INTAREA R. Moskowitz Internet-Draft HTT Consulting Intended status: Standards Track S. Card Expires: 20 November 2023 AX Enterprize, LLC 19 May 2023 The DRIP DET public Key Infrastructure draft-moskowitz-drip-dki-01 Abstract The DRIP Entity Tag (DET) public Key Infrastructure (DKI) is a specific variant of classic Public Key Infrastructures (PKI) where the orginization is around the DET, in place of X.520 Distinguished Names. Further, the DKI uses DRIP Endorsements in place of X.509 certificates for establishing trust within the DKI. There is a shadow PKI behind the DKI, with many of its X.509 fields mirroring content in the DRIP Endorsements. This PKI can at times be used where X.509 is expected and non-constrained communication links are available that can handle their larger size. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 20 November 2023. Copyright Notice Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Moskowitz & Card Expires 20 November 2023 [Page 1] Internet-Draft DRIP DKI May 2023 Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terms and Definitions . . . . . . . . . . . . . . . . . . . . 4 2.1. Requirements Terminology . . . . . . . . . . . . . . . . 4 2.2. Definitions . . . . . . . . . . . . . . . . . . . . . . . 4 3. The DKI Levels . . . . . . . . . . . . . . . . . . . . . . . 4 3.1. The Apex . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2. The RAAs . . . . . . . . . . . . . . . . . . . . . . . . 5 3.3. The HDAs . . . . . . . . . . . . . . . . . . . . . . . . 5 4. DNS view of DKI . . . . . . . . . . . . . . . . . . . . . . . 5 5. The Offline cache of HDA Endorsements . . . . . . . . . . . . 6 6. RAAs set aside for Testing . . . . . . . . . . . . . . . . . 6 7. The DKI's Shadow PKI . . . . . . . . . . . . . . . . . . . . 6 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 9. Security Considerations . . . . . . . . . . . . . . . . . . . 7 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7 10.1. Normative References . . . . . . . . . . . . . . . . . . 7 10.2. Informative References . . . . . . . . . . . . . . . . . 7 Appendix A. Test DETs and Endorsements . . . . . . . . . . . . . 8 A.1. Test DNS . . . . . . . . . . . . . . . . . . . . . . . . 11 A.2. Test X.509 Certificates . . . . . . . . . . . . . . . . . 12 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 12 1. Introduction A DRIP Entity Tag (DET, [RFC9374]) public Key Infrastructure (DKI) is a strict hierarchy, governed by the administrator of the DET prefix [IPv6-SPECIAL] and having the authority to authorize RAAs. RAAs in turn authorize HDAs within their domain. This authorization is managed via a set of DETs whose sole use is to define the DKI. The RAA Authorization DETs MUST reside in HID = RAA#|0 (Apex Authorization DET in HID = 0|0). There are three main classifications/types of DETs: Authorization DETs Used to assert the authorization of a DKI level. Endorsing DETs Used to assert operations within DKI level. Moskowitz & Card Expires 20 November 2023 [Page 2] Internet-Draft DRIP DKI May 2023 Operational DETs Used by operational entities within DKI level All DETs exist in DET-Endorsements (Appendix B of [drip-registries]). These DET-Endorsements provide the proof of registration and thus trust. These DETs, through chained Endorsements define the DKI as follows: +----------+ | Auth | +-o------o-+ | | | +-o-----+ Apex | +--o----+| | |Endorse|+ | +---o---+ | | | +-o-----+ | +--o----+| | |CRL,Srv|+ | +-------+ | ******************|************************************ +-o--------+ +-o--------+| | Auth |+ +--o-----o-+ | | | +-o-----+ RAAs | +--o----+| | |Endorse|+ | +---o---+ | | | +-o-----+ | +--o----+| | |CRL,Srv|+ | +-------+ | ******************|************************************ +-o--------+ +-o--------+| | Auth |+ +----o-----+ | +-o-----+ HDAs +--o----+| |Endorse|+ +---o---+ Moskowitz & Card Expires 20 November 2023 [Page 3] Internet-Draft DRIP DKI May 2023 | +-o-----+ +--o----+| |CRL,Srv|| |UAS |+ +-------+ ******************************************************* Figure 1: The DKI Endorsements The Authorization DETs exist in a set of DET-Authorization- Endorsements. The lifetime of these endorsements SHOULD be no less than 1 year, recommended 5 years, and should not exceed 10 years. Endorsements SHOULD be reissued prior to expiry (may be for a new DET). DETs used to define this authorization are replaced per undetermined policy (note these DETs do very little signing, see section...). This separation of DET type roles reduce the risk of private key loss for the critical Authentication DETs by making them infrequently used. It does make the chain of trust for a HDA customers' Operational DETs to be 4 Endorsements. 2. Terms and Definitions 2.1. Requirements Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2.2. Definitions This document uses the terms defined in Section 2.2 of [RFC9153] and in Section 2 of [drip-architecture]. The following new terms are used in the document: DKI A DRIP Entity Tag (DET) public Key Infrastructure. 3. The DKI Levels Moskowitz & Card Expires 20 November 2023 [Page 4] Internet-Draft DRIP DKI May 2023 3.1. The Apex The Apex Authorization DET is used to endorse RAA Authorization DETs and its own Apex Endorsing DETs; it has no other use. This is the case for all Authorization DETs. Apex Endorsing DETs are used to endorse DETs, with HID= 0|0, used by Apex services. 3.2. The RAAs Each RAA use its Authorization DET (HID = RAA#|0) to endorse its RAA Endorsing DET(s) (also HID = RAA#|0) and for endorsing its HDA Authorization DETs (HID = RAA#|HDA#). An RAA may have multiple Endorsing DETs (HID = RAA#|0), each for a different use (e.g. CRL signing, RAA server signing). It is expected that, over time, an RAA will rollover its Endorsing DETs, thus at times there will be more than ONE Endorsing DET per role in use. 3.3. The HDAs Each HDA use its Authorization DET to endorse its HDA Endorsing DETs (e.g. RAA=267, HDA=567). An HDA Endorsing DET is used to endorse Operational DETs; those used by the HDA for its services (e.g. USS) and for Devices (e.g. UA, GCS, ground infrastructure) partaking in the HDA's services. 