Title: kz-law-ext EPP extension
Status: draft
Version: 2.0.1
Release date: 2026.06.03
Owner: KazNIC Organization

1. Introduction

   This document describes an extension to the EPP domain mapping protocol, designed for the KazNIC Registry. The extension provides a 
mechanism for registrars to submit supplementary information required for legal compliance within the .KZ and .xn--80ao21a TLDs.
The extension introduces two primary functional components:

    Registration Purpose: Enables registrars to specify the intended use of a domain name, as mandated by the "Rules of Registration, 
    Support, and Use of Domain Names" in the Kazakhstan segment of the Internet.

    Digital Signatures block: Provides a structure for transmitting a detached cryptographic signatures data (CMS BLOB). This ensures the integrity
    and non-repudiation of the registrant's identity data by binding it to a specific domain state using a pre-defined algorithm (docSpecAlg).

By using this extension, registrars can fulfill legal verification requirements during the domain lifecycle, specifically during the 
initial registration window and subsequent data modifications.

2. EPP <greeting> Server Response

Response frames for <greeting> server response returned to a client by the KazNIC EPP server contains definition of the server supported 
extension "kz-law-ext" in the <kz-law-ext> element.


<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 epp-1.0.xsd">
  <greeting>
    <svID>KZ Registry EPP server</svID>
    <svDate>2011-01-05T07:44:50.014Z</svDate>
    <svcMenu>
      <version>1.0</version>
      <lang>en</lang>
      <objURI>urn:ietf:params:xml:ns:domain-1.0</objURI>
      <objURI>urn:ietf:params:xml:ns:contact-1.0</objURI>
      <objURI>urn:ietf:params:xml:ns:host-1.0</objURI>
      <svcExtension>
        ...
	<extURI>urn:kaznic:params:xml:ns:kz-law-ext-2.0</extURI>
        <extURI>http://www.nic.kz/kz-law-ext-2.0</extURI>
      </svcExtension>
    </svcMenu>
  </greeting>
</epp>


3. EPP <info> Command

Example <info> request frame with a <kz-law-ext:kz-law-ext:info> element:
Specify the <kz-law-ext:digitalSignature/> element within the <kz-law-ext:kz-law-ext:info> element to retrieve this data from the server.

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
     epp-1.0.xsd">
  <command>
    <info>
      <domain:info
       xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
       xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
       domain-1.0.xsd">
        <domain:name hosts="all">example.com</domain:name>
      </domain:info>
    </info>
    <clTRID>ABC-12345</clTRID>
  </command>
</epp>

Response frames for <info> commands for domain names returned to a client by an EPP server that supports this extension MAY have an additional <kz-law-ext:infData> 
element in the <extension> element. The <kz-law-ext:infData> MAY contain a <kz-law-ext:registration-purpose> element containing domain name registration purpose description.
The <kz-law-ext:infData> MAY contain a <kz-law-ext:digitalSignature> element containing domain digital signature data. The <kz-law-ext:digitalSignature> MUST contain 
<kz-law-ext:signatureHash> element, reprsenting SHA-256 hash of diginal signature bytes(base64 format).

Example <info> response frame with a <kz-law-ext:infData> element:


