Subject: [secdir] Secdir review of draft-hollenbeck-rfc4930bis-02

From: Catherine Meadows <[email-masked]>
Date: Tue, 14 Jul 2009 09:56:02 -0400

I have reviewed this document as part of the security directorate's  
ongoing effort to review all IETF documents being processed by the  
IESG. These comments were written primarily for the benefit of the  
security area directors.  Document editors and WG chairs should treat  
these comments just like any other last call comments.

Note:  I recently submitted a review of draft-hollenbeck- 
rfc4933bis-02.  That was a mistake on my part; that was not the  
document I was supposed to review.
Sandy Murphy is down for reviewing that one.  I am supposed to review  
this one.  This document is the update of the based specification of   
EPP, and so is related to rfc4933bis-02.

I've also had some discussion with Sandy about the issue she raised  
with respect to draft-hollenbeck-rfc4933bis-02.  That is actually what  
I first thought it was:  EPP only does a weak form of authentication.
So it depends on strong authentication done at the transport level or  
application level.  However there is nothing in the document that I  
can see
that says that the EPP ID must match the transport ID.  Thus, if it is  
relying on the
authentication being done at the transport level, there appears to be  
nothing to prevent the transport level channel being replaced by  
another one at some point.  I am not enough of an expert on EPP
to make a definite recommendation as to how or whether this needs to  
be addressed, but I feel that this is something that needs to be  
brought to the attention of the IESG and discussed in the next  
telechat.   If the
issue does need to be addressed, rfc4930bis is the place where it  
should be handled.

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: [email-masked]

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 14 Jul 2009 10:34:28 -0400

________________________________

From: Catherine Meadows [mailto:[email-masked]] 
Sent: Tuesday, July 14, 2009 9:56 AM
To: [email-masked]; [email-masked]; Hollenbeck, Scott
Cc: Catherine Meadows
Subject: Secdir review of draft-hollenbeck-rfc4930bis-02

	I have reviewed this document as part of the security
directorate's ongoing effort to review all IETF documents being
processed by the IESG. These comments were written primarily for the
benefit of the security area directors.  Document editors and WG chairs
should treat these comments just like any other last call comments. 

	Note:  I recently submitted a review of
draft-hollenbeck-rfc4933bis-02.  That was a mistake on my part; that was
not the document I was supposed to review.
	Sandy Murphy is down for reviewing that one.  I am supposed to
review this one.  This document is the update of the based specification
of  EPP, and so is related to rfc4933bis-02.

	I've also had some discussion with Sandy about the issue she
raised with respect to draft-hollenbeck-rfc4933bis-02.  That is actually
what I first thought it was:  EPP only does a weak form of
authentication.
	So it depends on strong authentication done at the transport
level or application level.  However there is nothing in the document
that I can see
	that says that the EPP ID must match the transport ID.  Thus, if
it is relying on the
	authentication being done at the transport level, there appears
to be nothing to prevent the transport level channel being replaced by
another one at some point.  I am not enough of an expert on EPP
	to make a definite recommendation as to how or whether this
needs to be addressed, but I feel that this is something that needs to
be brought to the attention of the IESG and discussed in the next
telechat.   If the
	issue does need to be addressed, rfc4930bis is the place where
it should be handled. 

	Please help me understand what you mean by "EPP ID" and
"transport ID".
	 
	-Scott-

---

From: Catherine Meadows <[email-masked]>
Date: Tue, 14 Jul 2009 17:06:08 -0400

Hi Scott:

By Transport ID, I would assume the  identifer(s)  associated with the  
transport level authentication key.
For EPP ID I would assume whatever identification is associated with  
an EPP instance.
II wasn't actually present at the discussion on channel binding so  
can't be more specific than this.
If there is anyone in the secdir group listening who has some more  
information on this I'd appreciate
hearing from them.

Cathy

On Jul 14, 2009, at 10:34 AM, Hollenbeck, Scott wrote:

> security area directors.  Document editors and WG chairs should  
> treat these comments just like any other last call comments.
>
> review this one.  This document is the update of the based  
> specification of  EPP, and so is related to rfc4933bis-02.
>
> with respect to draft-hollenbeck-rfc4933bis-02.  That is actually  
> So it depends on strong authentication done at the transport level  
> or application level.  However there is nothing in the document that  
> I can see
> that says that the EPP ID must match the transport ID.  Thus, if it  
> is relying on the
> authentication being done at the transport level, there appears to  
> be nothing to prevent the transport level channel being replaced by  
> Please help me understand what you mean by "EPP ID" and "transport  
> ID".
>
> -Scott-

Catherine Meadows