gtld-tech

Download

gtld-tech@icann.org

September 2013

23 participants
12 discussions

URS, PGP or S/MIME
by Gustavo Lozano Sept. 6, 2013

Sept. 6, 2013

Colleagues, The second version of the URS High Level Technical Requirements defines S/MIME as the authentication and non-repudiation mechanism for the interaction between URS providers and Registries, and for the communication between URS providers and Registrars. Several emails to the list and private messages suggest that PGP should be used instead of S/MIME. We believe that either PGP or S/MIME could be used. The PGP solution that we envision would be like this: * ICANN gathers the valid PGP keys from Registries and URS providers. * ICANN maintains and publishes a keyring of URS providers PGP keys and a keyring of Registry Operators PGP keys. Each keyring would be signed with ICANN's PGP key and published on an HTTPS site. * Registry Operator/Registrar downloads the keyring of URS providers PGP keys frequently (every 12 hours appears to be appropriate considering the 24 hour windows to URS lock a DN and the potential revocation of a compromised key). * URS provider downloads the keyring of Registry Operators frequently. * ICANN provides a list of "TLD, PGP key id" to URS providers (we could use the comment field of the PGP key to identify the TLD(s), but a simple CSV file appears easier). The S/MIME solution that we envision would be like this: * ICANN provides a list of "TLD, authorized email address" to URS providers. * ICANN provides a list of "URS provider, authorized email address" to Registry Operators/Registrars. * Registry Operators and URS providers obtain certificates from public CAs (the list of well-known root CAs in different software products and libraries do the rest). ICANN can accommodate either the PGP or the S/MIME solution. However, we believe we should only do one to avoid unnecessary complication. The question is: * What is your preference? For version three of the URS technical requirements, we will define whatever the majority believes is the best approach. Regards, Gustavo

9 8

Second version of the URS High Level Technical Requirements for Registries and Registrars
by Gustavo Lozano Sept. 3, 2013

Sept. 3, 2013

Colleagues, Attached you will find the second version of the "URS High Level Technical Requirements for Registries and Registrars" and a redline version of the document. This second version incorporates the feedback obtained from the conference call on August 07. We appreciate your feedback. Please send your feedback to the list or in private. Based on the feedback in this list, a new conference call may be required or this version may be published as the final version. Registry Operators will know the name servers deployed by the URS providers soon, in order to allow Registry Operators to create host objects (if necessary). Thank you, Gustavo

6 7