idnits 2.17.1 draft-snell-atompub-tombstones-17.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (July 16, 2012) is 4300 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 3023 (Obsoleted by RFC 7303) Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Snell 3 Internet-Draft July 16, 2012 4 Intended status: Standards Track 5 Expires: January 17, 2013 7 The Atom "deleted-entry" Element 8 draft-snell-atompub-tombstones-17 10 Abstract 12 This specification adds mechanisms to the Atom Syndication Format 13 which publishers of Atom Feed and Entry documents can use to 14 explicitly identify Atom entries that have been removed. 16 Status of this Memo 18 This Internet-Draft is submitted to IETF in full conformance with the 19 provisions of BCP 78 and BCP 79. 21 Internet-Drafts are working documents of the Internet Engineering 22 Task Force (IETF). Note that other groups may also distribute 23 working documents as Internet-Drafts. The list of current Internet- 24 Drafts is at http://datatracker.ietf.org/drafts/current/. 26 Internet-Drafts are draft documents valid for a maximum of six months 27 and may be updated, replaced, or obsoleted by other documents at any 28 time. It is inappropriate to use Internet-Drafts as reference 29 material or to cite them other than as "work in progress." 31 This Internet-Draft will expire on January 17, 2013. 33 Copyright Notice 35 Copyright (c) 2012 IETF Trust and the persons identified as the 36 document authors. All rights reserved. 38 This document is subject to BCP 78 and the IETF Trust's Legal 39 Provisions Relating to IETF Documents 40 (http://trustee.ietf.org/license-info) in effect on the date of 41 publication of this document. Please review these documents 42 carefully, as they describe your rights and restrictions with respect 43 to this document. Code Components extracted from this document must 44 include Simplified BSD License text as described in Section 4.e of 45 the Trust Legal Provisions and are provided without warranty as 46 described in the Simplified BSD License. 48 Table of Contents 50 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 51 2. Notational Conventions . . . . . . . . . . . . . . . . . . . . 3 52 3. The at:deleted-entry element . . . . . . . . . . . . . . . . . 3 53 4. Deleted Entry Document . . . . . . . . . . . . . . . . . . . . 6 54 5. Digital Signatures . . . . . . . . . . . . . . . . . . . . . . 6 55 6. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . 7 56 7. Security Considerations . . . . . . . . . . . . . . . . . . . 8 57 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 58 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9 59 10. Normative References . . . . . . . . . . . . . . . . . . . . . 9 60 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 10 62 1. Introduction 64 This specification adds mechanisms to the Atom Syndication Format 65 which publishers of Atom Feed and Entry documents can use to 66 explicitly identify Atom entries that have been removed. 68 2. Notational Conventions 70 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 71 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 72 document are to be interpreted as described in [RFC2119]. 74 This specification uses XML Namespaces [W3C.REC-xml-names-19990114] 75 to uniquely identify XML element names. It uses the following 76 namespace prefix for the indicated namespace URI; 78 "at": "http://purl.org/atompub/tombstones/1.0" 80 3. The at:deleted-entry element 82 The at:deleted-entry element represents an Atom Entry that has been 83 removed. 85 deletedEntry = 86 element at:deleted-entry { 87 atomCommonAttributes, 88 attribute ref { atomUri }, 89 attribute when { atomDateConstruct }, 90 ( element at:by { atomPersonConstruct }? 91 & element at:comment { atomTextConstruct }? 92 & element atom:link { atomLink }* 93 & element atom:source { atomSource }? 94 & anyElement* ) 95 } 97 The at:deleted-entry element MUST contain a ref attribute whose value 98 specifies the value of the atom:id of the entry that has been 99 removed. 101 The at:deleted-entry element MUST contain a when attribute whose 102 value is an [RFC3339] "date-time" specifying the instant the entry 103 was removed. An uppercase "T" character MUST be used to separate 104 date and time, and an uppercase "Z" character MUST be present in the 105 absence of a numeric time zone offset 107 The at:deleted-entry element MAY contain one at:by element used to 108 identify the entity that removed the entry. The at:by element is an 109 Atom Person Construct as defined by Section 3.2 of [RFC4287]. 111 The at:deleted-entry element MAY contain one at:comment element whose 112 value provides additional, language-sensitive information about the 113 deletion operation. The atom:comment element is an Atom Text 114 Construct as defined by Section 3.1 of [RFC4287]. 