<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.43 (Ruby 3.4.9) -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-linker-diem-adem-dns-01" category="info" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" version="3">
  <!-- xml2rfc v2v3 conversion 3.34.1 -->
  <front>
    <title abbrev="ADEM over DNS">ADEM - Distribution and Discovery over DNS</title>
    <seriesInfo name="Internet-Draft" value="draft-linker-diem-adem-dns-01"/>
    <author fullname="Felix Linker">
      <organization/>
      <address>
        <email>linkerfelix@gmail.com</email>
      </address>
    </author>
    <date year="2026" month="October" day="05"/>
    <area>Applications and Real-Time</area>
    <workgroup>Digital Emblems</workgroup>
    <keyword>next generation</keyword>
    <keyword>unicorn</keyword>
    <keyword>sparkling distributed ledger</keyword>
    <abstract>
      <?line 37?>

<t>TODO Abstract</t>
    </abstract>
    <note removeInRFC="true">
      <name>About This Document</name>
      <t>
        The latest revision of this draft can be found at <eref target="https://adem-wg.github.io/adem-dns-spec/draft-linker-diem-adem-dns.html"/>.
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-linker-diem-adem-dns/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        Digital Emblems Working Group mailing list (<eref target="mailto:diem@ietf.org"/>),
        which is archived at <eref target="https://mailarchive.ietf.org/arch/browse/diem"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/diem/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/adem-wg/adem-dns-spec"/>.</t>
    </note>
  </front>
  <middle>
    <?line 42?>

<section anchor="introduction">
      <name>Introduction</name>
      <t>The ADEM Core Specification specifies how a set of <em>tokens</em>, encoded as JSON Web Signatures (JWSs) <xref target="RFC7515"/>, can be used as a digital emblem to signal that digital assets enjoy specific protections under International Humanitarian Law (IHL).
This document describes a DNS-based distribution and discovery for ADEM tokens.</t>
    </section>
    <section anchor="conventions-and-definitions">
      <name>Conventions and Definitions</name>
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>
      <?line -18?>

</section>
    <section anchor="dns-distribution">
      <name>DNS Distribution</name>
      <t>Given a set of tokens containing exactly one emblem and zero or more associated endorsements, issuers can distribute this set and any public keys needed to validate it via DNS TXT records <xref target="RFC1035"/>, as follows.</t>
      <t>For each such set, issuers <bcp14>MAY</bcp14> choose a unique <em>identifier</em> string.
If multiple sets of tokens are associated with a given domain name, issuers <bcp14>SHOULD</bcp14> choose such a string.</t>
      <t>Each token or public key is distributed as its own TXT record, which includes a key and a value.
For token records, the value encodes the token in JWT compact serialization.
For public key records, the value encodes the public key as a JSON Web Key (JWK) <xref target="RFC7517"/>.</t>
      <t>Each record's key <bcp14>MUST</bcp14> be formatted as:</t>
      <artwork><![CDATA[
key := "adem-" ( "token" | "key" ) [ "-" identifier ]

