XRI and XRDS Key Building Blocks of the

XRI and XRDS: Key Building Blocks of the Internet Identity Layer n n OASIS Webinar, May 6, 2008 Gabe Wachob, XRI TC Co-Chair Drummond Reed, XRI TC Co-Chair

OASIS XRI Technical Committee Started January 2003

Topics n n What are XRI and XRDS? Why have they become key building blocks of the Internet identity layer? What synergy do they have with other OASIS TCs and specifications? OASIS Standard vote on XRI 2. 0

What are XRI and XRDS?

n n XRI and XRDS have become essential elements of the Higgins Project. Without them, we couldn’t fully implement the abstract data model that is the heart of Higgins and the key to user-controlled identity and data sharing. -- Paul Trevithick Higgins Project Lead

What is XRI (Extensible Resource Identifier)? n n A new type of Internet identifier (URI) designed expressly for digital identity An open standard language for abstract structured identifiers l l Abstract: identifiers that resolve to other identifiers Structured: identifiers containing selfdescribing “tags” – “XML for identifiers”

What is XRDS (Extensible Resource Descriptor Sequence)? n n n A simple, extensible XML document format for service discovery for any XRIor URL-identifiable resource The logical equivalent of a DNS resource record at the XRI layer of identification The discovery format adopted for Open. ID 2. 0, OAuth, and Higgins

Synonyms XRI Layer Reassignable “i-name(s)” Persistent “i-number” XRDS Document Concrete Identifier Layer Domain Name IP Address Local Path/Query URI/IRI XRDS Resolution TN (Telephone Number) Other concrete identifier types

Examples of XRI i-names n Human-friendly reassignable identifiers =gmw =drummond. reed @boeing @cordance*drummond +flower $xml

Examples of XRI i-numbers n Persistent identifiers (never reassigned) =!7 a 42. cd 93. 40 f 4. 18 e 5 @!b 3 a 7. 5537. 9 fea. 31 ec!133 +!3792!14

Examples of XRI cross-references n Identifiers reused across contexts =(mailto: gabe. wachob@gmail. com) =(http: //equalsdrummond. name) @(http: //boeing. com) @cordance*(mailto: dreed@xdi. org) +flower*(http: //en. wikipedia. org/rose)

Examples of XRIs transformed into URIs n XRI Syntax 2. 0 defines a strict transformation of an XRI into an IRI and URI xri: //=drummond. reed xri: //@!b 3 a 7. 5537. 9 fea. 31 ec!133 xri: //=(mailto: gabe. wachob@gmail. com) xri: //@cordance*(mailto: dreed@xdi. org)

Example XRDS document Query and synonyms Service #1 Service #2 <XRDS xmlns=“xri: //xrds”> <XRD xmlns=“xri: //xrd*($v*2. 0)”> <Query>*example</Query> <Expires>2005 -05 -30 T 09: 30: 10 Z</Expires> <Provider. ID>xri: //=</Provider. ID> <Canonical. ID>xri: //=!7 c 4. 58 ff. 7 c 9 a. e 285</Canonical. ID> <Service priority=“ 10”> <Type>xri: //$res*auth*($v*2. 0)</Type> <URI>http: //res. example. com/=!7 c 4. 58 ff. 7 c 9 a. e 285/</URI> </Service> <Service priority=“ 10”> <Type>http: //openid. net/openid/1. 1</Type> <Type>http: //openid. net/openid/2. 0</Type> <Path>+openid <URI>http: //authn. example. com/openid/</URI> </Service> </XRDS>

XRI, XRDS, and the emerging Internet identity layer

Where are XRI and XRDS being used? n n n Open. ID 2. 0 OAuth Discovery Higgins Project XDI. org i-name/i-number registries XDI data sharing

Case Study: the top 3 problems XRI/XRDS solved for Open. ID 2. 0 n n n Extensible service discovery Open. ID recycling Automatic secure resolution

What is Open. ID? n An open community specification for user-centric Internet authentication l n Based on the concept that users have their own globally-resolvable identifier and Open. ID authentication service Primary use case: eliminate the need for separate usernames and passwords for different websites

Relying Party (RP) XRDS Document Open. ID Provider (OP)

Problem #1: Extensible service discovery n n Describe what versions of Open. ID an Open. ID identifier supports Describe what Open. ID extensions it supports (SREG, AX, PAPE, etc. ) Describe what other services may be available (e. g. , OAuth, SAML, XDI) Enable redundant, prioritized Open. ID provider endpoints

Solution: XRDS documents n n Simple, standard discovery format Can be hosted on any blog, web server, Id. M system, etc. Easily extensible using new URIs or XRIs to define service types Can be extended with elements from any other namespace

