IANA Registration of Enumservices for Internet Calendaring
updated by
- rfc-6118 — Update of Legacy IANA Registrations of Enumservices
Extracted elements (9)
The Enumservice type strings use a dash '-' to allow hierarchical sub-typing (e.g., 'ical-sched', 'ical-access'), because neither RFC 3761 nor its immediate successors foresaw sub-subtyping. The dash is seen as a practical forward-compatible solution since intended successor documents explicitly allow it.
The existing 'mailto:' URI scheme is already used to address iMIP-compatible calendar services, and 'http:'/'https:' schemes are already used for CalDAV-compatible services; this document maps those URI schemes to ENUM NAPTR records without defining new URI schemes.
Calendaring URIs are often already guessable independently of ENUM, and calendar data typically requires cryptographic credentials before access is granted. Public ENUM record availability is therefore unlikely to meaningfully expose an otherwise protected calendaring resource.
The 'ical-access' Enumservice (type: 'ical-access', subtypes: 'http' and 'https') identifies a resource addressable via 'http:' or 'https:' URIs for accessing a user's calendar (e.g., free/busy status) using the CalDAV protocol (RFC 4791). Intended usage is COMMON.
The 'ical-sched' Enumservice (type: 'ical-sched', subtype: 'mailto') identifies a resource addressable via a 'mailto:' URI for calendar scheduling using the iMIP protocol (RFC 2447). Intended usage is COMMON.
RFC 5333 registers two new ENUM Enumservices: 'ical-sched' (with subtype 'mailto') for scheduling via iMIP, and 'ical-access' (with subtypes 'http' and 'https') for CalDAV-based calendar access. These are registered per the procedures in RFC 3761.
Attacks against underlying calendaring systems (unauthorized modification or viewing) are a serious concern. iTIP (RFC 2446) requires authentication, integrity, and confidentiality; CalDAV over 'https:' uses TLS (RFC 5246) to provide server authentication, confidentiality, and message integrity.
DNS does not enforce access control; all ENUM records must be considered publicly available. A calendaring URI may reveal personal information such as a user's full name or employer, though anonymous URIs can mitigate this risk.
ENUM relies on DNS, which in its current form is insecure. Resolvers SHOULD verify ENUM query responses via DNSSEC (RFC 4035) where available to prevent spoofed records pointing to malicious calendar endpoints.