Redacted Fields in the Registration Data Access Protocol (RDAP) ResponseVeriSign, Inc.12061 Bluemont WayRestonVA20190United States of Americajgould@verisign.comhttp://www.verisign.comVeriSign, Inc.12061 Bluemont WayRestonVA20190United States of Americadsmith@verisign.comhttp://www.verisign.comGoDaddy Inc.14455 N. Hayden Rd., #219ScottsdaleAZ85260United States of Americajkolker@godaddy.comhttp://www.godaddy.comGoDaddy Inc.14455 N. Hayden Rd., #219ScottsdaleAZ85260United States of Americarcarney@godaddy.comhttp://www.godaddy.com
art
regextRedactedRedactionRedactingJSONPathThis document describes a Registration Data Access
Protocol (RDAP) extension for specifying methods of
redaction of RDAP responses and explicitly identifying redacted RDAP
response fields, using JSONPath as the default expression language.Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by
the Internet Engineering Steering Group (IESG). Further
information on Internet Standards is available in Section 2 of
RFC 7841.
Information about the current status of this document, any
errata, and how to provide feedback on it may be obtained at
.
Copyright Notice
Copyright (c) 2024 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
() in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with
respect to this document. Code Components extracted from this
document must include Revised BSD License text as described in
Section 4.e of the Trust Legal Provisions and are provided without
warranty as described in the Revised BSD License.
Table of Contents
. Introduction
. Conventions Used in This Document
. Redaction Methods
. Redaction by Removal Method
. Redaction by Empty Value Method
. Redaction by Partial Value Method
. Redaction by Replacement Value Method
. Redacted RDAP Response
. RDAP Conformance
. "redacted" Member
. JSONPath Considerations
. JSONPath Client Considerations
. JSONPath Server Considerations
. IANA Considerations
. RDAP Extensions Registry
. RDAP JSON Values Registry
. Security Considerations
. References
. Normative References
. Informative References
Acknowledgements
Authors' Addresses
IntroductionThis document describes an RDAP extension for specifying methods of
redaction of RDAP responses and explicitly identifying redacted RDAP
response fields, using JSONPath as the default expression language. A redacted RDAP field is one that has data
removed or replaced in the RDAP response due to server policy, such as the lack of client privilege to
receive the field. This extension can be used to identify
redacted RDAP fields in any RDAP object class, as defined in , or
RDAP fields defined in RDAP extensions. Because an RDAP response may exclude a field due to either the lack of data
or the lack of RDAP client privileges,
this extension is used to explicitly specify which RDAP fields are not included in the RDAP response due
to redaction. It thereby provides a capability for disambiguation
between redaction and other possible reasons for data or field absence.In , RDAP supports both lookup and search queries, where a lookup query responds
with a single object and a search query responds with a list of objects.
This document applies to redaction of a single object of a lookup response and in each of the objects of a search response.JSONPath, as defined in , is used
as the default expression language to reference RDAP fields that have been redacted.
The redacted JSON fields will be removed, have empty values, have partial values, or be replaced in the RDAP response.
JSON is defined by .Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
"MAY", and "OPTIONAL" in this document are to be interpreted as
described in BCP 14
when, and only when, they appear in all capitals, as shown here.
The JSON examples include extra line breaks and empty space. For
instance, the JSONPath expressions are broken out into multiple
lines when required for illustration.The JSONPath expressions in the examples are for illustration
purposes with single-role entities, and the exact expressions to be used
by the server are out of scope.Redaction MethodsRedaction in RDAP can be handled in multiple ways. The resulting redacted RDAP response MUST comply with the format defined in the RDAP RFCs, such as and updates.
The use of placeholder text for the values of the RDAP fields, such as "XXXX",
MUST NOT be used for redaction, since the placeholder text value may not match the format requirements of each of the RDAP fields, which could provide an inconsistent and unreliable redaction signal.
