See Permission enum below for details.

Spec: Specifies the record's administrator. It consists of the administrator's identifier and element index (as defined above), encoded as a 4-byte length followed by that many UTF-8 encoded bytes, followed by a 4-byte unsigned integer for the index of the element that is referenced in the administrator's identifier record. The referred element in the administrator's identifier record must either be an identity authentication element (such as an HS_PUBKEY or HS_SECKEY element) or an HS_VLIST element, which specifies a group of administrators consisting of a list of one or more administrator identification and authentication elements references. (See HS_VLIST paragraph below for more description as well as HS_VLIST in section 4.2.8 for its detailed specification). An index value of 0 implies that the reference is to all elements in the administrator's identifier record; this means all HS_SECKEY or HS_PUBKEY elements in that record can be used.

a UTF8-string that describes the key type, see Type for details

a two-byte option field reserved for future use

a key-type-dependent number of byte-arrays that contains the public key itself.

An identifier whose record contains the HS_SITE elements defining the DO-IRP service.

Spec: The is an octet (as a bit mask) that specifies whether the interface is for administration (0x01), resolution (0x02), or both (0x03).

Spec: The is also an octet (as a bit mask) that specifies the protocol. Possible protocols include UDP (0x00), TCP (0x01), HTTP (0x02), and HTTPS (0x03). The following are additional protocols not in the spec: gRPC (0x04)

Spec: The is a 4-byte unsigned integer that specifies the port number used by the interface.The conventional port number used by DO-IRP servers is 2641 for UDP and TCP, and 8000 for HTTP.

Spec: A 4-byte unsigned integer that uniquely identifies a server process under the service site. s do not have to begin with 1 and they don't have to be consecutive numbers. They are used to distinguish servers under a service site from each other. Note that there can be multiple servers residing on any given computer, each with a different .

represented as text here for convenience

Spec: A 4-byte integer followed by a byte-array that contains the server's public key (server authentication key). The integer specifies the size of the byte-array. For key types described in this specification, the byte-array (for the public key) consists of a number of parts: a UTF8-string that describes the key type, a two-byte option field reserved for future use, and a key-type-dependent number of length-prefixed byte-arrays that describe the public key itself. The key types in current use are "DSA_PUB_KEY," where there are four byte-arrays after the two-byte option field for the four DSA parameters q, p, g, and y; and "RSA_PUB_KEY", where after the two-byte option field are two byte- arrays for the exponent and modulus, followed by an empty byte-array (four zero bytes). Other key types may be useful to consider in the future.

The public key in the can be used to authenticate any service response from the DO-IRP server.

service interface provided by the server

current version number: 1

Spec: A 2-byte integer value that identifies the highest DO-IRP protocol version understood by servers of the site. The higher byte of the value identifies the major version and the lower byte the minor version. Details of the message format for DO-IRP protocol version 3.0 are specified in section 6.2. Although the terminology used is the same, this field does not denote the protocol version of this DO-IRP specification. Rather, it denotes the protocol version as specified by the prefix administrator for the implementation of the local service that supports the identifier record. Local services which support the DO-IRP protocol version 3.0 specified in this document should be described with HS_SITE elements specifying 3.0.

This should be automatically increased on the IRS service side

Spec: An 8-bit mask that identifies the primary site(s) of the DO-IRP service. The first bit of the octet is the bit. It indicates whether the HS_SITE element is a primary site. A primary site is the one that supports administrative operations for its identifiers. The second bit of the octet is the bit. It indicates whether the service has multiple primary sites. A entry with zero value indicates that the service has a single primary site and all administration has to be done at that site. A non-zero entry indicates that the service has multiple primary sites. Each primary site may be used to administer identifiers managed under the service.

hash option used by the service site to distribute identifiers among its multiple servers; not meaningful for a typical service site with a single server.

Spec: An UTF8-string entry reserved for future use.

represented as map from to here for convenience

a list of s each defines a server that is part of the service

Spec: Add_Identifier (0x0001) This permission, when set in a prefix identifier record, allows an authenticated administrator to create new identifiers under that prefix. This permission is only meaningful when set in an identifier record pertaining to a prefix, as it is a prefix-only permission.

Spec: Delete_Identifier (0x0002) This permission allows an authenticated administrator to delete the identifier record.

Spec: Add_Derived_Prefix (0x0004) This permission, when set in a prefix identifier record, allows an authenticated administrator to create new prefixes derived from the stated prefix identifier. This permission is only meaningful when set in a prefix identifier record and it is a prefix-only permission.

Spec: Reserved (0x0008) This bit is reserved for historical reasons.

Spec: Modify_Element (0x0010) This permission allows an authenticated administrator to modify any elements other than HS_ADMIN elements. HS_ADMIN elements are used to define administrators and are managed by a different set of permissions (as described next).

Spec: Delete_Element (0x0020) This permission allows an authenticated administrator to delete any element other than the HS_ADMIN elements.

Spec: Add_Element (0x0040) This permission allows an authenticated administrator to add elements other than the HS_ADMIN elements.

Spec: Modify_Admin (0x0080) This permission allows an authenticated administrator to modify HS_ADMIN elements.

Spec: Remove_Admin (0x0100) This permission allows an authenticated administrator to remove HS_ADMIN elements.

Spec: Add_Admin (0x0200) This permission allows an authenticated administrator to add new HS_ADMIN elements.

Spec: Authorized_Read (0x0400) This permission grants an authenticated administrator read-access to elements with the ADMIN_READ and without PUBLIC_READ permission. Administrators without this permission will not have access to elements that require authentication for read access.

Spec: List_Identifiers (0x0800) This permission allows an authenticated administrator to list all identifiers under a designated prefix, even if such identifiers are managed in a distributed fashion on multiple servers. Identifiers that are based on prefixes derived from the specified prefix are not included in the listing. This is a prefix-wide setting and must be set on the respective prefix identifier record.

Spec: List_Derived_Prefixes (0x1000) This permission allows the administrator to list all prefixes derived from a designated prefix. If such derived prefixes have in turn their own derived prefixes, those further derivatives are also included in the listing as long as such derived prefix records are on the same DO-IRP service on which this listing operation is performed. This is a prefix-wide setting and must be set on a prefix identifier record.