116 The at:deleted-entry element MAY contain any number of atom:link 117 elements as specified by Section 4.2.7 of [RFC4287]. 119 The at:deleted-entry element MAY contain one atom:source element as 120 defined by Section 4.2.11 of [RFC4287]. Within the context of an at: 121 deleted-entry element, the atom:source element is intended to allow 122 the aggregation of at:deleted-entry element from different feeds 123 while retaining information about an at:deleted-entry's source feed. 124 When an at:deleted-entry element appears in a Feed document other 125 than it's source Feed or when an at:deleted-entry element that has a 126 source Feed document is used in the context of a Deleted Entry 127 Document, it MUST contain an atom:source element. 129 An Atom feed MAY contain any number of at:deleted-entry elements, but 130 MUST NOT contain more than one with the same combination of ref and 131 when attribute values. 133 135 ... 136 137 141 142 145 146 John Doe 147 jdoe@example.org 148 149 Removed comment spam 150 151 ... 152 154 An Atom feed MAY contain atom:entry elements and at:deleted-entry 155 elements sharing the same atom:id value. In such cases, the 156 implication is that the particular atom:entry has either been 157 published to the feed and then subsequently removed; or that a 158 previously removed entry has been republished to the feed following a 159 previous deletion. To determine which condition applies, the 160 processor needs to compare the value of the at:deleted-entry 161 element's when attribute to the value of the corresponding atom:entry 162 element's atom:updated value: 163 o If the when attribute specifies a value equal to or more recent 164 than that specified by the atom:updated element, the atom:entry is 165 assumed to have been published then subsequently removed. 166 Processors SHOULD ignore the older atom:entry element. 167 o If the when attribute specifies a value older than that specified 168 by the atom:updated element, the atom:entry is assumed to have 169 been republished to the feed following a prior removal. 170 Processors SHOULD ignore the older at:deleted-entry element. 172 Publishers of feeds containing at:deleted-entry elements should note 173 that the at:deleted-entry element is advisory in nature only and may 174 be ignored by Atom processors. The presence of an at:deleted-entry 175 element does not guarantee that the atom:entry to which it is 176 referring will no longer be available. For example, if an entry was 177 published to a feed document that was published and processed 178 yesterday by an aggregator application, then is subsequently deleted 179 today, with a corresponding at:deleted-entry element added to the 180 feed as a signal that the entry was deleted, there is no guarantee 181 that the aggregator application will pay any attention to the at: 182 deleted-entry element during subsequent processing operations. 184 Elements and attributes from any XML vocabulary MAY be used within an 185 at:deleted-entry element. Processors encountering such markup MUST 186 NOT stop processing or signal an error. It might be the case that 187 the Processor is able to process the foreign markup correctly and 188 does so. When unknown markup is encountered as a child of at: 189 deleted-entry, Processors MAY bypass the markup and any textual 190 content and MUST NOT change their behavior as a result of the 191 markup's presence. 193 This specification allows the use of IRIs [RFC3987] in precisely the 194 same manner specified in Section 2 of [RFC4287]. 196 Any element defined by this specification MAY have an xml:base 197 attribute [W3C.REC-xmlbase-20010627]. When xml:base is used, it 198 serves the function described in section 5.1.1 of [RFC3986], 199 establishing the base URI (or IRI) for resolving any relative 200 references found within the effective scope of the xml:base 201 attribute. 203 Any element defined by this specification MAY have an xml:lang 204 attribute, whose content indicates the natural language for the 205 element and its descendents. Requirements regarding the content and 206 interpretation of xml:lang are specified in XML 1.0 207 [W3C.REC-xml-20040204], Section 2.12. 209 4. Deleted Entry Document 211 A "Deleted Entry Document" represents exactly one at:deleted-entry 212 element outside the context of an Atom feed. It's root is the at: 213 deleted-entry element. 215 namespace at = "http://purl.org/atompub/tombstones/1.0" 216 start = at:deleted-entry 218 Deleted Entry Documents are specified in terms of the XML Information 219 Set, serialized as XML 1.0 [W3C.REC-xml-20040204] and identified with 220 the "application/atomdeleted+xml" media type. Deleted Entry 221 Documents MUST be well-formed XML. This specification does not 222 define a DTD for Deleted Entry Documents, and hence does not require 223 them to be valid (in the sense used by XML). 