Re: [secdir] Secdir review of draft-hollenbeck-rfc4930bis-02

[Catherine Meadows <[e-mail]>]

Hi Scott:

By Transport ID, I would assume the  identifer(s)  associated with the  
transport level authentication key.
For EPP ID I would assume whatever identification is associated with  
an EPP instance.
II wasn't actually present at the discussion on channel binding so  
can't be more specific than this.
If there is anyone in the secdir group listening who has some more  
information on this I'd appreciate
hearing from them.

Cathy

On Jul 14, 2009, at 10:34 AM, Hollenbeck, Scott wrote:

> From: Catherine Meadows [mailto:[e-mail]]
> Sent: Tuesday, July 14, 2009 9:56 AM
> To: [e-mail]; [e-mail]; Hollenbeck, Scott
> Cc: Catherine Meadows
> Subject: Secdir review of draft-hollenbeck-rfc4930bis-02
>
> I have reviewed this document as part of the security directorate's  
> ongoing effort to review all IETF documents being processed by the  
> IESG. These comments were written primarily for the benefit of the  
> security area directors.  Document editors and WG chairs should  
> treat these comments just like any other last call comments.
>
> Note:  I recently submitted a review of draft-hollenbeck- 
> rfc4933bis-02.  That was a mistake on my part; that was not the  
> document I was supposed to review.
> Sandy Murphy is down for reviewing that one.  I am supposed to  
> review this one.  This document is the update of the based  
> specification of  EPP, and so is related to rfc4933bis-02.
>
> I've also had some discussion with Sandy about the issue she raised  
> with respect to draft-hollenbeck-rfc4933bis-02.  That is actually  
> what I first thought it was:  EPP only does a weak form of  
> authentication.
> So it depends on strong authentication done at the transport level  
> or application level.  However there is nothing in the document that  
> I can see
> that says that the EPP ID must match the transport ID.  Thus, if it  
> is relying on the
> authentication being done at the transport level, there appears to  
> be nothing to prevent the transport level channel being replaced by  
> another one at some point.  I am not enough of an expert on EPP
> to make a definite recommendation as to how or whether this needs to  
> be addressed, but I feel that this is something that needs to be  
> brought to the attention of the IESG and discussed in the next  
> telechat.   If the
> issue does need to be addressed, rfc4930bis is the place where it  
> should be handled.
>
>
> Please help me understand what you mean by "EPP ID" and "transport  
> ID".
>
> -Scott-

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]