4. DNS view of DKI The primary view of the DKI is within DNS. There are two main DNS structures, one for DETs and one for DKI entities. In the DET DNS structure, only the Apex and RAA levels MUST be DNSSEC signed. The HDA level may be too dynamic for DNSSEC signing (e.g. hundreds of new EE Operational DETs per hour); trust in the EE Operational DETs within the HDA level comes through inclusion of the HDA Endorsement of EE object. A slow-churn HDA MAY use DNSSEC. The RAA and HDA levels MUST contain their Endorsement by higher object; this provides the needed trust in the Endorsement of EE objects. The Apex level Endorsement is self-signed, thus trust in it is only possible via DNSSEC. Other RR within these levels will vary. There may be HIP, TLSA, URI RR. Moskowitz & Card Expires 20 November 2023 [Page 5] Internet-Draft DRIP DKI May 2023 Each level needs FQDNs for its Authorization DET and Endorsing DET(s) (e.g. PTR to DETs?). FQDNs for services offered may also be present, or a URI for the commercial FQDN for the DKI Entity. TLSA RR of DET SPKI may be directly included here. Same with HIP RR. The Authorization Endorsement SHOULD be present, as SHOULD be Endorsing Endorsements. 5. The Offline cache of HDA Endorsements The Offline cache of HDA Endorsements, used to verify various EE signed objects without needing DNS access, SHOULD consist of the HDA Authentication DET Endorsements of the HDA Endorsement DETs. Thus the receiver has a trusted source of the HDA Endorsement DET Public Key (HI) in a DRIP standard object (136 bytes). If the DKI DNS tree includes GEO location data and coverage, a receiver could query some service for a trusted cache within some radius of its location. Such as, please tell me of all HDAs within 100KM of... This cache MAY contain the full chain up to the Apex. This could be helpful in limited connectivity environments when encountering an Endorsing HDA DET under a know Authenticated HDA or RAA. The needed trust chain could be shorter. 6. RAAs set aside for Testing The RAA range of 16376 - 16383 are reserved for testing. It test DET DNS structure under drip-testing.org will use these. RAAs 16376 - 16389 are preallocated in this test DNS with 16390 - 16383 available for testing setting up RAAs. Within RAAs 16376 - 16383, HDAs 16376 - 16383 will be preset for testing of Operational DETs. Other HDAs within RAAs 16376 - 16383 additional HDAs can be made available for testing of HDA setup and running said HDAs. It is anticipated that once a production DNS is established, these test RAAs and HDAs will carry forward. The migration could be as simple as the production Apex Endorsing the test RAA Authorization DETs and moving the various test DNS structures to the production structure. 7. The DKI's Shadow PKI TBD Moskowitz & Card Expires 20 November 2023 [Page 6] Internet-Draft DRIP DKI May 2023 In development is an X.509 PKI to shadow the DKI. The X.509 certificates are minimalistic (less than 400 bytes for DER). Any DRIP specific OIDs should come from the ICAO arc (e.g. 1.3.27.16.2). Important X.509 fields like issuerKeyIdentifier will have DETs rather than public key hashes, so software will need to specifically handle them. Distiguished Names will follow DET hierarchy and not map well into traditional PKI usage. This is a work in progress. 