DRIP Entity Tag (DET) Identity Management Architecture

2.1. Use of Existing DNS Models

Registration of DETs SHOULD follow the registrant-registrar-registry model commonly used for registration of domain names. In DRIP, the registrant would be the end user who owns/controls the Unmanned Aircraft. They are ultimately responsible for the DET and any other information that gets published in the DNS. Registrants use agents known as registrars to manage their interactions with the registry. Registrars typically provide optional additional services such as DNS hosting, web/mail hosting, X.509 certificates and so on. The registry maintains a database of the registered domain names and their related metadata such as the contact details for domain name holder and the relevant registrar. The registry provides DNS service for the zone apex - 3.0.0.1.0.0.2.ip6.arpa for DRIP - which contains delegation information for the domain names of the registered DETs Registries generally provide services such as WHOIS or RDAP to publish metadata about the registered domain names and their registrants and registrars.¶

Registrants have contracts with registrars who in turn have contracts with registries. Payments follow this model too: the registrant buys services from a registrar who pays for services provided by the registry.¶

By definition, there can only be one registry for a domain name. Since that registry is a de facto monopoly, the scope of its activities are usually kept to a minimum to reduce the potential for market distortions or anti-competitive practices. A registry can have an arbitrary number of registrars who compete with each other on price, service and customer support.¶

It is not necessary, and in some case may not be desirable, for DRIP registrations to strictly follow this registrant-registrar-registry model. Prevailing circumstances and/or local policy may mean some combination of these roles could be combined. A DRIP registry might be operated by the CAA. Or it could be outsourced to a DNS registry provider. Registration policies - pricing, renewals, registrar and registrant agreements, etc. - will need to be developed. These considerations SHOULD be determined by the CAA, perhaps in consultation with local stakeholders. They are are out of scope for this document.¶

Figure 1 is intended to show this mapping of DRIP Information Registry functions and existing DNS concepts. This figure is not meant to be exhaustive or explain how the DNS functions. It only show where DRIP overlays with the DNS.¶

+--------------------------+
| DNS: Registrant          |
+--------------------------+
| DRIP: UAS Operators & UA |
+-------o------------------+
        |
        | Domain/DET
        | Registration Request
        |
+-------o-----------------------------+
| DNS: Registrar                      |
+-------------------------------------+
| DRIP: DIME Provisioning Agent (DPA) |
+-------o-----------------------------+
        |
        | Updates to
        | Registry Database (e.g. EPP)
        |
+-------o----------------------------+
| DNS: Registry Operator             |
+------------------------------------+
| DRIP: DIME Information Agent (DIA) |
+-------o-------------------------o--+
        |                         |
        | Zone File               | Domain
        | Update(s)               | Metadata
        |                         |
+-------o---------------+    +----o------------------+
| DNS: Authoritative    |    | DNS/DRIP: Private     |
|      Name Server (NS) |    |           Information |
+-----------------------+    |           Registry    |
| DRIP: Public          |    +--o--------------------+
|       Information     |       |
|       Registry        |       | Registrant
+--------------------o--+       | Information Service
                     |          | (e.g. WHOIS, RDAP, etc.)
                     | DNS      |
                     |          |
                  +--o----------o--+
                  | DNS: Resolver  |
                  +----------------+
                  | DRIP: Observer |
                  +----------------+

2.2. UAS DIME Services

For UAS, a DIME can provide the following registration and lookup services:¶

1. personal information (e.g. for pilots and operators)¶
2. UAS Serial Number and aircraft physical characteristics¶
3. a Key ID for UAS RID Authentication (for example [RFC9575])¶
4. a pseudo-anonymous UAS Specific Session ID (for example [RFC9374])¶
5. binding of UAS ID to UTM Operational Intent¶

A DIME's services are determined by their intended role (Section 4) and policies (both internally and from appropriate authorities). For example, services 1 and 2 can be restricted to non-public access controlled lookups with mandatory registration and 5 to publicly available but access controlled lookups.¶

