Re: [secdir] Secdir review of draft-hollenbeck-rfc4930bis-02

[Sandra Murphy <[e-mail]>]

On Tue, 14 Jul 2009, Hollenbeck, Scott wrote:

> Doesn't TLS provide protections for this issue?
>
> -Scott-


(a) rfc4930 does not mandate use of TLS as a tranport connection, by 
design (so I don't know why you mention it):

    EPP is intended for use in diverse operating environments where
    transport and security requirements vary greatly.  It is unlikely
    that a single transport or security specification will meet the needs
    of all anticipated operators, so EPP was designed for use in a
    layered protocol environment.  Bindings to specific transport and
    security protocols are outside the scope of this specification.

(b) There are defined channel bindings for TLS.  See the recently 
published draft-altman-tls-channel-bindings-05.txt.  This isn't a free 
ride, however -- note the places where that draft mentions the need to 
modify firmware or software:

    Therefore 'tls-unique' is generally better than 'tls-server-end-
    point'.  However, 'tls-server-end-point' may be used with existing
    TLS server-side proxies ("concentrators") without modification to the
    proxies, whereas 'tls-unique' may require firmware or software
    updates to server-side proxies.  Therefore there may be cases where
    'tls-server-end-point' may interoperate but where 'tls-unique' may
    not.


--Sandy