identifier := CHARACTER-NO-HYPEN+

record := key "=" value
]]></artwork>
      <t><tt>CHARACTER-NO-HYPEN</tt> is any printable ASCII character as specified in <xref target="RFC0020"/> except for <tt>"-"</tt>.
If present, <tt>identifier</tt> <bcp14>MUST</bcp14> coincide with the string identifying the token set.</t>
    </section>
    <section anchor="security-considerations">
      <name>Security Considerations</name>
      <t>TODO Security</t>
    </section>
    <section anchor="iana-considerations">
      <name>IANA Considerations</name>
      <t>This document has no IANA actions.</t>
    </section>
  </middle>
  <back>
    <references anchor="sec-combined-references">
      <name>References</name>
      <references anchor="sec-normative-references">
        <name>Normative References</name>
        <reference anchor="RFC2119">
          <front>
            <title>Key words for use in RFCs to Indicate Requirement Levels</title>
            <author fullname="S. Bradner" initials="S." surname="Bradner"/>
            <date month="March" year="1997"/>
            <abstract>
              <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="2119"/>
          <seriesInfo name="DOI" value="10.17487/RFC2119"/>
        </reference>
        <reference anchor="RFC8174">
          <front>
            <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
            <author fullname="B. Leiba" initials="B." surname="Leiba"/>
            <date month="May" year="2017"/>
            <abstract>
              <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="8174"/>
          <seriesInfo name="DOI" value="10.17487/RFC8174"/>
        </reference>
        <reference anchor="RFC1035">
          <front>
            <title>Domain names - implementation and specification</title>
            <author fullname="P. Mockapetris" initials="P." surname="Mockapetris"/>
            <date month="November" year="1987"/>
            <abstract>
              <t>This RFC is the revised specification of the protocol and format used in the implementation of the Domain Name System. It obsoletes RFC-883. This memo documents the details of the domain name client - server communication.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="13"/>
          <seriesInfo name="RFC" value="1035"/>
          <seriesInfo name="DOI" value="10.17487/RFC1035"/>
        </reference>
        <reference anchor="RFC0020">
          <front>
            <title>ASCII format for network interchange</title>
            <author fullname="V.G. Cerf" initials="V.G." surname="Cerf"/>
            <date month="October" year="1969"/>
          </front>
          <seriesInfo name="STD" value="80"/>
          <seriesInfo name="RFC" value="20"/>
          <seriesInfo name="DOI" value="10.17487/RFC20"/>
        </reference>
      </references>
      <references anchor="sec-informative-references">
        <name>Informative References</name>
        <reference anchor="RFC7515">
          <front>
            <title>JSON Web Signature (JWS)</title>
            <author fullname="M. Jones" initials="M." surname="Jones"/>
            <author fullname="J. Bradley" initials="J." surname="Bradley"/>
            <author fullname="N. Sakimura" initials="N." surname="Sakimura"/>
            <date month="May" year="2015"/>
            <abstract>
              <t>JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and an IANA registry defined by that specification. Related encryption capabilities are described in the separate JSON Web Encryption (JWE) specification.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7515"/>
          <seriesInfo name="DOI" value="10.17487/RFC7515"/>
        </reference>
        <reference anchor="RFC7517">
          <front>
            <title>JSON Web Key (JWK)</title>
            <author fullname="M. Jones" initials="M." surname="Jones"/>
            <date month="May" year="2015"/>
            <abstract>
              <t>A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. This specification also defines a JWK Set JSON data structure that represents a set of JWKs. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and IANA registries established by that specification.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7517"/>
          <seriesInfo name="DOI" value="10.17487/RFC7517"/>
        </reference>
      </references>
    </references>
    <?line 105?>