This section covers the redaction
methods that can be used with the redaction signaling defined in .RDAP responses, as defined in , include
a mix of JSON objects and JSON arrays, where JSON arrays are heavily used for entity objects with jCard.
jCard is a JSON representation of vCard that
inherits its dependency on arrays.
An example is the vCard "ADR" property , or the jCard
"adr" property , which defines a sequence of
address components. According to , when an "ADR" property component value is missing,
the associated component separator MUST still be specified.
jCard extends the use of arrays with
each individual vCard property being represented by an array of three fixed elements, followed by one or more additional elements.
The mix of JSON objects and JSON arrays impacts the methods used for redaction in RDAP.The redaction of RDAP fields fall into the four categories defined in the following subsections.Redaction by Removal MethodThe Redaction by Removal Method is when the RDAP field is removed from the RDAP response, which is the default method.
The Redaction by Removal Method can be done for all RDAP response fields except for response fields using the position in an array to signal the redacted field (e.g., the JSON arrays used with jCard).
RDAP extensions, such as the one described in "Using JSContact in Registration Data Access Protocol (RDAP) JSON Responses", do not have a dependency on the use of positional JSON arrays and
are therefore suited for the Redaction by Removal Method.When an RDAP object is redacted
by removal, all of the RDAP object's child fields are also removed. Only the redacted RDAP object needs to be referenced in the list of redacted fields,
as defined in .An example of redacting an RDAP object is removing the administrative contact
from the RDAP response and including the following "redacted" member:Redacted Administrative Contact
"redacted": [
{
"name": {
"description": "Administrative Contact"
},
"prePath": "$.entities[?(@.roles[0]=='administrative')]",
"method": "removal"
}
]
The Redaction by Removal Method MUST NOT be used to remove an element of an array where the position of the element in the array determines semantic meaning.
For example, removal of an individual data field in jCard will result in a non-conformant jCard array definition.Redaction by Empty Value MethodThe Redaction by Empty Value Method is when a redacted field is not removed but its value is set to an empty value, such as "" for a jCard
text ("text") property or null for a non-text property. The empty jCard values ("" or null) are referenced in the "redacted"
member in place of the jCard property name in an array, such as referencing the "fn" jCard property value at position 3 instead of referencing the "fn"
jCard property name at position 0.
The Redaction by Empty Value Method MUST be used only when redacting JSON response fields that use the position in an
array to signal the redacted field (e.g., jCard arrays).
Optional jCard properties MUST
use the Redaction by Removal Method to redact the entire property.
The required jCard "fn" property, defined in vCard, MUST use the Redaction by Empty Value Method to redact the property value.
Removing the "fn" property would violate vCard, and removing the property value
would violate the fixed array positions defined in jCard.Redacted "fn" jCard Property Using the Redaction by Empty Value Method
[
"fn",
{},
"text",
""
]
An example of the "redacted" member for the redacted "fn" jCard property value, which is array position 3:Redacted Registrant Name Using an Array Position
"redacted": [
{
"name": {
"description": "Registrant Name"
},
"postPath": "$.entities[?(@.roles[0]=='registrant')].
vcardArray[1][?(@[0]=='fn')][3]",
"pathLang": "jsonpath",
"method": "emptyValue",
"reason": {
"description": "Server policy"
}
}
]
Redaction by Partial Value MethodThe Redaction by Partial Value Method is when a redacted field is not removed but its value has a portion of the data removed, such as for the "label" or "fn" jCard
properties. The partial values are referenced in the "redacted"
member in place of the property name in an array, such as referencing the "fn" jCard property value at position 3 instead of referencing the "fn"
jCard property name at position 0.
The Redaction by Partial Value Method SHOULD be used only when redacting JSON response fields that use a formatted value, where a portion of the value is removed.