For this document only services 3 and 4, when their identifier is selected as the DET, are detailed. Services 1 and 5 will be talked about conceptually while service 2 is out of scope.¶

Requirements on the elements of information in registration and lookup (beyond the scope of basic interoperability) is out of scope for this document. It is left to appropriate authorities to determine these details along with policy for access. For the UAS use-case this would be the national Civil Aviation Authorities (CAAs).¶

3.1. Required Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3.2. Additional Definitions

This document makes use of the terms (PII, USS, etc.) defined in [RFC9153]. Other terms (DIME, Endorsement, etc.) are from [RFC9434], while others (RAA, HDA, etc.) are from [RFC9374].¶

3.3. Text Conventions

When talking about a DIME in documents it should be referred to as the role it is serving. For example a CAA level DIME running services both as an RAA (its primary role in the hierarchy) and as an HDA (optionally) would be be referred to "RAA" when performing its RAA duties and "HDA" when performing its HDA duties. The rest of the document will follow this convention unless verbosity or clarity is needed.¶

• Review(MGLT): do we need this section above?¶

4.1. Apex

The Apex is the IPv6 prefix portion of the DET associated with it which is assigned by IANA from the special IPv6 address space for ORCHIDs. It serves as the branch point from the larger DNS system in which DETs are defined. The Apex manages all delegations and allocations of RAAs to various parties. The Apex MUST reserve an allocation for itself that it MAY use.¶

4.2. Registered Assigning Authority (RAA)

An RAA is a government agency, business or other organization that runs a DIME to register HDAs (Section 4.3).For UAS RID and related aviation uses most are expected to be CAAs (using Section 4.2.1), such as the Federal Aviation Authority (FAA), that then delegate HDAs for use in their National Air Space (NAS).¶

An RAA:¶

• MUST provide a set of services to allocate HDAs to organizations¶
• MUST have a public policy on what is necessary to obtain an HDA¶
• SHOULD provide service level guarantees for DNS operation and registry service¶
• SHOULD maintain a DNS zone minimally for discovering HIP Rendezvous (RVS) servers¶

• Review(MGTL): The normative language should not be about what function the RAA MUST accomplish. Instead we should mention what architecture mechanisms/protocols must be implemented so the RAA can perform the action it requires. The only item that fits this requirement is the HIP RVS.¶

Each RAA MUST use the single reserved HDA value 0 (0x0000) for itself to support various functions or services. Other HDA values SHOULD be allocated or reserved per RAA policy.¶

4.3. Hierarchial HIT Domain Authority (HDA)

An HDA may be an USS, ISP, or any third party that takes on the business to register client entities that need DETs. Client entities include, but is not limited to UA, GCS, UAS Operators and UAS/UTM infrastructure (such as Supplemental Data Service Providers). An HDA SHOULD also provide needed UAS services including those required for HIP-enabled devices (e.g. RVS).¶

For UAS RID, HDAs can provide any of the following services:¶

• registration and public lookup of DETs as a Key ID for Authentication as defined in [RFC9575]¶
• registration and access controlled lookup of DETs as a pseudonymous UAS Session ID¶
• registration of UAS ID and UTM Operational Intent to bind them together (if allowed by cognizant authority)¶

An HDA SHOULD maintain a set of RVS servers for UAS clients that may use HIP. This service MUST be discoverable through the DNS zone maintained by the HDA's RAA.¶

An RAA may assign a block of values to an individual organization. This is completely up to the individual RAA's published policy for delegation. Such policy is out of scope for this document.¶

5.1. DIME Provisioning Agent (DPA)

The DPA performs the task of vetting information coming from clients wishing to register. It then delegates (internally or externally) various items to other components in the DIME. This is the primary component that handles all DRIP related cryptographic operations for incoming registrations to the DIME. The role of the DPA is similar to that of a registrar in the conventional model of domain name management in the DNS.¶

The DPA:¶

• SHOULD have a publicly accessible and discoverable interface for clients to register¶
• SHOULD provide DNS service for the DET's registered domain name¶