S:  <?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:  <epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
S:    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
S:    xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 epp-1.0.xsd">
S:    <response>
S:      <result code="1000">
S:        <msg>Command completed successfully.</msg>
S:      </result>
S:      <resData>
S:        <domain:infData
S:          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
S:          xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
S:          domain-1.0.xsd">
S:          <domain:name>domain.kz</domain:name>
S:          <domain:roid>CNIC-DO302520</domain:roid>
S:          <domain:status r="ok"/>
S:          <domain:registrant>CONTACT-HANDLE</domain:registrant>
S:          <domain:contact type="tech">CONTACT-HANDLE</domain:contact>
S:          <domain:clID>C11480</domain:clID>
S:          <domain:ns>
S:            <domain:hostObj>ns1.domain.kz</domain:hostObj>
S:            <domain:hostObj>ns2.domain.kz</domain:hostObj>
S:          </domain:ns>
S:          <domain:crDate>1995-01-01T00:00:00.0Z</domain:crDate>
S:          <domain:exDate>2020-01-01T23:59:59.0Z</domain:exDate>
S:          <domain:upDate>2005-05-14T11:15:19.0Z</domain:upDate>
S:        </domain:infData>
S:      </resData>
S:      <extension>
S:	  <kz-law-ext:infData xmlns:kz-law-ext="urn:kaznic:params:xml:ns:kz-law-ext-2.0">
S:	    <kz-law-ext:registration-purpose>Purpose description</kz-law-ext:registration-purpose>
S:          <kz-law-ext:digitalSignatures>    
S:            <kz-law-ext:digitalSignature actionType="REGISTRANT-IDENTITY-VERIFICATION">
S:              <kz-law-ext:signatureHash docSpecAlg="DOC-SPEC-REGISTRANT-IDENTITY-CONFIRMATION-V1" signerRole="CURRENT_REGISTRANT">
S:                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
S:              </kz-law-ext:signatureHash>
S:            </kz-law-ext:digitalSignature>
S:            .....           
S:          </kz-law-ext:digitalSignatures>
S:	  </kz-law-ext:infData>
S:      </extension>
S:      <trID>
S:        <clTRID>ABC-12345</clTRID>
S:        <svTRID>CNIC-F29KDFTOEJW4OSKGC00008SKOG8SOO0</svTRID>
S:      </trID>
S:    </response>
S:  </epp>

4. EPP <create> Command

Request frames for <create> commands for domain names sent to an EPP server that supports this extension MAY have 
an additional <kz-law-ext:create> element in the <extension> element. The <kz-law-ext:create> MAY contain a <kz-law-ext:registration-purpose> element 
containing domain name registration purpose description.

Example <create> request frame with a <kz-law-ext:create> element:


<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0 
  epp-1.0.xsd">
   <command>
     <create>
       <domain:create
         xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
         xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
         domain-1.0.xsd">
         <domain:name>domain.kz</domain:name>
         <domain:registrant>CONTACT-HANDLE</domain:registrant>
         <domain:contact type="admin">CONTACT-HANDLE</domain:contact>
         <domain:contact type="tech">CONTACT-HANDLE</domain:contact>
         <domain:authInfo>
           <domain:pw>2fooBAR</domain:pw>
         </domain:authInfo>
       </domain:create>
     </create>
     <clTRID>ABC-12345</clTRID>
     <extension>      
	<kz-law-ext:create xmlns:kz-law-ext="urn:kaznic:params:xml:ns:kz-law-ext-2.0">
	    <kz-law-ext:registration-purpose>Purpose description</kz-law-ext:registration-purpose>
	</kz-law-ext:create>
     </extension>
   </command>
</epp>

5. EPP <update> Command

Request frames for <update> commands for domain names sent to an EPP server that supports this extension MAY have an 
additional <kz-law-ext:update> element in the <extension> element. The <kz-law-ext:create> MAY contain a <kz-law-ext:registration-purpose> element 
containing domain name registration purpose description. The <kz-law-ext:infData> MAY contain a <kz-law-ext:digitalSignature> element containing 
domain digital signature data. The <kz-law-ext:digitalSignature> MUST contain <kz-law-ext:signatureValue> element, reprsenting diginal signature 
bytes(base64 format).

Example <update> request frame with a <kz-law-ext:update> element:
               
                          
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="urn:ietf:params:xml:ns:epp-1.0
  epp-1.0.xsd">
  <command>
    <update>
      <domain:update
      xmlns:domain="urn:ietf:params:xml:ns:domain-1.0"
      xsi:schemaLocation="urn:ietf:params:xml:ns:domain-1.0
      domain-1.0.xsd">
        <domain:name>domain.kz</domain:name>
      </domain:update>
    </update>
    <clTRID>ABC-12345</clTRID>
    <extension>
      <kz-law-ext:update xmlns:kz-law-ext="urn:kaznic:params:xml:ns:kz-law-ext-2.0"
       xsi:schemaLocation="urn:kaznic:params:xml:ns:kz-law-ext-2.0
       kz-law-ext-2.0.xsd">
	 <kz-law-ext:registration-purpose>Purpose description</kz-law-ext:registration-purpose>
         <kz-law-ext:digitalSignatures>                   
           <kz-law-ext:digitalSignature actionType="REGISTRANT-IDENTITY-VERIFICATION">
             <kz-law-ext:signatureValue docSpecAlg="DOC-SPEC-REGISTRANT-IDENTITY-CONFIRMATION-V1" signerRole="CURRENT_REGISTRANT">
               MIIHbgYJKoZIhvcNAQcCoIIHXzCCHbcCAQExADALBgkqhkiG9w0BBwGggh2TMIID...
             </kz-law-ext:signatureValue>
           </kz-law-ext:digitalSignature>           
           .....           
        </kz-law-ext:digitalSignatures>
      </kz-law-ext:update>  
    </extension>
  </command>
</epp>


