EPPk

EPPk is a key‑based authentication scheme used within the Extensible Provisioning Protocol (EPP), a protocol standardized by the Internet Assigned Numbers Authority for domain name registration and transfer operations. It is specified in the IETF RFC 6156, which describes the mechanics of generating, storing, and exchanging digital keys for authenticating EPP clients to registries.

The central idea of EPPk is that each EPP client possesses an asymmetric key pair. The public key is inserted into the EPP database under the client’s account or a specific object, and the private key is used to sign every EPP command sent over the secure channel. The registry verifies the signatures using the stored public key, thus authenticating the client without the continuous use of passwords or session tokens. This approach provides better security, simplifies key rotation, and facilitates delegation of authority when multiple staff members need access.

Key components of the EPPk specification include the `<eppKey>` XML element for storing and retrieving a public key, `<authInfoKey>` for passing key‑based authentication data inside command envelopes, and a `<eppKeyAccess>` element that manages permissions for key usage. Registries typically support multiple algorithm families such as RSA and ECDSA, and the standard requires them to offer a way to audit key usage and revoke compromised keys.

The protocol is designed to integrate seamlessly with existing TLS‑encrypted EPP sessions, adding an extra layer of authentication that is independent of transport security. As a result, EPPk has been adopted by several large registries, including the public registries of multiple top‑level domains, to enhance the security of their domain management systems.

See also: Extensible Provisioning Protocol, X.509 certificates, RSA, ECDSA, IETF RFC 6156.