An example of the "label" jCard property in that redacts "123 Maple Ave\nSuite 901\n":Redacted "label" jCard Property
["adr",
{
"type":"home",
"label":"Vancouver\nBC\n1239\n"
},
"text",
[
"", "", "", "", "", "", ""
]
]
An example of the "redacted" member for the redacted "label" jCard property value, based on :Redacted Label Using the Redaction by Partial Value Method
"redacted": [
{
"name": {
"description": "Home Address Label"
},
"postPath": "$.vcardArray[1][?(@[0]=='adr')][1].label",
"pathLang": "jsonpath",
"method": "partialValue",
"reason": {
"description": "Server policy"
}
}
]
Redaction by Replacement Value MethodThe Redaction by Replacement Value Method is when a redacted field is not removed but its value is replaced with a different value, such as protecting the "email" jCard
property value with an anonymized email "text" value or the use of an alternative "uri" value to a web form. Replacing a property value is a form of redaction, since it protects the
true property value for privacy reasons.Redacted "email" jCard Property Using the Redaction by Replacement Value Method with an Anonymized Email
[
"email",
{},
"text",
"anonymized123@example.com"
]
Redacted Email Using a Replacement Value with an Anonymized "text" Value
"redacted": [
{
"name": {
"description": "Registrant Email"
},
"postPath": "$.entities[?(@.roles[0]=='registrant')].
vcardArray[1][?(@[0]=='email')][3]",
"pathLang": "jsonpath",
"method": "replacementValue",
}
]
Redacted "email" jCard Property Using the Redaction by Replacement Value Method with a "contact-uri" jCard Property to a Web Form
[
"contact-uri",
{},
"uri",
"https://email.example.com/123"
]
Redacted Email Using a Replacement Value with a "contact-uri" jCard Property to a Web Form
"redacted": [
{
"name": {
"description": "Registrant Email"
},
"prePath": "$.entities[?(@.roles[0]=='registrant')].
vcardArray[1][?(@[0]=='email')]",
"replacementPath": "$.entities[?(@.roles[0]=='registrant')].
vcardArray[1][?(@[0]=='contact-uri')]",
"pathLang": "jsonpath",
"method": "replacementValue",
}
]
Redacted RDAP ResponseRDAP ConformanceRDAP responses that contain values described in this document MUST
indicate conformance with this specification by including an
"rdapConformance" value of "redacted".
The "redacted" extension identifier is described in ."rdapConformance" with Redacted Extension
"rdapConformance": [
"rdap_level_0",
"redacted"
]
"redacted" MemberThe "redacted" member MUST be added to the RDAP response when
there is one or more redacted fields. The "redacted" member is included as a member of the object instance in a lookup response, such as the object classes defined in , and
as a member of the object instances in a search response.The server, including a redacted signal, provides an unauthorized client additional
information related to the existence of data and MAY exclude the redacted members
for RDAP fields that are considered a privacy issue in providing a data existence signal.
The server MAY choose to publish a redaction policy describing how this extension is implemented for their constituency.
The contents of such a policy are outside the scope of this specification.The "redacted" member contains an array
of objects with the following child members:
"name":
REQUIRED logical name for the redacted field. The logical name used
for the redacted field is up to server policy.
The logical name
is defined using an object with a "type" field denoting a registered redacted
name (see ) or a "description" field denoting an unregistered redacted name.
The registered redacted names and the chosen unregistered names
can meet the needs of different RDAP services or industries.
"prePath":
OPTIONAL JSON path expression referencing a redacted JSON field in the pre-redacted response, using the expression language defined by the "pathLang" member.
The "prePath" member MAY be set when the redacted field does not exist in the redacted response for the Redaction by Removal Method and the Redaction by Replacement Value Method.
The "prePath" member MUST NOT be set when the "postPath" member is set.
"postPath":
OPTIONAL JSON path expression referencing a redacted JSON field in the redacted (post-redacted) response, using the expression language defined by the "pathLang" member.
The "postPath" member MUST be set when the redacted field does exist in the redacted response for the Redaction by Empty Value Method, the Redaction by Partial Value Method, and the Redaction by Replacement Value Method.