8. IANA Considerations TBD 9. Security Considerations TBD Needs description of risk to Authorization DET private keys for broad trees (e.g. lots of RAAs). 10. References 10.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . 10.2. Informative References [drip-architecture] Card, S. W., Wiethuechter, A., Moskowitz, R., Zhao, S., and A. Gurtov, "Drone Remote Identification Protocol (DRIP) Architecture", Work in Progress, Internet-Draft, draft-ietf-drip-arch-31, 6 March 2023, . Moskowitz & Card Expires 20 November 2023 [Page 7] Internet-Draft DRIP DKI May 2023 [drip-registries] Wiethuechter, A. and J. Reid, "DRIP Entity Tag (DET) Identity Management Architecture", Work in Progress, Internet-Draft, draft-ietf-drip-registries-09, 28 March 2023, . [drip_scripts] "Python scripts to generate DETs and Endorsements", April 2023, . [IPv6-SPECIAL] IANA, "IANA IPv6 Special-Purpose Address Registry", . [RFC9153] Card, S., Ed., Wiethuechter, A., Moskowitz, R., and A. Gurtov, "Drone Remote Identification Protocol (DRIP) Requirements and Terminology", RFC 9153, DOI 10.17487/RFC9153, February 2022, . [RFC9374] Moskowitz, R., Card, S., Wiethuechter, A., and A. Gurtov, "DRIP Entity Tag (DET) for Unmanned Aircraft System Remote ID (UAS RID)", RFC 9374, DOI 10.17487/RFC9374, March 2023, . Appendix A. Test DETs and Endorsements The following are test DETs and Endorsements for the test DKI. This testing environment is open to all. There are 4 RAAs available for others to build out. HDAs under the 4 pre-set RAAs, or under any of the 4, built out be others, are available. Finally the test HDAs are available for setting up a handful of entities. Any tester wanting more than a few DETs for entities should plan on doing that under their own HDA. The following are the test values and objects. They were generated using the det-gen.py and endorse.py scripts available at [drip_scripts]. Apex Authorizing DET (HID=0|0) DET: 20010030000000052aeb9adc1ce8b1ec DET: 2001:0030:0000:0005:2aeb:9adc:1ce8:b1ec Raw HI: d60268e6cf64ad693e5bb055d7c6e48c 7ed07013609e6ed02bb935b3d6acf53e vnb="05/01/2023" Moskowitz & Card Expires 20 November 2023 [Page 8] Internet-Draft DRIP DKI May 2023 vna="06/01/2024" DETofP=0x20010030000000052aeb9adc1ce8b1ec Endorsement(136 bytes): 644f3940665a9cc020010030000000052a eb9adc1ce8b1ecd60268e6cf64ad693e5bb055d7c6e48c7ed07013 609e6ed02bb935b3d6acf53e20010030000000052aeb9adc1ce8b1 ec17008ad1bc982c6cd8c955b1ef621ef80ee5c269aa3dbcfd34b5 85162b19d39dad7d7ba78aeb0e84bc4dd8efc2246dd30834b1e5d0 d220e7815af921a560fc0d rra16376 Authorizing DET (HID=16376|0) DET: 2001003ffe000005f970a4d7fd0e14a5 DET: 2001:003f:fe00:0005:f970:a4d7:fd0e:14a5 Raw HI: df7e64cc1bfdcb65835437b37b6110d5 6fedb81443f58d53df8094e0e2828d23 vnb="05/07/2023" vna="05/21/2024" DETofP=0x20010030000000052aeb9adc1ce8b1ec Endorsement(136 bytes): 64572240664c1c402001003ffe000005f9 70a4d7fd0e14a5df7e64cc1bfdcb65835437b37b6110d56fedb814 43f58d53df8094e0e2828d2320010030000000052aeb9adc1ce8b1 ecea2cdf1933fb93842cb2c4e849fda3637493c9eedbfe08178fd5 c7293c1b46acbd9a6c0c740a297ffda903b53bb34e8779ee8397d4 9e6216b51ac7e87161200c Endorsing DET (HID=16376|0) DET: 2001003ffe000005191f150daf98f382 DET: 2001:003f:fe00:0005:191f:150d:af98:f382 Raw HI: b81b0180631ce60c14d14ab80a69c214 7305836bf80b3b10284d36bae750265c vnb="05/07/2023" vna="05/21/2024" DETofP=0x20010030003ff805d80a0a62d3062894 Endorsement(136 bytes): 64572240664c1c402001003ffe00000519 1f150daf98f382b81b0180631ce60c14d14ab80a69c2147305836b f80b3b10284d36bae750265c20010030003ff805d80a0a62d30628 94c1d2d6c8e0165da6318a8130a6eb5149830c9717bbad98be4fde abec31195df9d6c41319d477cafcebf19efaa2694abc05f4460cbb aedfee617fb44646523807 hda16376-16376 Authorizing DET (HID=16376|16376) DET: 2001003ffe3ff805e805a98f9df15e2d DET: 2001:003f:fe3f:f805:e805:a98f:9df1:5e2d Raw HI: b82b27f86b013468fe48d85b54f01bf6 5385f302ab2e136dc51a3b929c88ce5a vnb="05/14/2023" vna="05/14/2024" Moskowitz & Card Expires 20 November 2023 [Page 9] Internet-Draft DRIP DKI May 2023 DETofP=0x2001003ffe000005f970a4d7fd0e14a5 Endorsement(136 bytes): 64605cc06642e1c02001003ffe000005a1 43e69785df6f61e8f6d91f7d5351485471420a9c7d5df180c7a31d b86cc937581ee8106f18e4eb2001003ffe000005f970a4d7fd0e14 a5a791e3e1f8fe3fcc4848232df472cb4f796a1b836b918b55d69e fac9a8d35d0fda184b5915e467969a8c6352f1e8ff65a0e8d42c2c 08f1b22f800b1288512904 Endorsing DET (HID=16376|16376) DET: 2001003ffe3ff8059b0e2860eb0bacde DET: 2001:003f:fe3f:f805:9b0e:2860:eb0b:acde Raw HI: 65f26bc01b89398f787c4785e4e7f6e0 1f2993137759995d7baa72791a44ac5d vnb="05/14/2023" vna="05/14/2024" DETofP=0x2001003ffe3ff805e805a98f9df15e2d Endorsement(136 bytes): 64605cc06642e1c02001003ffe3ff8059b 0e2860eb0bacde65f26bc01b89398f787c4785e4e7f6e01f299313 7759995d7baa72791a44ac5d2001003ffe3ff805e805a98f9df15e 2d72e53262d8b49452bfd6324daf2193fce47bbbce37bce0391542 bde64a156ab0942fa1ad340ecabf1e49eecf3818b25322955ef71d ffc7b786c5c48a6a84c003 UA DET in 16376.16376 DET: 2001003ffe3ff805a93e53b72709e0ba DET: 2001:003f:fe3f:f805:a93e:53b7:2709:e0ba Raw HI: bf0453a01120ed8e651ae9f6951a8278 3da820296a338effd54a0ba846a99875 vnb="05/14/2023" vna="05/21/2023" DETofP=0x2001003ffe3ff8059b0e2860eb0bacde Endorsement(136 bytes): 64605cc0646997402001003ffe3ff805a9 3e53b72709e0babf0453a01120ed8e651ae9f6951a82783da82029 6a338effd54a0ba846a998752001003ffe3ff8059b0e2860eb0bac de903ad90789c07f948737280159a071449caed275c91cb73d782d 904a20492d12e27eb0f40c6098e70c5e5e382a3b43d9cac4994b4a e82758665d62346fd80d00 Figure 2: Test DKI values Moskowitz & Card Expires 20 November 2023 [Page 10] Internet-Draft DRIP DKI May 2023 A.1. Test DNS The DNS tree(s) for the above test data is still in limbo and will be added in a later version of this draft. But some of the RR for these DETs are available below (note that some HIP RR were generated with an earlier version of det-gen.py that used the old TYPE55 RR; this will be corrected in a later update): Apex Authorizing DET (HID=0|0) IN TLSA 3 1 0 ( 302a300506032b6570032100d60268e6cf64ad693e5b b055d7c6e48c7ed07013609e6ed02bb935b3d6acf53e ) IN TYPE55 \# 152 (1005002020010030000000052aeb9adc1ce8b1ecd6 0268e6cf64ad693e5bb055d7c6e48c7ed07013609e6ed02bb935b3d6 acf53e) IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRPOUBmWpzAIAEAMAAAAAUq65 rcHOix7NYCaObPZK1pPluwVdfG5Ix+0HATYJ5u0Cu5NbPWrPU+IAEAM