225 5. Digital Signatures 227 The at:deleted-entry element MAY have an Enveloped Signature, as 228 described by XML-Signature and Syntax Processing 229 [W3C.REC-xmldsig-core-20020212]. 231 Processors MUST NOT reject an at:deleted-entry containing such a 232 signature because they are not capable of verifying it; they MUST 233 continue processing and MAY inform the user of their failure to 234 validate the signature. 236 In other words, the presence of an element with the namespace URI 237 "http://www.w3.org/2000/09/xmldsig#" and a local name of "Signature" 238 as a child of the document element MUST NOT cause an Processor to 239 fail merely because of its presence. 241 Section 6.5.1 of [W3C.REC-xmldsig-core-20020212] requires support for 242 Canonical XML [W3C.REC-xml-c14n-20010315]. However, many 243 implementers do not use it because signed XML documents enclosed in 244 other XML documents have their signatures broken. Thus, Processors 245 that verify signed at:deleted-entry elements MUST be able to 246 canonicalize with the exclusive XML canonicalization method 247 identified by the URI "http://www.w3.org/2001/10/xml-exc-c14n#", as 248 specified in Exclusive XML Canonicalization 249 [W3C.REC-xml-exc-c14n-20020718]. 251 Intermediaries such as aggregators may need to add an atom:source 252 element to an at:deleted-entry that does not contain its own atom: 253 source element. If such an entry is signed, the addition will break 254 the signature. Thus, a publisher of individually-signed at:deleted- 255 entry's should strongly consider adding an atom:source element to 256 those elements before signing them. Implementers should also be 257 aware of the issues concerning the use of markup in the "xml:" 258 namespace as it interacts with canonicalization. 260 Section 4.4.2 of [W3C.REC-xmldsig-core-20020212] requires support for 261 DSA signatures and recommends support for RSA signatures. However, 262 because of the much greater popularity in the market of RSA versus 263 DSA, Atom Processors that verify signed Atom Documents MUST be able 264 to verify RSA signatures, but do not need be able to verify DSA 265 signatures. Due to security issues that can arise if the keying 266 material for message authentication code (MAC) authentication is not 267 handled properly, Atom Documents SHOULD NOT use MACs for signatures. 269 6. Encryption 271 The root of a Deleted Entry Document (the at:deleted-entry element) 272 MAY be encrypted, using the mechanisms described by XML Encryption 273 Syntax and Processing [W3C.REC-xmlenc-core-20021210]. 275 Section 5.1 of [W3C.REC-xmlenc-core-20021210] requires support of 276 TripleDES, AES-128, and AES-256. Processors that decrypt Deleted 277 Entry Documents MUST be able to decrypt with AES-128 in Cipher Block 278 Chaining (CBC) mode. 280 Encryption based on [W3C.REC-xmlenc-core-20021210] does not ensure 281 integrity of the original document. There are known cryptographic 282 attacks where someone who cannot decrypt a message can still change 283 bits in a way where part or all the decrypted message makes sense but 284 has a different meaning. Thus, Processors that decrypt Deleted Entry 285 Documents SHOULD check the integrity of the decrypted document by 286 verifying the hash in the signature (if any) in the document, or by 287 verifying a hash of the document within the document (if any). 289 When a Deleted Entry Document is to be both signed and encrypted, it 290 is generally a good idea to first sign the document, then encrypt the 291 signed document. This provides integrity to the base document while 292 encrypting all the information, including the identity of the entity 293 that signed the document. Note that, if MACs are used for 294 authentication, the order MUST be that the document is signed and 295 then encrypted, and not the other way around. Further, if MACs are 296 used along with a symmetric encryption algorithm, the same key SHOULD 297 NOT be used in the generation of the MAC and the encryption. 299 7. Security Considerations 301 As specified in [RFC4287], Atom processors should be aware of the 302 potential for spoofing attacks where an attacker publishes atom:entry 303 or atom:deleted-entry elements using the same atom:id values as 304 entries from other Atom feeds. An attacker may attempt to trick an 305 application into believing that a given entry has either been removed 306 from or added to a feed. To mitigate this issue, Atom processors are 307 advised to ignore at:deleted-entry elements referencing entries that 308 have not previously appeared within the containing Feed document and 309 should take steps to verify the origin of the Atom feed before 310 considering the entries to be removed. 