Re: [secdir] SECDIR review of draft-ietf-regext-launchphase

["Gould, James" <[e-mail]>]

Chris,

Thank you for the review and feedback.  I respond to you feedback below:

> I found in the section of Conventions Used in this Document, several XML terms are defined with each containing an addendum similar to, "The XML namespace prefix [xxx] is used, but implementations MUST NOT depend on it and instead employ a proper namespace-aware XML parser and serializer
> to interpret and output the XML documents." I think that it would be appropriate to have a summary statement covering these in the Security Considerations section.

The statement related to the XML namespace prefix is not security related but is an XML best practice for interoperability.  The XML namespace prefixes chosen (“launch”, “smd”, “mark”) in the draft are for illustration purposes only and must not be statically defined dependencies in the implementations to ensure that the clients can chose XML namespace prefixes for the commands that may not match the draft and that will be supported by the server.  The same holds true for the server being able to chose XML namespace prefixes for the responses that may not match the draft that will be supported by the client.

Thanks,

—

JG

[id:[e-mail]933A30]

James Gould
Distinguished Engineer
[e-mail]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

Verisign.com<http://verisigninc.com/>

From: Chris Lonvick <[e-mail]>
Date: Friday, November 3, 2017 at 6:58 AM
To: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: [EXTERNAL] SECDIR review of draft-ietf-regext-launchphase
Resent-From: <[e-mail]>
Resent-To: James Gould <[e-mail]>, Wil Tan <[e-mail]>, Gavin Brown <[e-mail]>, <[e-mail]>, <[e-mail]>, <[e-mail]>, <[e-mail]>, <[e-mail]>, Ulrich Wisser <[e-mail]>, <[e-mail]>
Resent-Date: Friday, November 3, 2017 at 6:58 AM

Hi,

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready with Nits.

The abstract describes the specification as: This document describes an Extensible Provisioning Protocol (EPP) extension mapping for the provisioning and management of domain name registrations and applications during the launch of a domain name registry.

I am not familiar with this line of work. In my review, I found in the section of Conventions Used in this Document, several XML terms are defined with each containing an addendum similar to, "The XML namespace prefix [xxx] is used, but implementations MUST NOT depend on it and instead employ a proper namespace-aware XML parser and serializer to interpret and output the XML documents." I think that it would be appropriate to have a summary statement covering these in the Security Considerations section.

The Security Considerations section appears appropriate for the contents and normative references.

Regards,
Chris