6. Formal Specification


<?xml version="1.0" encoding="UTF-8"?>
<schema targetNamespace="urn:kaznic:params:xml:ns:kz-law-ext-2.0"
        xmlns:kz-law-ext="urn:kaznic:params:xml:ns:kz-law-ext-2.0"
        xmlns="http://w3.org"
        elementFormDefault="qualified">

  <element name="create" type="kz-law-ext:createType"/>
 
  <complexType name="createType">
    <sequence>
      <element name="registration-purpose" type="string" minOccurs="0"/>
    </sequence>
  </complexType>

  <element name="update" type="kz-law-ext:updateType"/>

  <complexType name="updateType">
    <sequence>
      <element name="registration-purpose" type="string" minOccurs="0"/>
      <element name="digitalSignatures" type="kz-law-ext:digitalSignaturesUpdateType"/>
    </sequence>
  </complexType>

  <complexType name="digitalSignaturesUpdateType">
    <sequence>
      <element name="digitalSignature" type="kz-law-ext:digitalSignatureUpdateType" maxOccurs="unbounded"/>
    </sequence>
  </complexType>

  <complexType name="digitalSignatureUpdateType">
    <sequence>
      <element name="signatureValue" type="kz-law-ext:signatureValueType"/>
    </sequence>
    <attribute name="actionType" type="kz-law-ext:signatureActionTypeEnum" use="required"/>
  </complexType>

  <complexType name="signatureValueType">
    <simpleContent>
      <extension base="base64Binary">
        <attribute name="docSpecAlg" type="kz-law-ext:docSpecAlgEnum" use="required"/>
        <attribute name="signerRole" type="kz-law-ext:signerRoleEnum" use="required"/>
      </extension>
    </simpleContent>
  </complexType>

  <element name="infData" type="kz-law-ext:infDataType"/>

  <complexType name="infDataType">
    <sequence>
      <element name="digitalSignatures" type="kz-law-ext:digitalSignaturesInfoType"/>
    </sequence>
  </complexType>

  <complexType name="digitalSignaturesInfoType">
    <sequence>
      <element name="digitalSignature" type="kz-law-ext:digitalSignatureInfoType" maxOccurs="unbounded"/>
    </sequence>
  </complexType>

  <complexType name="digitalSignatureInfoType">
    <sequence>
      <element name="signatureHash" type="kz-law-ext:signatureHashType"/>
    </sequence>
    <attribute name="actionType" type="kz-law-ext:signatureActionTypeEnum" use="required"/>
  </complexType>

  <complexType name="signatureHashType">
    <simpleContent>
      <extension base="kz-law-ext:sha256HexType">
        <attribute name="docSpecAlg" type="kz-law-ext:docSpecAlgEnum" use="required"/>
        <attribute name="signerRole" type="kz-law-ext:signerRoleEnum" use="required"/>
      </extension>
    </simpleContent>
  </complexType>

  <simpleType name="signatureActionTypeEnum">
    <restriction base="string">
      <enumeration value="REGISTRANT-IDENTITY-VERIFICATION"/>
    </restriction>
  </simpleType>

  <simpleType name="docSpecAlgEnum">
    <restriction base="string">
      <enumeration value="DOC-SPEC-REGISTRANT-IDENTITY-CONFIRMATION-V1"/>
    </restriction>
  </simpleType>

  <simpleType name="signerRoleEnum">
    <restriction base="string">
      <enumeration value="CURRENT_REGISTRANT"/>
      <enumeration value="NEW_REGISTRANT"/>
      <enumeration value="REGISTRAR"/>
    </restriction>
  </simpleType>

  <simpleType name="sha256HexType">
    <restriction base="string">
      <pattern value="[0-9a-fA-F]{64}"/>
    </restriction>
  </simpleType>
</schema>