Specific details of the above interfaces (such as advertisement) are out of scope for this document.¶

5.2. Registrar & Registry

The Registrar and Registry are commonly used concepts in the DNS. These components interface the DIME into the DNS hierarchy and thus operation SHOULD follow best common practices, specifically in security (such as running DNSSEC) as appropriate. The following RFC provide suitable guidance: [RFC7720], [RFC4033], [RFC4034], [RFC4035], [RFC5155], [RFC8945], [RFC2182], [RFC4786], [RFC3007].¶

If DNSSEC is used, a DNSSEC Practice Statement (DPS) SHOULD be developed and published. It SHOULD explain how DNSSEC has been deployed and what security measures are in place. [RFC6841] documents a Framework for DNSSEC Policies and DNSSEC Practice Statements.¶

The interfaces and protocol specifications for registry-registrar interactions are intentionally not specified in this document. These will depend on nationally defined policy and prevailing local circumstances. It is expected registry-registrar activity will use the Extensible Provisioning Protocol (EPP) [RFC5730]. The registry SHOULD provide a lookup service such as WHOIS [RFC3912] or RDAP [RFC9082] to provide public information about registered domain names.¶

Decisions about DNS or registry best practices and other operational matters SHOULD be made by the CAA, ideally in consultation with local stakeholders.¶

5.3. DIME Information Agent (DIA)

The DIA is the main component handling information egress (via lookup) of the DIME. Public information SHOULD be in Authoritative Name Servers and MAY be mirrored into the Private Information Registry. Related PII MUST be stored in a Private Information Registry and MAY be available via RDAP or equivalent.¶

The DIA:¶

• MUST have an access controlled interface for add/delete/update of information; this interface MAY be publicly available¶

  • this interface definition, for example an EPP schema, is out of scope for this document¶

• SHOULD have an access controlled interface to query for private information; this interface MAY be publicly available¶

  • if this interface is publicly available it MAY use RDAP or equivalent protocols¶
  • if this interface is not publicly available its specification is out of scope for this document¶

Certain information may be considered PII. This is a National Matter, subject to prevailing national laws and regulations. Such data MUST be protected from access using AAA (for example using XACML). These decisions should be determined by the CAA. See Section 7 for more information.¶

A DIA can be considered an additional function to an existing DNS Registry Operator for DRIP. It MAY be a separate service or entity that interfaces with a DNS provider.¶

6.1. Generic DET Registration

Generically a DET can be used as an identifier for any node in UTM and SHOULD be registered to a DIME. For example a CAA may choose to use DETs as an identifier for its Operators. A data model would be required to define all the information for registration for a given type of client. Such data models are out of scope for this document.¶

The general process for a registering DET is shown in Figure 4 and the accompanying text.¶

            registrant             dime
                |                   |
(1) GEN_DET/HI  |                   |
                |----(2) INPUT----->|
                |                   | (3) VALID_INPUT?
                |<-------FAIL-------|
                |                   | (4) DUPE_HI?
                |<-------FAIL-------|
                |                   | (5) DUPE_DET?
                |<-------FAIL-------|
                |                   | (6) GEN_BE
                |                   | (7) UPDATE_DATABASE
                |                   | (8) UPDATE_NS
                |<----(9) OUTPUT----|

(1) GEN_DET/HI:

The registrant that plans to use the identity and its cryptographic properties MUST generate the asymmetric key-pair of their choosing and protect the private key with best common practices. The registrant SHOULD derive the corresponding DET. How the registrant obtains the desired HID for DET generation is out of scope for this document.¶

(2) INPUT:

The registrant MUST format and send the required information for a given service registration as specified by the DIME. Specific service data models and methods, other than those proposed by this document (see Section 6.2), are out of scope.¶

(3) VALID_INPUT?:

The DIME, upon receipt of service registration inputs, MUST validate the input data. This may be simply performing syntax checks to ensure the data is properly formatted all the way to full semantic validation. Signed data, such as Endorsements, MUST have their signatures verified before further processing. Failure of input validation SHOULD return errors to the registrant.¶