The "postPath" member MUST NOT be set when the "prePath" member is set.
"replacementPath":
OPTIONAL JSON path expression of the replacement field of the redacted field with the
Redaction by Replacement Value Method, using the expression language defined by the "pathLang" member.
"pathLang":
OPTIONAL JSON path expression language used, with the default value of "jsonpath" for JSONPath .
Other JSON path expression languages registered with the "redacted expression language" Type in the "RDAP JSON Values" registry MAY be used based on server policy.
"method":
OPTIONAL redaction method used, with one of the following values:
"removal" indicating the Redaction by Removal Method,
"emptyValue" indicating the Redaction by Empty Value Method,
"partialValue" indicating the Redaction by Partial Value Method, or
"replacementValue" indicating the Redaction by Replacement Value Method.
The default value is "removal" when not provided.
"reason":
OPTIONAL human-readable reason(s) for the redacted field in
the language defined by the "lang" member.
The default language is "en" if the "lang" member is not specified.
The reason is defined using an object with an OPTIONAL "type" field denoting a registered redacted reason
(see ) and an OPTIONAL "description" field denoting an unregistered redacted reason.
The "description" field MUST NOT be a client processing dependency.
When the server is using the Redaction by Removal Method or the Redaction by Replacement Value Method with an alternative field value,
the JSONPath expression of the "prePath" member will not resolve successfully with the redacted response.
The client can key off the "name" member for display logic related to the redaction.
JSONPath Server ConsiderationsThis section covers considerations for servers
using JSONPath to identify
redacted RDAP fields with the "prePath", "postPath", or "replacementPath" member of redacted objects in the "redacted" member.
The list of JSONPath considerations include:
Use absolute paths with the '$' JSONPath element. An example is "$.handle" for the "Registry Domain ID" in a lookup response or "$.domainSearchResults[0].handle" in a search response.
Validate a JSONPath expression with the non-redacted RDAP response when using the "prePath" member, where evaluating the expression results in returning the redacted field.
Reference the removed object field when redacting an entire object by the Redaction by Removal Method, where all of the object's child fields are explicitly removed.
An example is "$.entities[?(@.roles[0]=='administrative')]" for the entire "Administrative Contact".
Use multiple bases for the redaction of
certain content. For example, if server policy is such that all
administrative-role entities are redacted and all technical-role
entities are redacted, then an entity having both the
administrative role and the technical role could be redacted for
two different reasons. In this situation, a server is required to
include at least one "redacted" entry, but it should consider
including a separate "redacted" entry for each applicable basis
for redaction to clearly document the server policies that
are relevant to redaction in each instance.
Reference the removed field when using the Redaction by Removal Method. An example is "$.handle" for the "Registry Domain ID".
Reference index 0 of the jCard property array, which is the jCard "name" property,
with a filter expression containing the name of the field when redacting a jCard field using the Redaction by Removal Method.
An example is "$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='email')]" for the "Registrant Email".
Reference the jCard field value or values redacted by array index 3 and greater
when redacting a jCard field using the Redaction by Empty Value Method.
The jCard property array index 3 and greater contain the property values, where the property values set with an empty value
are referenced directly in place of the jCard property name. Servers can then systematically redact the jCard
field value or values based on the JSONPath expressions, and clients will directly know which jCard property values have been redacted.
An example is "$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='fn')][3]" for the "Registrant Name" or "$.entities[?(@.roles[0]=='registrant')].vcardArray[1][?(@[0]=='adr')][3][5]"
for the "Registrant Postal Code".
RDAP extensions should define any special JSONPath considerations required to identify redacted RDAP fields if these considerations are insufficient.
IANA ConsiderationsRDAP Extensions RegistryIANA has registered the following value in the "RDAP
Extensions" registry:
Extension Identifier:
redacted
Registry Operator:
Any
Specification:
RFC 9537
Contact:
IETF <iesg@ietf.org>
Intended Usage:
This extension identifies the redacted fields in an RDAP response.