<section numbered="false" anchor="acknowledgments">
      <name>Acknowledgments</name>
      <t>TODO acknowledge.</t>
    </section>
  </back>
  <!-- ##markdown-source:
H4sIAAAAAAAAA4VWbXMaNxD+rl+xvXxo4hps8jJJmbwRwDGJDakhk2YymbG4
W0D1nXSVdMYkdX9Lf0t/WXcl4EycTPlwnFbaFz377O41Gg3hlc+xDUmn1z+F
BvSU81ZNK6+MBqkzFqTmEu0K+Am94TgRcjq1eLlRquWp9Dg3dtUGpWdGiMyk
WhZkPbNy5hu50hdoG5nCoiEzemTaNQ5bwlXTQjlHHv2qpNOD/uQI4A7I3Bly
onSGJdJD+2QfEsyUN1bJnBeDziv6M5beziZHidBVMUXbFhlF0hap0Q61q1wb
vK1QUMgPhLQoOfSyzBUFTF5duOgZyrwxUQUmYmnsxdyaqqRzPTVXXubQL6Y5
Fi4RF7ii/awtCC2NVx7mqNEGQyyqtEqNDa+ulPaCLj2HbIMqZpBjNkcrLlFX
FCLADx0BRDiSDxQOW3nNJ1leSJWTnIF8qdDPmsbOWS5tuiD5wvvStQ8O+BiL
1CU2N8cOWHAwtWbp8IANsB45XlRT0gxZWdKhTXZciSmfyAlP52/YXp9sRtWm
Mrs6Bz/OeHPhizwRQlZ+YSzDSPYBZlWeR7IcYa6u4CSohi2M943GZrz7cs6i
ZmoKIbSxBaF/SWAKpl29ajabQjQaDZBTgl+mXojJqDeCznYZdguVZTkKcQcG
2luTVWnIpZgsEALBu8YijOlWarZmDLi4QgcLswQJDj2YGex5c0GE29sH1KnJ
KNvSwZvxaAgfcApjNdfSV5a07r75MHb34OvXF2dH3cePWo+ur/chlRqmCJWL
epJoEymBgRLgDTg2kYNfSL/dlY68O/L4h1ltAkuhtMZjGuldUfFYvh1aHeIn
reOqkJr0qZI0nMgl3B0cn9xr0q2VAyrcqqB6gwxdSsRFjoZKvDGVHFz2bZPI
tk2C8I+gRSSaDGvXaGJ7XWk9nClyzeuIMpUUcE05SE7fjydc2PwPw1F4P+v/
9n5w1u/x+/i4c3KyfRHrE+Pj0fuTXv1Wa3ZHp6f9YS8qkxR2RCI57XykHY4q
Gb2bDEbDzklC3YsQvgkD9QxGn5KjGMTSog85Eht8MtZ51X337z+th5TVnyir
91utX6+v14snrccPabFcoI7ejM5X66Vf4ErIskRp2YrMc2JCyal1+8wDRxTT
sECLhObeJ0bmcxueTtOy9fD5WsAX3hFuMNsRBsxuS24pRxC/I/qOmy2aO/Jv
kN6Nt/NxZ73B/Ybw6QsqdoRG68mL54IpRNzbGU1CvKYa13XlRboBdXwviVzU
LfGKSpxANmRoXUAM/Be0hgdGwUVNpWNSJTmZNGCMdcjpJthpHFVoXSjJunlH
VrBHtiT1CspqSlOECexoGCBXPPHkUuaKJxAoD5cqVA5Mfp+AxTSwPHKidfgg
lD2leGbynDoy5feIQkOZLsBV/EBfx0K4QbowxlHcPGb+rBD2FI9F7kR2DzhM
PW+KwQyKKveqzBFCa6jxkbuXXlL3JmPzgGVmqKlq4CZcO13nfe03BCW3jkSf
Iw2mGdIaDODiuTHz6IqK4yAe1zjsE/8V6Sud5lUWWgyrBmgZwor4znBE+2vs
QrnE3XWPdUESD1H4bz5MiAVFScmny/N3gvoSel40diPG/7F442Roxts2/pYk
1L/f3mjfj6+vN2hEqz+7oBhKk7pGnEoRCRpMf9OPvyOg/Ww9cxO4C0m4QwJ/
QUJ7CdyDT5DQTp1i+Ewjrl6Rdve4c9bpTvpnjeGocfzxXX/4ixAxBN5mH8mz
JN4uuhXnt3XOOV+BzpRXL6lWoDPuDgaUdsmDknxxH1rPvNDrIoUPD+8fUlvD
qxRLH3r/OUV8HihITZI+voi/53XI5xGR1FDOSRr5x2BHRm2uuuL3OqvE4TBH
xphWVvkVDxRHR+NHl1tP9c1u6BeDzrBz+9hOT1/QlbSJJ2UclM31F8FUphds
pZNeaLPkD7bQFsTXdvy+xOxZMqP2jMn12rncniTS/geOJE3sVwsAAA==

-->

</rfc>
