Subject: [eppext] Ted Lemon's No Objection on draft-ietf-eppext-reg-08: (with COMMENT)

From: "Ted Lemon" <[email-masked]>
Date: Thu, 02 Oct 2014 07:06:27 -0700

Ted Lemon has entered the following ballot position for
draft-ietf-eppext-reg-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-eppext-reg/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

This seems wrong:

   Using email to deliver forms to IANA carries a risk of registry
   entries being created or updated by an attacker who is able to spoof
   the email address of a legitimate extension registrant.  This risk
   can be mitigated by replying to received messages with a request to
   confirm the requested action.  The reply will be delivered to the
   specified registrant, who can validate or refute the request.

If you have a man-in-the-middle, they can presumably modify messages in
both directions.   But as Kathleen said, the normal process of review
should catch problems of this sort. If that fails, and an erroneous
registration occurs, the registrant will see the incorrect IANA registry
entry.   So this will serve as an out-of-band mechanism for detecting
attacks of this type, since the MITM presumably won't be able to spoof
the SSL cert from the IANA web site.