Copyright © 2001,2002 W3C® (MIT, INRIA, Keio), All Rights Reserved. W3C liability, trademark, document use and software licensing rules apply.
This document extends the XML Key Management Specification [XKMS] protocol to encompass the bulk operations necessary for aggregate key management operations and interfacing with such systems as smart card management systems.
X-BULK is defined in terms of structures expressed in the XML Schema Language [XML-Schema] and web services description language [WSDL].
This is an editor's copy and has no status at all.
This is the first draft of the "XML Key Management Specification Bulk Operation (X-BULK)" specification from theW3C XML Key Management Working Group(Activity Statement). This version attempts to capture the consensus resulting from the 1 March 2001 face-to-face meeting and subsequent discussion on thelist. However, it does contain points which are still under discussion or not well specified.
The Working Group will try touse a new namespacewhen changes in its syntax or processing are substantive. However, this namespace might be reused (prior to reaching Candidate Recommendation) by subsequent drafts in such a way as to cause instances using the namespace to become invalid or to change in meaning or affect the operation of existing software. Requests for a more stringent level of namespace stability should be made to the Working Group.
Publication of this document does not imply endorsement by the W3C membership. This is a draft document and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to cite a W3C Working Draft as anything other than a "work in progress." Please send comments to the editor and cc: the listwww-xkms@w3.org(archives).
Patent disclosures relevant to this specification may be found on the Working Group'spatent disclosure pagein conformance with W3C.
A list of current W3C working drafts can be found athttp://www.w3.org/TR/.
XKMS currently addresses one-by-one registration (X-KRSS) and key information and validation services (X-KISS). However, we feel that a standard must also address bulk processing cases and are proposing that an X-BULK specification, built on the basis of X-KISS and X-KRSS be included in scope of the work.
The use cases where X-BULK is required include:
Key differences between X-KRSS and X-BULK include:
X-BULK does however attempt to reuse as many structures and features as possible from the current XKMS specification.
Separating bulk from one-by-one processing has the benefit that the separately defined messages required are simpler than if a single message format handling both one-by-one and bulk cases were to be defined. It is also better not to burden a client for one-by-one operation with the additional complexity required in batch operation.
Demand for this functionality is shown by the emergence of a number of proprietary solutions in this space.
Design criteria include:
For clarity, some examples of XML are not complete documents and namespace [XML-Names] declarations may be omitted from XML fragments. In this document, certain namespace prefixes represent certain namespaces as follows
Prefix | Specification | Schema |
XML Schema | http://www.w3.org/2001/XMLSchema | |
ds | XML Signature | http://www.w3.org/2000/09/xmldsig# |
xkms | XKMS | http://www.w3.org/2002/03/xkms# |
xbulk | X-BULK | http://www.w3.org/2002/08/xbulk# |
These namespaces are declared in the X-BULK schema as follows:
Schema Definition: <?xml version="1.0"?> <schema targetNamespace="http://www.w3.org/2002/08/xbulk#" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xkms="http://www.w3.org/2002/03/xkms#" xmlns:xbulk="http://www.w3.org/2002/08/xbulk#" elementFormDefault="qualified" attributeFormDefault="unqualified"> <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/> <import namespace="http://www.w3.org/2001/04/xmlenc#" schemaLocation="xenc-schema.xsd"/> <import namespace="http://www.w3.org/2002/03/xkms#" schemaLocation="xkms-schema.xsd"/> <annotation> <documentation xml:lang="en"> XML Schema for XBULK draft 22nd August 2002 </documentation> </annotation>
X-BULK defines request and result messages that are bulk equivalents of the protocol messages defined in X-KISS and X-KRSS, along with additional messages for querying the status of a bulk request. The basic idea is that a single batch can contain a number of independently referencable requests or responses. Batches are produced both from the requestor and responder. A responder will process an entire batch and produce a single batch of responses after processing.
All bulk requests MUST be authenticated; that is, the originator of a batch must protect the batch with a digital signature. In particular, there is no proof of possession or authorization on a per-key binding level; instead, the entire bulk operation is authenticated by the originator. Implementations MUST be capable of using the XKMS Register operation for the registration of the keys used to authenticate batches.
The basic mode of operation is that a batch of requests is submitted. The responder processes the batch and produces a response batch that contains one response for each request in the batch. Other, more flexible modes of operation may be defined later (e.g. allowing responses to be spread over multiple batches). This mode of "full batch processing" is sufficient for most use cases and is considerably simpler than supporting "selective batch processing."
Batches are identified using ID attributes and optional opaque client data that is carried unaltered by the responder.
In order to allow the requestor to track the progress of batch processing implementations MAY support status requests. A status request is a request to determine the status of processing of the referenced batch. The response gives a simple indication of the numbers of requests from the batch that are in the various possible states (processed, failed, etc.).