<XRDS xmlns=“xri: //xrds”> <XRD xmlns=“xri: //xrd*($v*2. 0)”> <Query>*example</Query> <Expires>2005 -05 -30 T 09: 30: 10 Z</Expires> <Provider. ID>xri: //=</Provider. ID> <Canonical. ID>xri: //=!7 c 4. 58 ff. 7 c 9 a. e 285</Canonical. ID> <Service> <Type>xri: //$res*auth*($v*2. 0)</Type> <URI>http: //res. example. com/=! 7 c 4. 58 ff. 7 c 9 a. e 285/</URI> </Service> <Type>http: //openid. net/openid/1. 1</Type> <Type>http: //openid. net/openid/2. 0</Type> <Path>+openid</Path> <URI>http: //authn. example. com/openid/</URI> <URI>https: //secure-authn. example. com/openid/</URI> <openid: delegate>http: //example. com/bob</openid: delegate> </Service> </XRDS>

Problem #2: Open. ID recycling n With usernames/passwords, usernames can be recycled l n The service provider controls the binding with the credential With Open. ID, that’s no longer true l l The user controls the binding to the credential Losing control of the identifier = losing control of the credential

Solution: persistent synonyms n n n Bind a recyclable Open. ID identifier with a non-recyclable (persistent) identifier – an XRI i-number Authenticate based on the persistent i-number Treat the recyclable identifier as only a temporary handle for the persistent synonym

<XRDS xmlns=“xri: //xrds”> <XRD xmlns=“xri: //xrd*($v*2. 0)”> <Query>*example</Query> <Expires>2005 -05 -30 T 09: 30: 10 Z</Expires> <Provider. ID>xri: //=</Provider. ID> <Canonical. ID>xri: //=!7 c 4. 58 ff. 7 c 9 a. e 285</Canonical. ID> <Service> <Type>xri: //$res*auth*($v*2. 0)</Type> <URI>http: //res. example. com/=!1234. 5678. a 1 b 2. c 3 d 4/</URI> </Service> <Type>http: //openid. net/openid/1. 1</Type> <Type>http: //openid. net/openid/2. 0</Type> <Path>+openid <URI>http: //authn. example. com/openid/</URI> </Service> </XRDS>

Problem #3: Automatic secure resolution n Open. ID could not specify HTTPS resolution for all Open. ID URLs l l l Too many users do not have access to HTTPS certs or infrastructure Thus the default had to be HTTP This forces users with HTTPS URLs to have to type the entire string, e. g. , https: //my. openid. identifier. tld

Solution: XRI secure resolution n n As abstract identifiers, XRIs always map to concrete identifiers This mapping process - XRI resolution offers three trusted modes: l n HTTPS, SAML, or both Thus all XRI i-names can use HTTPS resolution as the default l No need for users to know/do anything

XRI and XRDS are also building blocks for other identity solutions n OAuth l n Higgins Project l n Context discovery and resolution XDI. org XRI registries l n XRDS discovery format i-name/i-number registries & resolution SAML and Information Cards l Privacy-protected identifier claims

Synergy with Other OASIS TCs

XDI (XRI Data Interchange) n The XDI controlled data sharing protocol is based entirely on XRI l A globally addressable RDF graph where the address of every node is an RDF statement structured as an XRI subject-xri / predicate-xri / object-xri l Enables a simple portable authorization format called XDI link contracts

ORMS (Open Reputation Management Services) n n n New OASIS TC in the IDtrust member section Will define neutral, vendor-independent system for exchanging reputation data XRI and XDI TC members participating l l XRI for durable subject identifiers XDI for controlled data sharing

Other TCs in the IDtrust Member Section n Digital Signature Services e. Xtended (DSS-X) Advancing new profiles for the DSS OASIS Standard Enterprise Key Management Infrastructure (EKMI) Defining symmetric key management protocols Public Key Infrastructure (PKI) Adoption Advancing the use of digital certificates as a foundation for managing access to network resources and conducting electronic transactions

The OASIS Standard Vote on XRI 2. 0

Specifications n XRI Syntax 2. 0 l l l Explicit syntax for reassignable and persistent identifiers Global context symbols Cross-references for identifier reuse across domains Flexible delegation at all levels of hierarchy Lossless transformation into IRI and URI forms n XRI Resolution 2. 0 l l l HTTP(S)-based resolution protocol XRDS simple XML discovery document format Synonym management and verification Service endpoint selection logic Redirect and Ref processing

Conclusion n n Five years and several thousand man hours has gone into XRI and XRDS That’s what it takes to create a solid foundation for the Internet identity layer Open. ID, OAuth, Higgins, i-names, XDI are still just the start Please support this effort with your OASIS Standard vote on XRI 2. 0

Contact us n Drummond Reed, XRI TC Co-Chair l l n Gabe Wachob, XRI TC Co-Chair l l n http: //xri. net/=drummond. reed@cordance. net http: //xri. net/=gmw gabe. wachob@wachob. com Wikipedia l l http: //en. wikipedia. org/xri http: //en. wikipedia. org/xrds

n n n Learn through the IDtrust Knowledgebase of educational materials and background on the standards Share news, events, presentations, white papers, product listings, opinions, questions, and recommendations through postings, blogs, forums, and directories. Collaborate with others online through a wiki interface http: //idtrust. xml. org