(4) DUPE_HI?:

The DIME MUST check that the proposed HI is not a duplicate already in use. The registrant SHOULD be notified with an error if duplication is detected.¶

(5) DUPE_DET?:

The DIME MUST check that the proposed DET, derived from the HI, is not a duplicate already in use. If the registrant proposed a DET with HID outside that of the DIME, it MUST be rejected. If the registrant only provided the HI, the DIME MUST generate the DET using its HID. The registrant SHOULD be notified with an error if duplication is detected.¶

(6) GEN_BE:

The DIME, after all the above validation, MUST generate a Broadcast Endorsement using the provided HI and DET from the registrant as the evidence. This Endorsement signifies the DIME accepts the DET/HI pairing from the registrant.¶

(7) UPDATE_DATABASE:

The DIME MUST update the Private Information Registry with any PII that was part of the registration. It MAY include additional metadata or public information. How the Private Information Registry is updated is out of scope for this document. example a CAA may choose to use DETs as an identifier for its Operators. A data model would be required to define all the information (8) UPDATE_NS:¶

The DIME MUST update the Authoritative Name Server with any public information that was part of the registration. This information MUST be stored as described in Section 8.¶

(9) OUTPUT:

The DIME, upon successful updates of the Private Information Registry and Name Server, transmits to the registrant the list of Broadcast Endorsements that make up the trust chain for use in [RFC9575].¶

6.2. Session ID & Authentication Services

Both UAS RID Authentication and UAS Specific Session ID services when using DETs share a common data model for registration. Endorsements (Section 9) are the RECOMMENDED way to securely transfer information for registration.¶

Appendix D contains the general data model as well as the specific variants for Session ID & Authentication services.¶

8.1. DRIP Entity Tags

The REQUIRED mechanism is to place any information into ip6.arpa when using a DET. Since the DET is an IPv6 address it can be nibble-reversed and used in the zone, per standard conventions.¶

The prefix 2001:30::/28 is registered with IANA [RFC9374] and 3.0.0.1.0.0.2.ip6.arpa - the corresponding reverse domain - SHOULD be under the administrative control of the Apex. In addition to the DNS infrastructure for 3.0.0.1.0.0.2.ip6.arpa, the Apex SHOULD be responsible for the allocation of IPv6 addresses in this prefix. The RAA, might need to develop an addressing plan for delegating HDA values.¶

Distribution of HHIT (IPv6 address) blocks SHOULD be done using the 14-bit RAA space as a framework. The Apex SHOULD allocate blocks to each entity who can then assign them to HDAs in accordance with local law and policy. All HDAs MUST have an IPv6 address in 2001:30::/28. A discrete zone SHOULD be delegated for each HDA. These MUST contain an HHIT resource record (Appendix A) for itself.¶

Reverse lookups of these IPv6 addresses MUST return HIP and HHIT RRTypes. Depending on local circumstances these lookups MAY return other RRTypes.¶

10.1. Certificate Policy and Certificate Stores

X.509 certificates are optional for the DRIP entities covered in this document. DRIP endpoint entities (EE) (i.e., UA, GCS, and Operators) may benefit from having X.509 certificates. Most of these certificates will be for their DET and some will be for other UAS identities. To provide for these certificates, some of the other entities (e.g. USS) covered in this document will also have certificates to create and manage the necessary PKI structure.¶

Three certificate profiles are defined, with examples, and explained in [drip-dki]. Each has a specific role to play and an EE may have its DET enrolled in all of them. There is a 'Lite' profile that would work well enough on constrained communication links for those instances where various issues push the use of X.509. There is a 'Basic; profile that is more in line with [RFC5280] recommendations, but is still small enough for many constrained environments. Finally there is a profile to directly add DET support into the civil/general aviation certificates as discussed below.¶

A Certificate Authority (CA) supporting DRIP entities MAY adhere to the ICAO's Aviation Common Certificate Policy (ACCP). The CA(s) supporting this CP MUST either be a part of the ACCP cross-certification or part of the ACCP CA Trust List. It is possible that future versions of the ACCP will directly support the DRIP Basic profile.¶