A batch response contains one response for each request, not necessarily in the same order as in the request batch. That is, requestors MUST be able to handle responses that are not sorted in any particular way. Correlativity between individual requests and responses can be identified either based in information within the key binding, or through the use of ID attributes on the requests, which are automatically included in the responses.
In many use cases, the requestor requires "additional information" to be "carried around" with a batch or request, but which is not intended for processing by the responder.
Responders MAY also add more additional information to the specific responses. Requestors MUST be able to handle such additional information.
The basic request and response structures are as in [XKMS] and can support the same level of functionality (registration of new keys, local/central key generation, revocation, location, etc.).
This specification uses XML Schemas [XML-Schema] to describe the content model.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specification are to be interpreted as described in RFC2119 [Keywords]:
"they MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmissions)"
Consequently, we use these capitalized keywords to unambiguously specify requirements over protocol and application features and behavior that affect the interoperability and security of implementations. These key words are not used (capitalized) to describe XML grammar; schema definitions unambiguously describe such requirements and we wish to reserve the prominence of these terms for the natural language descriptions of protocols and features. For instance, an XML attribute might be described as being "optional." Compliance with the XML-namespace specification [XML-Names] is described as "REQUIRED."
The remainder of this document describes the X-BULK messages; first the generic message types; then the messages and elements associated with bulk registration, along with examples; and then the messages associated with bulk status checking, along with examples. Finally the complete schema for X-BULK and the [WSDL] definition are presented.
X-BULK messages reuse the standard XKMS abstract request/response framework.
OpaqueClientData
message
element. This will be stored by the X-BULK responder, and returned to the
client when processing is complete.OpaqueClientData
message element and using a reference to
the Id
attribute of the associated request.KeyBinding
and KeyInfo
extensibility
mechanisms.BulkRequestAbstractType
typeThe BulkRequestAbstractType
type extends the XKMS abstract
request type to include information about the number of requests in the
batch:
Schema Definition: <complexType name="BulkRequestAbstractType" abstract="true"> <complexContent> <extension base="xkms:RequestAbstractType"> <attribute name="NumberOfRequests" type="positiveInteger"/> </extension> </complexContent> </complexType>
Processing of the inherited attributes and elements is the same as specified in XKMS.
BulkResultAbstractType
typeThe BulkResultAbstractType
type extends the XKMS abstract
result type but currently includes no additional information:
Schema Definition: <complexType name="BulkResultAbstractType" abstract="true"> <complexContent> <extension base="xkms:RequestAbstractType"/> </complexContent> </complexType>
Processing of the inherited attributes and elements is the same as specified in XKMS.
BulkResultInfoAbstractType
typeThe BulkResultInfoAbstractType
type is used to encapsulate
the response to an individual request within a batch. This includes a copy of
the Id
attribute from the original request key binding, to allow
correlation between requests and responses within the batch.
Schema Definition: <complexType name="BulkResultInfoAbstractType" abstract="true"> <attribute name="OriginalKeyBindingId" type="anyURI" use="optional"/> </complexType>
The following messages comprise the bulk location process:
BulkLocateRequest
messageThe BulkLocateRequest
message is an XML element that consists
of a sequence of QueryKeyBinding
elements providing information
on each desired locate operation.
Schema Definition: <element name="BulkLocateRequest" type="xbulk:BulkLocateRequestType"/> <complexType name="BulkLocateRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:QueryKeyBinding" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkLocateResult
messageThe BulkLocateResult
message is an XML element that consists
of a sequence of BulkLocateInfo
elements, providing an answer to
each of the original requests.
Schema Definition: <element name="BulkLocateResult" type="xbulk:BulkLocateResultType"/> <complexType name="BulkLocateResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkLocateInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkLocateInfo
elementThe BulkLocateInfo
element contains a sequence of zero or
more KeyBinding
elements, providing the result of a single
locate request. The inherited OriginalKeyBindingId
attribute
allows correlation with the original request.
Schema Definition: <element name="BulkLocateInfo" type="xbulk:BulkLocateInfoType"/> <complexType name="BulkLocateInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
The following messages comprise the bulk validation process:
BulkValidateRequest
messageThe BulkValidateRequest
message is an XML element that
consists of a sequence of QueryKeyBinding
elements providing
information on each desired validate operation.
Schema Definition: <element name="BulkValidateRequest" type="xbulk:BulkValidateRequestType"/> <complexType name="BulkValidateRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:QueryKeyBinding" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkValidateResult
messageThe BulkValidateResult
message is an XML element that
consists of a sequence of BulkValidateInfo
elements, providing
an answer to each of the original requests.
