Re: [secdir] Secdir last call review of draft-ietf-regext-epp-fees-16

Roger D Carney <rcarney@godaddy.com> Fri, 06 September 2019 14:48 UTC

Return-Path: <rcarney@godaddy.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C0B9120C86; Fri, 6 Sep 2019 07:48:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=secureservernet.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pb32nAWezWX1; Fri, 6 Sep 2019 07:48:11 -0700 (PDT)
Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0723.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe41::723]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A463E120C90; Fri, 6 Sep 2019 07:48:07 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MrffX4CH3v8BhETTcVYdNB0oEBmnjomnHfslryMZCIc1FO7BFPG6Ntfs1O+qCPAD2TSV8gAJVDefiysJzNkg96FIhInFsHHbRxdYk1kSdlULTtMXuZMSHYT/wTkS+CLOYMEUrDAdpBvLihR1ZtFitGYL1zdOF3c8AkingclqROZIMUuOflBiVQrdlkP9w+YIHur4ZfmSMokVquAc9AqjHZKEJDE4yg4TBHbOS29IJzl8eYwRY1uhN6XvhbAIZ8YCPohTuUxfc0a+8nZKYCutuNeNTQqKy8oU72NRlhpGCFRug0jI9wzHZyBnA6DDimrjcCHiHQetBIKJedrcQzsH6g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qxk8uu5NVf2PzLn3oUVD6TzTV5djjyJtNwa4YYIzjIE=; b=Q8lb3+h6BCRSZR3XeCAHXd1j4YCWqvisNveuPg/87k7Rf3qBpnRIuWOer3Atb9gTp0LrgEUF/nCMma1Rfo7D6mNm7iZ3qGwDlAoHX/ogSbCQq7+ZVM8zbB3Paw9d8If3scnpVYXiTUL+ujpDvMltZZRPnjGnIVHisHNjK+gC1gDwkrEh24CdeDy0wOGlYWAEh7UBpSb2oMkdTPGkgORMUSOFcs+01p6muQuDEXzCl5Fg8Cuqg3aMf8nSRb7zaFkQNiH7Pcob6t0O0EbomLua3mrDzk1EQ8PIoFjPHgu0LYQl9L3pK4YiWcmV3wLEA95u7+VZrsUdlNwsihRd2d17dA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=godaddy.com; dmarc=pass action=none header.from=godaddy.com; dkim=pass header.d=godaddy.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secureservernet.onmicrosoft.com; s=selector2-secureservernet-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qxk8uu5NVf2PzLn3oUVD6TzTV5djjyJtNwa4YYIzjIE=; b=nOnPT1wAz5s7Xp1e1JcyGsLszPU5TGmAgn8V12NgJN8J8uX4Nuzcj7FmWR+xkifcCnB93qGWNzcYg8/vjmUZR8oATLQm9t+yBkgscECCvgQm8dxuJrLg8hQdJnLkk87xZjfnf33cvTmUz0SIO0G5bbP2DSQlGoej8ClWLnX8trY=
Received: from BL0PR02MB5491.namprd02.prod.outlook.com (20.177.207.214) by BL0PR02MB4625.namprd02.prod.outlook.com (10.167.172.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2220.19; Fri, 6 Sep 2019 14:48:04 +0000
Received: from BL0PR02MB5491.namprd02.prod.outlook.com ([fe80::de0:ffa3:56a:6f4e]) by BL0PR02MB5491.namprd02.prod.outlook.com ([fe80::de0:ffa3:56a:6f4e%6]) with mapi id 15.20.2220.022; Fri, 6 Sep 2019 14:48:04 +0000
From: Roger D Carney <rcarney@godaddy.com>
To: Yoav Nir <ynir.ietf@gmail.com>, "secdir@ietf.org" <secdir@ietf.org>
CC: "ietf@ietf.org" <ietf@ietf.org>, "draft-ietf-regext-epp-fees.all@ietf.org" <draft-ietf-regext-epp-fees.all@ietf.org>, "regext@ietf.org" <regext@ietf.org>
Thread-Topic: Secdir last call review of draft-ietf-regext-epp-fees-16
Thread-Index: AQHVLo73dUFUGwuDgkmttbFHLxXhi6cb0i2A
Date: Fri, 06 Sep 2019 14:48:04 +0000
Message-ID: <BL0PR02MB54915DE532DCD836D4DFAD15B1BA0@BL0PR02MB5491.namprd02.prod.outlook.com>
References: <156182196167.12901.11966487185176024571@ietfa.amsl.com>
In-Reply-To: <156182196167.12901.11966487185176024571@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=rcarney@godaddy.com;
x-originating-ip: [173.18.40.219]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: ce5e4e22-a127-410e-9611-08d732d93978
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600166)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:BL0PR02MB4625;
x-ms-traffictypediagnostic: BL0PR02MB4625:
x-ms-exchange-purlcount: 2
x-microsoft-antispam-prvs: <BL0PR02MB4625B81AA8BA729F250AE8B5B1BA0@BL0PR02MB4625.namprd02.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0152EBA40F
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(376002)(346002)(39860400002)(366004)(396003)(136003)(13464003)(189003)(199004)(52536014)(74316002)(9686003)(7736002)(5660300002)(11346002)(186003)(110136005)(54906003)(6506007)(66446008)(64756008)(66556008)(66476007)(66946007)(76116006)(6436002)(476003)(6246003)(3846002)(6116002)(790700001)(86362001)(256004)(478600001)(14454004)(2906002)(53936002)(7696005)(229853002)(316002)(33656002)(446003)(76176011)(14444005)(71190400001)(71200400001)(53546011)(486006)(4326008)(25786009)(2501003)(55016002)(99286004)(102836004)(66066001)(54896002)(8936002)(81166006)(81156014)(6306002)(26005)(8676002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR02MB4625; H:BL0PR02MB5491.namprd02.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: godaddy.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: Su2i3FdF8A2uA9B37qHHfzlahPy+NFEmDquMfgOUSAVNuaj+y3X5qhHzQJ5Mp3r0iPjVEi5NYHyvS4VfvFbseEmm1D+u63lukqucJHIrin2XhiTM66HAbmAQX4DggfeipzMr/ZMcuc0ibxcPkbXNaAhZCnMIrUfPYtWP9V5Msnf+W31gROJH43mByymxlvn4Lc2+uxlGBb6d/q/XvhRocNkI2F3g4C3oWrvhKJWSm/nY7KuYBDKxOAV8PmmG8dpjVr5+t4w37yrqr+DZqdJMF9rLiZOihRcph2WrOXIzB0yxZlmVBOu2iPqZ2UevsGwi2NLUwh5DyDOC80McBfEj7Rke2C6hazag0tiCkYT6eSTY1FjlmRshMTSjKYrIHlXvn2K20J+V9Fcp4+cmyi6qCol+N3I4ms8ST/oxwngc4Xs=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_BL0PR02MB54915DE532DCD836D4DFAD15B1BA0BL0PR02MB5491namp_"
MIME-Version: 1.0
X-OriginatorOrg: godaddy.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ce5e4e22-a127-410e-9611-08d732d93978
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Sep 2019 14:48:04.8941 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d5f1622b-14a3-45a6-b069-003f8dc4851f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: R/bmlAO7iav4LIuSf82IRwbuhWdut1BjM4VBzeYCJ1F6OhLS7FDiszvQy9cKfefLZDeY8qa0Pf7PFaBtoxP+uA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR02MB4625
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/MzIILKGjw_fR82oMSsl5Orm0qJs>
Subject: Re: [secdir] Secdir last call review of draft-ietf-regext-epp-fees-16
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Sep 2019 14:48:15 -0000