RDAP JSON Values Registry defines the
"RDAP JSON Values" registry with predefined Type field values and a
registration policy of Expert Review .
This specification defines three new Type field
values that can be used to register predefined redacted name, reason, and
expression language values. IANA has updated the "RDAP JSON Values" registry to accept these additional Type field values as follows:
"redacted name":
Redacted name being registered. The registered redacted name
is referenced using the "type" field of the redacted "name" field.
"redacted reason":
Redacted reason being registered. The registered redacted reason
is referenced using the "type" field of the redacted "reason" field.
"redacted expression language":
Redacted expression language being registered. The registered redacted expression
language is referenced using the "pathLang" field.
IANA has also listed this document as a reference for the "RDAP JSON Values" registry and has registered the following value:
Value:
jsonpath
Type:
redacted expression language
Description:
JSON path expression language, as defined in RFC 9535.
Registrant:
IETF
Contact Information:
iesg@ietf.org
Reference:
RFC 9537
Security ConsiderationsThe extension described in this document does not provide any security services
beyond those described by .ReferencesNormative ReferencesKey words for use in RFCs to Indicate Requirement LevelsIn many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.vCard Format SpecificationThis document defines the vCard data format for representing and exchanging a variety of information about individuals and other entities (e.g., formatted and structured name and delivery addresses, email address, multiple telephone numbers, photograph, logo, audio clips, etc.). This document obsoletes RFCs 2425, 2426, and 4770, and updates RFC 2739. [STANDARDS-TRACK]jCard: The JSON Format for vCardThis specification defines "jCard", a JSON format for vCard data. The vCard data format is a text format for representing and exchanging information about individuals and other entities, for example, telephone numbers, email addresses, structured names, and delivery addresses. JSON is a lightweight, text-based, language- independent data interchange format commonly used in Internet applications.Guidelines for Writing an IANA Considerations Section in RFCsMany protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA).To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry.This is the third edition of this document; it obsoletes RFC 5226.Ambiguity of Uppercase vs Lowercase in RFC 2119 Key WordsRFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.The JavaScript Object Notation (JSON) Data Interchange FormatJavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data.This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance.Registration Data Access Protocol (RDAP) Query FormatThis document describes uniform patterns to construct HTTP URLs that may be used to retrieve registration information from registries (including both Regional Internet Registries (RIRs) and Domain Name Registries (DNRs)) using "RESTful" web access patterns. These uniform patterns define the query syntax for the Registration Data Access Protocol (RDAP). This document obsoletes RFC 7482.JSON Responses for the Registration Data Access Protocol (RDAP)This document describes JSON data structures representing registration information maintained by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs). These data structures are used to form Registration Data Access Protocol (RDAP) query responses. This document obsoletes RFC 7483.JSONPath: Query Expressions for JSONJSONPath defines a string syntax for selecting and extracting JSON (RFC 8259) values from within a given JSON value.Informative ReferencesUsing JSContact in Registration Data Access Protocol (RDAP) JSON ResponsesIIT-CNR/Registro.itCentralNic Group plcThis document describes an RDAP extension which represents entity contact information in JSON responses using JSContact.Work in ProgressAcknowledgementsThe authors wish to thank the following persons for their feedback and suggestions:
,
,
,
,
,
,
,
,
and .
Authors' AddressesVeriSign, Inc.12061 Bluemont WayRestonVA20190United States of Americajgould@verisign.comhttp://www.verisign.comVeriSign, Inc.12061 Bluemont WayRestonVA20190United States of Americadsmith@verisign.comhttp://www.verisign.comGoDaddy Inc.14455 N. Hayden Rd., #219ScottsdaleAZ85260United States of Americajkolker@godaddy.comhttp://www.godaddy.comGoDaddy Inc.14455 N. Hayden Rd., #219ScottsdaleAZ85260United States of Americarcarney@godaddy.comhttp://www.godaddy.com