• Authors Note: ACCP is ICAO Doc 10169 Aviation Common Certificate Policy (ACCP). I can't get a url for that, but so far these is no changes from v 0.93 of the old IATF CP; changes are in the works then will be posted, so continue to reference IATF CP¶

EEs may use their X.509 certificates, rather than their rawPublicKey (i.e. HI) in authentication protocols (as not all may support rawPublicKey identities). Short lived DETs like those used for a single operation or even for a day's operations may not benefit from X.509. Creating then almost immediately revoking these certificates is a considerable burden on all parts of the system. Even using a short notAfter date will not completely mitigate the burden of managing these certificates. That said, many EEs will benefit to offset the effort. It may also be a regulator requirement to have these certificates. Finally, certificates can provide the context of use for a DET (via policy constraint OIDs).¶

Typically an HDA either does or does not issue a certificate for all its DETs. An RAA may specifically have some HDAs for DETs that do not want/need certificates and other HDAs for DETs that do need them. These types of HDAs could be managed by a single entity thus providing both environments for its customers.¶

It is recommended that DRIP X.509 certificates be stored as DNS TLSA Resource Records, using the DET as the lookup key. This not only generally improves certificate lookups, but also enables use of DANE [RFC6698] for the various servers in the UTM and particularly DIME environment and DANCE [dane-clients] for EEs (e.g. [drip-secure-nrid-c2]). All DRIP certificates MAY alternatively be available via RDAP. LDAP/OCSP access for other UTM and ICAO uses SHOULD also be provided.¶

10.2. Certificate Management

PKIX standard X.509 issuance practices should be used. The certificate request SHOULD be included in the DET registration request. A successful DET registration then MUST include certificate creation, store, and return to the DET registrant. It is possible that the DET registration is actually an X.509 registration. For example, PKIX CSR may be directly used and the DET registration and Endorsement creation are a addition to this process. Further ACME may be directly extendable to provide the DET registration.¶

Note that CSRs do not include the certificate validityDate; adding that is done by the CA. If in the registration process, the EE is the source of notBefore and notAfter dates, they need to be sent along with the CSR.¶

Certificate revocation will parallel DET revocation. TLSA RR MUST be deleted from DNS and RDAP, LDAP, and OCSP return revoked responses. CRLs SHOULD be maintained per the CP.¶

10.3. Examples

For full examples of X.509 Certificates and the process to use them see [drip-dki].¶

10.4. Alternative Certificate Encoding

The CBOR Encoded X.509 Certificates (C509 Certificates) [cbor-cert] provides a standards-based approach to reduce the size of X.509 certificates both on-the-wire and in storage. The PKI-Lite RAA certificate example in Appendix B.2 is 331 bytes. The matching C509 certificate is 183 bytes. This sort of difference may have significant impact both on UAS storage requirements and over-the-air transmission impact.¶

• Author: where is the B.2 example from?¶

C509 provides two approaches for encoding X.509:¶

1. An invertible CBOR re-encoding of DER encoded X.509 certificates [RFC5280], which can be reversed to obtain the original DER encoded X.509 certificate.¶
2. Natively signed C509 certificates, where the signature is calculated over the CBOR encoding instead of over the DER encoding as in 1. This removes the need for ASN.1 and DER parsing and the associated complexity but they are not backwards compatible with implementations requiring DER encoded X.509.¶

The invertible CBOR encoding may be sufficient for most needs. The CBOR objects clearly indicate which approach was used, so that the receiver can properly process the C509 object. For interoperability in DRIP, it is recommended that invertible CBOR encoding be used.¶

Using the invertible CBOR encoding is achieved through in-line libraries that convert in the desired direction. Since it is not expected that DNS protocols to implement this conversion, the HHIT RR SHOULD contain the normal X.509 DER encoding. The CBOR encoding MAY be used, but operational experience will be needed to see if there are measurable gains in doing so.¶