312 The at:deleted-entry element can be encrypted and signed using 313 [W3C.REC-xmlenc-core-20021210] and [W3C.REC-xmldsig-core-20020212], 314 respectively, and are subject to the security considerations implied 315 by their use. 317 Digital signatures provide authentication and message integrity with 318 proof of origin. Encryption provides data confidentiality. 320 An application supporting the use of digitally signed atom:entry and 321 at:deleted-entry elements should be aware of the potential issues 322 that could arise if a at:deleted-entry element indicating the 323 deletion of an atom:entry element has been signed using a different 324 key than what was used to sign the atom:entry, or when an unsigned 325 at:deleted-entry is used to indicate the deletion of a signed atom: 326 entry. Either case can potentially indicate a form of spoofing 327 attack. Processors must take steps to verify the validity of the at: 328 deleted-entry element. 330 8. IANA Considerations 332 A Deleted Entry Document, when serialized as XML 1.0, can be 333 identified with the following media type: 335 Type name: application 336 Subtype name: atomdeleted+xml 337 Required parameters: None 338 Optional parameters: "charset" : This parameter has semantics 339 identical to the charset parameter of the "application/xml" media 340 type as specified in [RFC3023]. 341 Encoding considerations: Identical to those of "application/xml" 342 as described in [RFC3023], Section 3.2. 343 Security considerations: As defined in this specification. In 344 addition, as this media type uses the "+xml" convention, it shares 345 the same security considerations as described in [RFC3023], 346 Section 10. 347 Interoperability considerations: There are no known 348 interoperability issues. 349 Published specification: This specification. 350 Applications that use this media type: Undefined. As an extension 351 to the Atom Syndication Format ([RFC4287]), this specification may 352 be used within any application that uses the Atom Format. 353 Additional information: 354 Magic number(s): As specified for "application/xml" in 355 [RFC3023], Section 3.2 356 File extension(s): .atomdeleted 357 Macintosh file type code(s): TEXT 358 Person & email address to contact for further information: James M 359 Snell 360 Intended usage: COMMON 361 Restrictions on usage: None. 362 Author: James M Snell 363 Change controller: IESG 365 9. Acknowledgements 367 The author gratefully acknowledges the feedback from the members of 368 the Atom Publishing Format and Protocol working group during the 369 development of this specification. 371 10. Normative References 373 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 374 Requirement Levels", BCP 14, RFC 2119, March 1997. 376 [RFC3023] Murata, M., St. Laurent, S., and D. Kohn, "XML Media 377 Types", RFC 3023, January 2001. 379 [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the 380 Internet: Timestamps", RFC 3339, July 2002. 382 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 383 Resource Identifier (URI): Generic Syntax", STD 66, 384 RFC 3986, January 2005. 386 [RFC3987] Duerst, M. and M. Suignard, "Internationalized Resource 387 Identifiers (IRIs)", RFC 3987, January 2005. 389 [RFC4287] Nottingham, M., Ed. and R. Sayre, Ed., "The Atom 390 Syndication Format", RFC 4287, December 2005. 392 [W3C.REC-xml-20040204] 393 Yergeau, F., Maler, E., Bray, T., Sperberg-McQueen, C., 394 and J. Paoli, "Extensible Markup Language (XML) 1.0 (Third 395 Edition)", World Wide Web Consortium FirstEdition REC-xml- 396 20040204, February 2004, 397 . 399 [W3C.REC-xml-c14n-20010315] 400 Boyer, J., "Canonical XML Version 1.0", World Wide Web 401 Consortium Recommendation REC-xml-c14n-20010315, 402 March 2001, 403 . 405 [W3C.REC-xml-exc-c14n-20020718] 406 Reagle, J., 3rd, D., and J. Boyer, "Exclusive XML 407 Canonicalization Version 1.0", World Wide Web Consortium 408 Recommendation REC-xml-exc-c14n-20020718, July 2002, 409 . 411 [W3C.REC-xml-names-19990114] 412 Hollander, D., Bray, T., and A. Layman, "Namespaces in 413 XML", World Wide Web Consortium FirstEdition REC-xml- 414 names-19990114, January 1999, 415 . 417 [W3C.REC-xmlbase-20010627] 418 Marsh, J., "XML Base", World Wide Web Consortium 419 FirstEdition REC-xmlbase-20010627, June 2001, 420 . 422 [W3C.REC-xmldsig-core-20020212] 423 Solo, D., Reagle, J., and D. Eastlake, "XML-Signature 424 Syntax and Processing", World Wide Web Consortium 425 FirstEdition REC-xmldsig-core-20020212, February 2002, 426 . 428 [W3C.REC-xmlenc-core-20021210] 429 Eastlake, D. and J. Reagle, "XML Encryption Syntax and 430 Processing", World Wide Web Consortium Recommendation REC- 431 xmlenc-core-20021210, December 2002, 432 . 434 Author's Address 436 James M Snell 438 Email: jasnell@us.ibm.com 439 URI: http://ibm.com