Schema Definition: <element name="BulkValidateResult" type="xbulk:BulkValidateResultType"/> <complexType name="BulkValidateResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkValidateInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkValidateInfo
elementThe BulkValidateInfo
element contains a sequence of zero or
more KeyBinding
elements, providing the result of a single
validate request. The inherited OriginalKeyBindingId
attribute
allows correlation with the original request.
Schema Definition: <element name="BulkValidateInfo" type="xbulk:BulkValidateInfoType"/> <complexType name="BulkValidateInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
The following messages comprise the bulk registration process:
BulkRegisterRequest
messageThe BulkRegisterRequest
message is an XML element that
consists of a sequence of PrototypeKeyBinding
elements providing
information on each desired register operation. The entire bulk registration
operation is authenticated through an Authentication
element. No
per-request proof of possession is required for client-generated keys.
Schema Definition: <element name="BulkRegisterRequest" type="xbulk:BulkRegisterRequestType"/> <complexType name="BulkRegisterRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:PrototypeKeyBinding" maxOccurs="unbounded"/> <element ref="xkms:Authentication"/> </sequence> </extension> </complexContent> </complexType>
BulkRegisterResult
messageThe BulkRegisterResult
message is an XML element that
consists of a sequence of BulkRegisterInfo
elements, providing
an answer to each of the original requests.
Schema Definition: <element name="BulkRegisterResult" type="xbulk:BulkRegisterResultType"/> <complexType name="BulkRegisterResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkRegisterInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkRegisterInfo
elementThe BulkRegisterInfo
element contains a sequence of zero or
more KeyBinding
elements, providing the result of a single
register request, and optionally the associated server-generated private key.
The inherited OriginalKeyBindingId
attribute allows correlation
with the original request.
Schema Definition: <element name="BulkRegisterInfo" type="xbulk:BulkRegisterInfoType"/> <complexType name="BulkRegisterInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> <element ref="xkms:PrivateKey" minOccurs="0"/> </sequence> </extension> </complexContent> </complexType>
The following messages comprise the bulk revocation process:
BulkRevokeRequest
messageThe BulkRevokeRequest
message is an XML element that consists
of a sequence of KeyBinding
elements providing information on
each desired revoke operation. The entire bulk revocation operation is
authenticated through an Authentication
element.
Schema Definition: <element name="BulkRevokeRequest" type="xbulk:BulkRevokeRequestType"/> <complexType name="BulkRevokeRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:KeyBinding" maxOccurs="unbounded"/> <element ref="xkms:Authentication"/> </sequence> </extension> </complexContent> </complexType>
BulkRevokeResult
messageThe BulkRevokeResult
message is an XML element that consists
of a sequence of BulkRevokeInfo
elements, providing an answer to
each of the original requests.
Schema Definition: <element name="BulkRevokeResult" type="xbulk:BulkRevokeResultType"/> <complexType name="BulkRevokeResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkRevokeInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
BulkRevokeInfo
elementThe BulkRevokeInfo
element contains a sequence of zero or
more KeyBinding
elements, providing the result of a single
revoke request. The inherited OriginalKeyBindingId
attribute
allows correlation with the original request.
Schema Definition: <element name="BulkRevokeInfo" type="xbulk:BulkRevokeInfoType"/> <complexType name="BulkRevokeInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType>
The following messages comprise the batch status checking process:
BulkStatusRequest
messageThe BulkStatusRequest
message is an XML element that contains
a ResponseId
attribute to identify the batch whose status is in
question.
Schema Definition: <element name="BulkStatusRequest" type="xbulk:BulkStatusRequestType"/> <complexType name="BulkStatusRequestType"> <complexContent> <extension base="xkms:RequestAbstractType"> <!-- Authentication? --> <attribute name="ResponseId" type="anyURI" use="optional"/> </extension> </complexContent> </complexType>
BulkStatusResult
messageThe BulkStatusResult
message is an XML element that returns
the processing status of a previously-submitted batch.
Schema Definition: <element name="BulkStatusResult" type="xbulk:BulkStatusResultType"/> <complexType name="BulkStatusResultType"> <complexContent> <extension base="xkms:ResultAbstractType"> <sequence> <element name="Pending" type="positiveInteger"/> <element name="Successful" type="positiveInteger"/> <element name="Failed" type="positiveInteger"/> </sequence> <attribute name="Complete" type="boolean"/> </extension> </complexContent> </complexType>
The status is presented simply in the form of the following data:
One application might be to use a XML style sheet to present this information to the customer over a web page.
ds:KeyInfo
The following new children of ds:KeyInfo
are defined, for
integration with legacy systems:
PKCS1
elementThe PKCS1
element contains a DER-encoded [PKCS1] public
key.
Schema Definition: <element name="PKCS1" type="binary"/>
PKCS10
elementThe PKCS10
element contains a DER-encoded [PKCS10] public
key.