11.1. Management of DRIP Apex

IANA is asked to maintain the DNS registry for 3.0.0.1.0.0.2.ip6.arpa and oversee the delegation of RAA allocations until administrative control can be transitioned to ICAO. Requests for delegation of RAAs MUST be approved by the appropriate CAA. Control of a country's RAAs is a National Matter and is expected to be overseen by the CAA. Management issues include delegation of these RAAs in the 3.0.0.1.0.0.2.ip6.arpa Apex, Secure DNS policy, validation and delegation of DET registrations. These are out of scope for this document.¶

Requests for delegations of RAAs MUST be validated, either by ICAO or the appropriate CAA. This SHOULD follow a process analogous to the procedures used in ENUM [RFC3761] for the delegation of country codes for E.164 telephone numbers. Delegation of RAAs is a National Matter and MUST NOT be made without the consent of the relevant CAA.¶

11.2. IANA DRIP Registry

12.1. DNS Operational Considerations

The contents of this section are duplicated in Section 5.2¶

The Registrar and Registry are commonly used concepts in the DNS. These components interface the DIME into the DNS hierarchy and thus operation SHOULD follow best common practices, specifically in security (such as running DNSSEC) as appropriate. The following RFC provide suitable guidance: [RFC7720], [RFC4033], [RFC4034], [RFC4035], [RFC5155], [RFC8945], [RFC2182], [RFC4786], [RFC3007].¶

If DNSSEC is used, a DNSSEC Practice Statement (DPS) SHOULD be developed and published. It SHOULD explain how DNSSEC has been deployed and what security measures are in place. [RFC6841] documents a Framework for DNSSEC Policies and DNSSEC Practice Statements.¶

The interfaces and protocol specifications for registry-registrar interactions are intentionally not specified in this document. These will depend on nationally defined policy and prevailing local circumstances. It is expected registry-registrar activity will use the Extensible Provisioning Protocol (EPP) [RFC5730]. The registry SHOULD provide a lookup service such as WHOIS [RFC3912] or RDAP [RFC9082] to provide public information about registered domain names.¶

Decisions about DNS or registry best practices and other operational matters SHOULD be made by the CAA, ideally in consultation with local stakeholders.¶

12.2. Key Rollover & Federation

During DET key rollover the DIME MUST inform all children and parents of the change - using best standard practices of a key rollover.¶

A DET has a natural ability for a single DIME to hold different cryptographic identities under the same HID values. This is due to the lower 64-bits of the DET being a hash of the public key and the HID of the DET being generated. As such during key rollover, only the lower 64-bits would change and a check for a collision would be required.¶

This attribute could also allow for a single DIME to be "federated" across multiple DETs sharing the same HID value. This method of deployment has not been thoroughly studied at this time.¶

12.3. DET Generation

• Author: is this section valid anymore? Perhaps we hard specify that devices ONLY generate on their own hardware instead of "out-sourcing" as this section implies.¶

Under the FAA [FAA-RID-NPRM], it is expecting that Session IDs for UAS are assigned by the UTM and are one-time use. The methods for this however are unspecified leaving two options.¶

Option 1:¶

• The entity generates its own DET, discovering and using the RAA and HDA for the target DIME. The method for discovering a DIME's RAA and HDA is out of scope here. This allows for the device to generate an DET to send to the DIME to be accepted (thus generating the required Self-Endorsement) or denied.¶

Option 2:¶

• The entity sends to the DIME its HI for it to be hashed and result in the DET. The DIME would then either accept (returning the DET to the device) or deny this pairing.¶

Keypairs are expected to be generated on the device hardware it will be used on. Due to hardware limitations and connectivity it is acceptable, though not recommended, under DRIP to generate keypairs for the Aircraft on Operator devices and later securely inject them into the Aircraft. The methods to securely inject and store keypair information in a "secure element" of the Aircraft is out of scope of this document.¶