Good Morning,



Thank you for your comments Yoav, please see my responses below. A new version of the draft will be published shortly and will address all of the review comments that needed edits.





Thanks

Roger



-----Original Message-----

From: Yoav Nir via Datatracker <noreply@ietf.org>

Sent: Saturday, June 29, 2019 10:26 AM

To: secdir@ietf.org

Cc: ietf@ietf.org; draft-ietf-regext-epp-fees.all@ietf.org; regext@ietf.org

Subject: Secdir last call review of draft-ietf-regext-epp-fees-16



Notice: This email is from an external sender.







Reviewer: Yoav Nir

Review result: Has Nits



Hi



I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.

Document editors and WG chairs should treat these comments just like any other last call comments.



The entire text of the Security Considerations section is as follows:



   The mapping extensions described in this document do not provide any

   security services beyond those described by EPP [RFC5730], the EPP

   domain name mapping [RFC5731], and protocol layers used by EPP.  The

   security considerations described in these other specifications apply

   to this specification as well.



This is what we like to call "security considerations by reference". I don't know what "security services" are in this context, but they are not the only thing that needs to be described in a Security Considerations section.



In this case, the draft adds information about fees, customer credit and pay schedule. This falls under the category of financial information, which should be protected in transit by security mechanisms that protect confidentiality and integrity. It is also true that any transport mechanism that complies with RFC

5730 provides those functions. So what I'm missing here is a sentence that calls this out specifically. Something along the lines of "This extension adds financial information to the EPP protocol, so confidentiality and integrity protection must be provided by the transport mechanism.  All transports compliant with RFC5730 provide that"



[RDC] We have added the following text to section 7: "This extension passes financial information using the EPP protocol, so confidentiality and integrity protection must be provided by the transport mechanism.  All transports compliant with RFC5730 provide the needed level of confidentiality and integrity protections."