Schema Definition: <element name="PKCS10" type="binary"/>
The complete schema definition is as follows:
Schema Definition: <?xml version="1.0"?> <schema targetNamespace="http://www.w3.org/2002/08/xbulk#" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xkms="http://www.w3.org/2002/03/xkms#" xmlns:xbulk="http://www.w3.org/2002/08/xbulk#" elementFormDefault="qualified" attributeFormDefault="unqualified"> <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/> <import namespace="http://www.w3.org/2001/04/xmlenc#" schemaLocation="xenc-schema.xsd"/> <import namespace="http://www.w3.org/2002/03/xkms#" schemaLocation="xkms-schema.xsd"/> <annotation> <documentation xml:lang="en"> XML Schema for XBULK draft 22nd August 2002 </documentation> </annotation> <!-- abstract types --> <complexType name="BulkRequestAbstractType" abstract="true"> <complexContent> <extension base="xkms:RequestAbstractType"> <attribute name="NumberOfRequests" type="positiveInteger"/> </extension> </complexContent> </complexType> <complexType name="BulkResultAbstractType" abstract="true"> <complexContent> <extension base="xkms:RequestAbstractType"/> </complexContent> </complexType> <complexType name="BulkResultInfoAbstractType" abstract="true"> <attribute name="OriginalKeyBindingId" type="anyURI" use="optional"/> </complexType> <!-- bulk locate --> <element name="BulkLocateRequest" type="xbulk:BulkLocateRequestType"/> <complexType name="BulkLocateRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:QueryKeyBinding" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkLocateResult" type="xbulk:BulkLocateResultType"/> <complexType name="BulkLocateResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkLocateInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkLocateInfo" type="xbulk:BulkLocateInfoType"/> <complexType name="BulkLocateInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <!-- bulk validate --> <element name="BulkValidateRequest" type="xbulk:BulkValidateRequestType"/> <complexType name="BulkValidateRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:QueryKeyBinding"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkValidateResult" type="xbulk:BulkValidateResultType"/> <complexType name="BulkValidateResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkValidateInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkValidateInfo" type="xbulk:BulkValidateInfoType"/> <complexType name="BulkValidateInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <!-- bulk register --> <element name="BulkRegisterRequest" type="xbulk:BulkRegisterRequestType"/> <complexType name="BulkRegisterRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:PrototypeKeyBinding" maxOccurs="unbounded"/> <element ref="xkms:Authentication"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkRegisterResult" type="xbulk:BulkRegisterResultType"/> <complexType name="BulkRegisterResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkRegisterInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkRegisterInfo" type="xbulk:BulkRegisterInfoType"/> <complexType name="BulkRegisterInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> <element ref="xkms:PrivateKey" minOccurs="0"/> </sequence> </extension> </complexContent> </complexType> <!-- bulk revoke --> <element name="BulkRevokeRequest" type="xbulk:BulkRevokeRequestType"/> <complexType name="BulkRevokeRequestType"> <complexContent> <extension base="xbulk:BulkRequestAbstractType"> <sequence> <element ref="xkms:KeyBinding" maxOccurs="unbounded"/> <element ref="xkms:Authentication"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkRevokeResult" type="xbulk:BulkRevokeResultType"/> <complexType name="BulkRevokeResultType"> <complexContent> <extension base="xbulk:BulkResultAbstractType"> <sequence> <element ref="xbulk:BulkRevokeInfo" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <element name="BulkRevokeInfo" type="xbulk:BulkRevokeInfoType"/> <complexType name="BulkRevokeInfoType"> <complexContent> <extension base="xbulk:BulkResultInfoAbstractType"> <sequence> <element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/> </sequence> </extension> </complexContent> </complexType> <!-- No Bulk Reissue / Recover yet.. just reuse xkms:Pending? --> <!-- bulk status --> <element name="BulkStatusRequest" type="xbulk:BulkStatusRequestType"/> <complexType name="BulkStatusRequestType"> <complexContent> <extension base="xkms:RequestAbstractType"> <!-- Authentication? --> <attribute name="ResponseId" type="anyURI" use="optional"/> </extension> </complexContent> </complexType> <element name="BulkStatusResult" type="xbulk:BulkStatusResultType"/> <complexType name="BulkStatusResultType"> <complexContent> <extension base="xkms:ResultAbstractType"> <sequence> <element name="Pending" type="positiveInteger"/> <element name="Successful" type="positiveInteger"/> <element name="Failed" type="positiveInteger"/> </sequence> <attribute name="Complete" type="boolean"/> </extension> </complexContent> </complexType> <!-- key info types --> <element name="PKCS1" type="binary"/> <element name="PKCS10" type="binary"/> </schema>
The WSDL is as follows:
WSDL Definition: <!-- to follow from a more stable schema -->
The following people provided valuable feedback that improved the quality of this specification: