The Atom "deleted-entry" Element
Extracted elements (20)
Publishers of individually signed at:deleted-entry elements should add an atom:source element before signing, because aggregators may need to add atom:source after publication, which would break an existing signature.
The at:deleted-entry element is explicitly advisory in nature; it may be ignored by Atom Processors. Its presence does not guarantee that the referenced entry will be unavailable, since aggregators that previously processed an entry may not reprocess the feed to observe the deletion signal.
A feed MAY contain both atom:entry elements and at:deleted-entry elements sharing the same atom:id, representing an entry being published, then deleted, or deleted then republished. Timestamp comparison between 'when' and 'atom:updated' determines which condition applies.
An Atom feed MUST NOT contain more than one at:deleted-entry element with the same combination of ref and when attribute values.
Atom Processors that verify signed Atom Documents MUST be able to verify RSA signatures; DSA support is not required. Atom Documents SHOULD NOT use MACs for signatures due to key-handling risks.
Processors encountering unknown XML markup within at:deleted-entry MUST NOT stop processing or signal an error, and MUST NOT change their behavior as a result of the markup's presence.
Processors MUST NOT reject an at:deleted-entry containing an XML digital signature merely because they cannot verify it; they MUST continue processing and MAY inform the user of the validation failure.
Processors that decrypt Deleted Entry Documents MUST be able to decrypt with AES-128 in Cipher Block Chaining (CBC) mode, as required by XML Encryption.
Processors that decrypt Deleted Entry Documents SHOULD check integrity of the decrypted document by verifying the signature hash or a document-internal hash, because XML Encryption alone does not ensure integrity.
Processors that verify signed at:deleted-entry elements MUST support exclusive XML canonicalization identified by 'http://www.w3.org/2001/10/xml-exc-c14n#', because standard Canonical XML breaks signatures when signed documents are enclosed in other XML documents.
The at:deleted-entry element MUST contain a 'when' attribute whose value is an RFC 3339 date-time specifying the instant the entry was removed.
When a Deleted Entry Document is both signed and encrypted, it MUST be signed first and then encrypted. When MACs are used with symmetric encryption, the same key SHOULD NOT be used for both the MAC and the encryption.
When an at:deleted-entry element appears in a Feed document other than its source feed, or when used in a Deleted Entry Document that has a source feed, it MUST contain an atom:source element to preserve source provenance during aggregation.
A Deleted Entry Document is a standalone XML 1.0 document whose root element is at:deleted-entry, representing exactly one deleted entry outside the context of an Atom feed. It is identified by the 'application/atomdeleted+xml' media type and MUST be well-formed XML.
The at:deleted-entry element represents an Atom Entry that has been removed. It uses namespace 'http://purl.org/atompub/tombstones/1.0' and carries atomCommonAttributes plus mandatory 'ref' and 'when' attributes, and optional at:by, at:comment, atom:link, and atom:source child elements.
This document registers the 'application/atomdeleted+xml' media type for Deleted Entry Documents serialized as XML 1.0. The file extension is .atomdeleted; encoding considerations are identical to 'application/xml' per RFC 3023.
Atom Processors must be aware of spoofing attacks where an attacker publishes at:deleted-entry elements using atom:id values from other feeds, tricking consumers into treating valid entries as removed. Processors should ignore at:deleted-entry elements referencing entries not previously seen in the containing feed and should verify feed origin.
If an at:deleted-entry indicating deletion of an atom:entry is signed with a different key than the original entry, or is unsigned while the entry was signed, this may indicate a spoofing attack. Processors must verify the validity of at:deleted-entry elements in relation to the signing keys of the referenced entries.
When a feed contains both an atom:entry and an at:deleted-entry sharing the same atom:id, processors compare the at:deleted-entry 'when' attribute to the atom:entry 'atom:updated' value. If 'when' is equal to or newer, the entry is treated as deleted and the atom:entry SHOULD be ignored; if 'when' is older, the entry is treated as republished and the at:deleted-entry SHOULD be ignored.
The 'ref' attribute on at:deleted-entry is an atomUri carrying the atom:id value of the removed entry. The 'when' attribute is an RFC 3339 date-time string; 'T' MUST be uppercase to separate date and time, and 'Z' MUST appear when no numeric time zone offset is present.