A.1. Wire Format

hhit-rr = #6.TBD([
    hhit, type, status, abbreviation, endorsements, uris
])
hhit = #6.54(bstr .size(16))
type = uint .size(2)
status = uint .size(1)
abbreviation = tstr .size(15)
endorsements = [1* #6.TBD]  ; MUST be in e-type order
uris = [* #6.32]

A.2. Presentation Format

<domain> HHIT IN ( HHIT TYPE STATUS ABBREV [Endorsement(s)] [URI(s)])

A.3. Field Descriptions

Type:

This field is two octets with values defined in Section 11.2.3. It is envisioned that there may be many types of HHITs in use. In some cases it may be helpful to understand the HHITs role in the ecosystem like described in [drip-dki].¶

Status:

This field is a single byte with values defined in Section 11.2.4. A HHIT can go through various states during its life-cycle in the ecosystem. For example: TODO(ATW).¶

Abbreviation:

This field is meant to provide an abbreviation to the HID structure for display devices. The specific contents of this field are not defined here, but a recommendation/example can be found in Appendix C.¶

Endorsements:

This field is a list of CBOR encoded Endorsements in e-type order. It MUST included at least one Broadcast Endorsement (Appendix F.2). A special case for the Apex is that the Broadcast Endorsement is filled with its own DET and HI as evidence (i.e. a self-signed Broadcast Endorsement).¶

URIs:

This field is a list of URIs that can be used for the given HHIT to obtain information.¶

A.4. Example

The following example was generated using the CDDL presented in Figure 6 with the tool in Appendix F of [RFC8610].¶

CBOR Tag 55799 is used in this example.¶

TODO

B.1. Wire Format

uasrid-rr = #6.55799({
    uas_type: nibble-field,
    uas_ids: {+ &uas-id-types => uas-id},
    ? auth-grp,
    ? self-grp,
    ? op_type: 0..3,
    ? area-grp,
    ? classification-grp,
    ? operator-grp
})
uas-id = bstr .size(20)
uas-id-types = (none: 0, serial: 1, caa: 2, utm: 3, session: 4)
auth-grp = (
    a_type: nibble-field,
    a_data: bstr .size(1..255),
    ? add_a_data: bstr .size(0..255)
)
area-grp = (
    area_count: 1..255,
    area_radius: float,
    area_floor: float,
    area_ceiling: float
)
classification-grp = (
    ua_class: 0..8,
    eu_class: nibble-field,
    eu_category: nibble-field
)
self-grp = (
    desc_type: nibble-field,
    description: tstr .size(23)
)
operator-grp = (
    operator_id_type: nibble-field,
    operator_id: bstr .size(20)
)
nibble-field = 0..15

B.2. Presentation Format

<domain> IN UASRID ( TODO )

B.3. Field Descriptions

The field names and their general typing are borrowed from the ASTM [F3411] data dictionary. See that document for additional information on fields semantics and units.¶

B.4. Example

The following example was generated using the CDDL presented in Figure 8 with the tool in Appendix F of [RFC8610].¶

CBOR Tag 55799 is used in this example.¶

d9d9f7a5687561735f747970650c6775
61735f696473a100548c0ee64a4212ba
be59e8459b25e5e550b0b3ae85687561
5f636c617373076865755f636c617373
006b65755f63617465676f727905

55799({
  "uas_type": 12,
  "uas_ids": {0: h'8C0EE64A4212BABE59E8459B25E5E550B0B3AE85'},
  "ua_class": 7,
  "eu_class": 0,
  "eu_category": 5
})

D.1. UAS ID Handling

The uas_id_type field MUST be set to same UAS ID Type in the ASTM [F3411] Basic ID Message to ensure proper decoding of the uas_id field.¶

The uas_id field MUST be set with the octets found in the ASTM [F3411] Basic ID Message UAS ID field. By using identical contents of the Basic ID Message the Specific Session ID Type octet (the first octet in the UAS ID when using UAS ID Type is 0x4) is preserved. It is RECOMMENDED to preserve the null padding.¶

