Re: [regext] Security Lock anyone? (Was: Preliminary agenda for Prague, and call for agenda items)

Bill Woodcock <woody@pch.net> Mon, 25 February 2019 09:06 UTC

Return-Path: <woody@pch.net>
X-Original-To: regext@ietfa.amsl.com
Delivered-To: regext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D2551292F1 for <regext@ietfa.amsl.com>; Mon, 25 Feb 2019 01:06:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kHJW7a6olpYS for <regext@ietfa.amsl.com>; Mon, 25 Feb 2019 01:06:19 -0800 (PST)
Received: from mail.pch.net (keriomail.pch.net [206.220.231.84]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58A6812894E for <regext@ietf.org>; Mon, 25 Feb 2019 01:06:19 -0800 (PST)
X-Footer: cGNoLm5ldA==
Received: from [10.19.48.13] ([69.166.14.6]) by mail.pch.net (Kerio Connect 9.2.7 patch 3) with ESMTPS (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256 bits)); Mon, 25 Feb 2019 01:06:06 -0800
Content-Type: multipart/alternative; boundary="Apple-Mail-E04548CF-7B77-47C4-9529-5412B03002D1"
Mime-Version: 1.0 (1.0)
From: Bill Woodcock <woody@pch.net>
X-Mailer: iPhone Mail (16D57)
In-Reply-To: <19F54F2956911544A32543B8A9BDE0759FBF8765@NICS-EXCH2.sbg.nic.at>
Date: Mon, 25 Feb 2019 01:06:05 -0800
Cc: Antoin Verschuren <ietf@antoin.nl>, Registration Protocols Extensions <regext@ietf.org>
Content-Transfer-Encoding: 7bit
Message-Id: <563E062B-10D1-40F9-B5A0-9ADB8B21C50C@pch.net>
References: <19F54F2956911544A32543B8A9BDE0759FBF8765@NICS-EXCH2.sbg.nic.at>
To: Alexander Mayrhofer <alexander.mayrhofer@nic.at>
Archived-At: <https://mailarchive.ietf.org/arch/msg/regext/TnxvAu8Ff3FTZfw5Ye4vgZNn6Gs>
Subject: Re: [regext] Security Lock anyone? (Was: Preliminary agenda for Prague, and call for agenda items)
X-BeenThere: regext@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Registration Protocols Extensions <regext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/regext>, <mailto:regext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/regext/>
List-Post: <mailto:regext@ietf.org>
List-Help: <mailto:regext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/regext>, <mailto:regext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Feb 2019 09:06:22 -0000

We’d be _very interested_ in seeing a standardized, end-to-end registry-locking model. Specifically, one in which the registrant signs change requests, and the registry validates the signatures, and nobody in the registrar path is involved in any way. 

Lack of end-to-end protection was one of the key weaknesses attacked in this campaign. 

We had “registrar lock” enabled prior to the attack (but it was inapplicable); we went through the “registry lock” process after the attack had already begun, and we were very, very unimpressed. As currently implemented, it would not have successfully defended against the attack, since it involves both shared secrets and registrar-registry trust, which were both compromised. Neither is necessary, both weaken the security of the process. 
    
                -Bill


> On Feb 24, 2019, at 23:26, Alexander Mayrhofer <alexander.mayrhofer@nic.at> wrote:
> 
> Antoin, all,
>  
> for now this is more a question / request to the group, rather than a specific agenda slot request – but:
>  
> In the light of the recent attacks on registration interfaces, do we want to take a fresh look at standardization of “Registry Lock” / “Security Lock”. There’s some previous work on this topic (see https://tools.ietf.org/html/draft-wallstrom-epp-registrant-problem-statement-00). As Patrick pointed out, there’s also some IPR considerations in this area (See his blog post at http://www.circleid.com/posts/20150603_registry_lock_or_epp_with_two_factor_authentication/).
>  
> I constantly hear from registrars that “Security Lock” (our product name) would be much more attractive if there wasn’t a myriad of different processes at each registry – so my take is that there’s room for standardization (which probably goes beyond the pure EPP extension).  I’m also hearing some fellow ccTLD colleages are interesting in a common “profile”.
> Would regext be the right spot for such a discussion? If yes, would it be interesting to hold a 20 minutes slot in Prague? Or even a Bar-BoF before we “report back” to the working group?
>  
> Best,
> Alex
>  
>  
> Von: regext <regext-bounces@ietf.org> Im Auftrag von Antoin Verschuren
> Gesendet: Sonntag, 24. Februar 2019 14:43
> An: Registration Protocols Extensions <regext@ietf.org>
> Betreff: [regext] Preliminary agenda for Prague, and call for agenda items
>  
> Hi all,
> 
> Please find the preliminary agenda for Prague attached.
> I hope I captured everyone that has requested time to speak. If not, let the chairs know.
> We still have a little bit of time left on the agenda, so if you have urgent agenda items, let us know as well.
> If you are on the agenda, start preparing ;-)
> 
> 
> 
> 
> 
> Regards, Jim and Antoin
> 
> - -- 
> Antoin Verschuren
> 
> Tweevoren 6, 5672 SB Nuenen, NL
> M: +31 6 37682392
> 
> 
> 
> 
> 
> 
> _______________________________________________
> regext mailing list
> regext@ietf.org
> https://www.ietf.org/mailman/listinfo/regext
> _______________________________________________
> regext mailing list
> regext@ietf.org
> https://www.ietf.org/mailman/listinfo/regext