Administering Handles

Conducting handle administration (i.e., creating, modifying, and deleting individual handles) requires that you authenticate yourself to the Handle System by proving that you are who you claim to be. To authenticate yourself, you need to have an ID that uniquely identifies you, and since the Handle System is global in nature, your ID must also be globally unique. Since globally unique identifiers are the Handle System's specialty, it is natural that administrators should be identified by handles.

An administrator handle contains either a public key or a secret key (password) that authenticates the individual identified by that handle. If an administrator handle is specified with permission to perform some operation in the Handle System, then that administrator can perform that operation as long as he can authenticate himself against the public or secret key in the administrator handle.

When you request your own prefix (also known as a naming authority), a prefix will be created that will also serve as the administrator handle for that prefix, so prefixes (such as 0.NA/123456) serve double-duty as administrator handles and as prefixes. In this discussion we will be focusing on the administrator functions of the naming authority handle.

An administrator handle can be queried and the values viewed using a handle client, or by using the form on the "Resolve a Handle and View the Values" page at http://hdl.handle.net, the URL for the proxy server run by CNRI. (Access the form at http://hdl.handle.net/. Note that if you append a handle to the proxy server address http://hdl.handle.net/, the proxy server will resolve the handle to its associated URL.) Your public or secret key will be associated with the administrator handle. When you query the handle, you will notice that there are several values associated with it. In addition, each handle value has a unique (within the handle) numeric index, as well as a type identifier. Some of the handle values have special meaning within the Handle System:

Admin Value. Every handle must have an admin value associated with it. An admin value is of type HS_ADMIN, and specifies the permissions and handle of the administrator who is allowed to make changes to or delete that handle. Admin values are values of type HS_ADMIN, and for consistency are being given an index of 100*. If there are multiple admin values, then the additional indexes are being given 101, 102, 103, and so on. Admin values specify who can perform administration, by the handle and value index of either the administrator's authentication, or of an admin group value.
Public Key Value. If you have a public key associated with the handle, it will be in a handle value with type HS_PUBKEY. Public key values for consistency are being given an index of 300 (or 301, 302, 303, etc., if you have multiple keys). It is important to remember the index because you will need to specify it along with your handle when you authenticate yourself.
Secret Key Value. If you have a secret key associated with your handle, it will be in a handle value with type HS_SECKEY. For consistency, secret key values are being given an index of 300 (or 301, 302, 303, etc. if you have multiple keys). It is important to remember this index because you will need to specify it along with your handle when asked to authenticate yourself. This handle value should obviously not be publicly readable, which is why secret key values do not appear in non-authenticated queries for your administrative handle.
Group Value. A group value contains a list of handle values that identify public keys, secret keys, or other groups and is type HS_VLIST. If an admin value specifies a group value as an administrator, then every value in the group is considered an administrator for the handle.

Handle administration requires an administrator to authenticate himself by providing the following information:

Your admin handle (your prefix) and the index of your public or secret key value within that handle.
Your private or secret key. Note: your private and secret key will *never* be sent over the Internet by the Handle System. You shouldn't send either private or secret keys over the Internet. You only need to provide this to the Handle System client software so that it can prove to any handle server that you have this information.

In order to create an identifier under a given prefix, the owner of the prefix (the part of the handle before the slash) must give you permission to create identifiers under that prefix. He can give you permission to create identifiers by adding your admin handle and the index for your key value to a list of administrators who have permission to create identifiers under that prefix.

When you send the 'create-handle' request to the Handle System, you must provide your authentication information. If the server can verify that you are the individual identified by the admin handle (your private key matches your public key, or you enter the correct secret key) then the requested identifier will be created.

*The Handle System does not require these particular index values. The index values just need to be unique within the handle.

For more information on administering handles, see the Handle System RFCs referenced in the Interface Specification.