D.2. Registration Model Examples

The following are example CDDLs for registration models for the Session ID and Authentication & Session ID services.¶

$$evidence //= ({
    serial_number: bstr .size(20),
    uas_id_type: 0..15,
    uas_id: bstr .size(20),
    dki: dki-grp
},)
dki-grp = {
    hi: bstr .size(32)
}

$$evidence //= ({
    serial_number: bstr .size(20),
    uas_id_type: 0..15,
    uas_id: bstr .size(20),
    dki: dki-grp
},)
dki-grp = {
    det: #6.48(bstr .size(16)),
    hi: bstr .size(32)
}

F.1. Self Endorsement

The Self Endorsement MAY be used during registration process as an input. $$evidence contains the HI of the endorser. $$endorser contains the HHIT of the endorser. $$signature contains the EdDSA25519 signature.¶

e-type = 0  ; Self Endorsement
$$evidence //= (eddsa25519-hi,)
$$endorser //= (hhit,)
$$signature = (eddsa25519-sig,)

TODO

TODO

F.2. Broadcast Endorsement

Defined by [RFC9575] in a binary format (see Figure 18) to support Authentication over ASTM [F3411] constrained links and is the main content of the DRIP Link. This Endorsement is a required output of registration to a DIME at any level.¶

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+---------------+---------------+
|                              VNB                              |
+---------------+---------------+---------------+---------------+
|                              VNA                              |
+---------------+---------------+---------------+---------------+
|                                                               |
|                            HHIT of                            |
|                             Child                             |
|                                                               |
+---------------+---------------+---------------+---------------+
|                                                               |
|                                                               |
|                                                               |
|                             HI of                             |
|                             Child                             |
|                                                               |
|                                                               |
|                                                               |
+---------------+---------------+---------------+---------------+
|                                                               |
|                            HHIT of                            |
|                            Parent                             |
|                                                               |
+---------------+---------------+---------------+---------------+
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                           Signature                           |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
|                                                               |
+---------------+---------------+---------------+---------------+

e-type = 1  ; SAM Type=1, Broadcast Endorsement
$$evidence //= (hhit, eddsa25519-hi,)
$$endorser //= (hhit,)
$$signature = (eddsa25519-sig,)

$$evidence are the child entities (e.g. a UA) DET/HHIT and its associated HI. $$endorser contains the HHIT of the parent entity (e.g. DIME) as the endorser. $$signature contains the EdDSA25519 signature.¶

Note that the Endorsement Type (e-type) field is the same value as the SAM Type allocated to DRIP (i.e. the value 1). As such for DRIP Authentication the e-type field is not encoded into the binary form and is instead handled by the SAM Type of the Authentication framing.¶

TODO

TODO

F.3. Wrapper Endorsement

Defined by [RFC9575] in a binary format (see Figure 22) to support Authentication over ASTM [F3411] constrained links and is the main content of the DRIP Wrapper.¶

TODO

e-type = 2 ; SAM Type=2, Wrapper Endorsement
$$evidence //= (*4 astm-message,)
$$endorser //= (hhit,)
$$signature = (eddsa25519-sig,)
astm-message = bstr .size(25)

TODO

TODO

F.4. Manifest Endorsement

Defined by [RFC9575] in a binary format (see Figure 26) to support Authentication over ASTM [F3411] constrained links and is the main content of the DRIP Manifest.¶

TODO

e-type = 3  ; SAM Type=3, Manifest Endorsement
$$evidence //= (3*11 manifest-hash,)
$$endorser //= (hhit,)
$$signature = (eddsa25519-sig,)
manifest-hash = bstr .size(8)

TODO

TODO

F.5. Frame Endorsement

Defined by [RFC9575] in a binary format (see Figure 30) to support Authentication over ASTM [F3411] constrained links and is the main content of the DRIP Frame.¶

TODO

e-type = 4  ; SAM Type=4, Frame Endorsement
$$evidence //= (frame-type, frame-data,)
$$endorser //= (hhit,)
$$signature = (eddsa25519-sig,)
frame-type = uint .size(1)
frame-data = bstr .size(1..111)

TODO

TODO