AAAAAUq65rcHOix7BcAitG8mCxs2MlVse9iHvgO5cJpqj28/TS1hR YrGdOdrX17p4rrDoS8TdjvwiRt0wg0seXQ0iDngVr5IaVg/A0= ) rra16376 Authorizing DET (HID=16376|0) IN TLSA 3 1 0 ( 302a300506032b6570032100efcd5ca4427d87d9642c 76ebf48776df567cf2a9e5e513cb50b966ce54162fa0 ) IN IN HIP ( 5 2001003ffe000005f970a4d7fd0e14a5 335kzBv9y2WDVDeze2EQ1W/tuBRD9Y1T34CU4OKCjSM= ) IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRXIkBmTBxAIAEAP/4AAAX5cK TX/Q4Upd9+ZMwb/ctlg1Q3s3thENVv7bgUQ/WNU9+AlODigo0jIAEAM AAAAAUq65rcHOix7Oos3xkz+5OELLLE6En9o2N0k8nu2/4IF4/Vxy k8G0asvZpsDHQKKX/9qQO1O7NOh3nug5fUnmIWtRrH6HFhIAw= ) Endorsing DET (HID=16376|0) IN TLSA 3 1 0 ( 302a300506032b6570032100b81b0180631ce60c14d1 4ab80a69c2147305836bf80b3b10284d36bae750265c ) IN TYPE55 \# 152 (100500202001003ffe000005191f150daf98f382b8 1b0180631ce60c14d14ab80a69c2147305836bf80b3b10284d36b ae750265c ) IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRXIkBmTBxAIAEAP/4AAAUZHx UNr5jzgrgbAYBjHOYMFNFKuAppwhRzBYNr+As7EChNNrrnUCZcIAEAM AA/+AXYCgpi0wYolMHS1sjgFl2mMYqBMKbrUUmDDJcXu62Yvk/eq+ wxGV351sQTGdR3yvzr8Z76omlKvAX0Rgy7rt/uYX+0RkZSOAc= ) hda16376-16376 Authorizing DET (HID=16376|16376) IN TLSA 3 1 0 ( 302a300506032b6570032100b82b27f86b013468fe48 d85b54f01bf65385f302ab2e136dc51a3b929c88ce5a ) IN HIP ( 5 2001003ffe3ff805e805a98f9df15e2d uCsn+GsBNGj+SNhbVPAb9lOF8wKrLhNtxRo7kpyIzlo= ) Moskowitz & Card Expires 20 November 2023 [Page 11] Internet-Draft DRIP DKI May 2023 IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRgXMBmQuHAIAEAP/4/+AXoBa mPnfFeLbgrJ/hrATRo/kjYW1TwG/ZThfMCqy4TbcUaO5KciM5aIA EAP/4AAAX5cKTX/Q4UpYcZ8SaHQTV9yscZCjN/KwqfqJXc/h3M4R Hz366TSNShUany3nQG3bF+FR1vRQqOEbXIYdTID/PcgZaUiGezJw w= ) Endorsing DET (HID=16376|16376) IN TLSA 3 1 0 ( 302a300506032b657003210065f26bc01b89398f787c 4785e4e7f6e01f2993137759995d7baa72791a44ac5d ) IN TYPE55 \# 152 ( 100500202001003ffe3ff8059b0e2860eb0bacde6 5f26bc01b89398f787c4785e4e7f6e01f2993137759995d7baa7 2791a44ac5d ) IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRgXMBmQuHAIAEAP/4/+AWbDi hg6wus3mXya8AbiTmPeHxHheTn9uAfKZMTd1mZXXuqcnkaRKxdIA EAP/4/+AXoBamPnfFeLXLlMmLYtJRSv9YyTa8hk/zke7vON7zgOR VCveZKFWqwlC+hrTQOyr8eSe7POBiyUyKVXvcd/8e3hsXEimqEwA M= ) UA DET in 16376.16376 IN TLSA 3 1 0 ( 302a300506032b6570032100bf0453a01120ed8e651a e9f6951a82783da820296a338effd54a0ba846a99875 ) IN HIP ( 5 2001003ffe3ff805a93e53b72709e0ba vwRToBEg7Y5lGun2lRqCeD2oIClqM47/1UoLqEapmHU= ) IN CERT 254 0 0 ( DAYKKwYBBAG0OwIGBmRgXMBkaZdAIAEAP/4/+AWpPl O3Jwngur8EU6ARIO2OZRrp9pUagng9qCApajOO/9VKC6hGqZh1IA EAP/4/+AWbDihg6wus3pA62QeJwH+UhzcoAVmgcUScrtJ1yRy3PX gtkEogSS0S4n6w9AxgmOcMXl44KjtD2crEmUtK6CdYZl1iNG/YDQ A= ) Figure 3: Test DNS Records A.2. Test X.509 Certificates Under development for next version. Acknowledgments TBD Authors' Addresses Robert Moskowitz HTT Consulting Oak Park, MI 48237 United States of America Email: rgm@labs.htt-consult.com Moskowitz & Card Expires 20 November 2023 [Page 12] Internet-Draft DRIP DKI May 2023 Stuart W. Card AX Enterprize, LLC 4947 Commercial Drive Yorkville, NY 13495 United States of America Email: stu.card@axenterprize.com Moskowitz & Card Expires 20 November 2023 [Page 13]