[secdir] review of draft-hollenbeck-rfc4933bis-02

[Catherine Meadows <[e-mail]>]

I have reviewed this document as part of the security
directorate's ongoing effort to review all IETF documents
being processed by the IESG.
These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs
should treat these comments just like any other last call comments.

Quote from last review:

"The draft updates RFC 4933, the EPP Contacts Mapping spec.
The updates listed are relatively minor - updates to
references and a few minor updates to text."

Version 1 has reviewed recently (June 10, by Sandy Murphy) and the  
author already
made the changes that were agreed upon in following discussion.

Everything mostly looks OK to me, but there is one issue that never  
got completely resolved
as far as I can tell from what I saw online.  This is the question of  
channel binding issues as described
RFC 4953.  I'm having trouble accessing that document right now, but  
apparently the issue is that
low-level authentication mechanisms will not provide any distinction  
between channels at a higher level.
This can make it possible for someone with access to the  
authentication mechanisms to spoof different channels.
In particular, if the EPP authorization information is protected with  
lower-level authentication mechanisms this could
be the case.  Unless there is good reason to believe that this sort of  
attack is impossible (in which case it would
be a good idea to say why) it might be good
that

>> Both client and server MUST ensure that authorization
>>    information is stored and exchanged with high-grade encryption
>>    mechanisms to provide privacy services.

be changed to

Both client and server MUST ensure that authorization
    information is stored and exchanged with high-grade encryption
    mechanisms to provide privacy and authentication services at the  
appropriate level
of granularity.


Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]