC3987] Duerst, M. and M. Suignard, "Internationalized Resource 371 Identifiers (IRIs)", RFC 3987, January 2005. 373 [RFC4287] Nottingham, M., Ed. and R. Sayre, Ed., "The Atom 374 Syndication Format", RFC 4287, December 2005. 376 [W3C.REC-xml-20040204] 377 Bray, T., Maler, E., Sperberg-McQueen, C., Paoli, J., and 378 F. Yergeau, "Extensible Markup Language (XML) 1.0 (Third 379 Edition)", World Wide Web Consortium FirstEdition REC-xml- 380 20040204, February 2004, 381 . 383 [W3C.REC-xml-c14n-20010315] 384 Boyer, J., "Canonical XML Version 1.0", World Wide Web 385 Consortium Recommendation REC-xml-c14n-20010315, 386 March 2001, 387 . 389 [W3C.REC-xml-exc-c14n-20020718] 390 Reagle, J., Boyer, J., and D. 3rd, "Exclusive XML 391 Canonicalization Version 1.0", World Wide Web Consortium 392 Recommendation REC-xml-exc-c14n-20020718, July 2002, 393 . 395 [W3C.REC-xml-names-19990114] 396 Hollander, D., Bray, T., and A. Layman, "Namespaces in 397 XML", World Wide Web Consortium FirstEdition REC-xml- 398 names-19990114, January 1999, 399 . 401 [W3C.REC-xmlbase-20010627] 402 Marsh, J., "XML Base", World Wide Web Consortium 403 FirstEdition REC-xmlbase-20010627, June 2001, 404 . 406 [W3C.REC-xmldsig-core-20020212] 407 Solo, D., Eastlake, D., and J. Reagle, "XML-Signature 408 Syntax and Processing", World Wide Web Consortium 409 FirstEdition REC-xmldsig-core-20020212, February 2002, 410 . 412 [W3C.REC-xmlenc-core-20021210] 413 Eastlake, D. and J. Reagle, "XML Encryption Syntax and 414 Processing", World Wide Web Consortium Recommendation REC- 415 xmlenc-core-20021210, December 2002, 416 . 418 Author's Address 420 James M Snell 422 Phone: 423 Email: jasnell@us.ibm.com 424 URI: http://ibm.com