Re: [secdir] Secdir review of draft-hollenbeck-rfc4930bis-02

["Hollenbeck, Scott" <[e-mail]>]

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]] 
> Sent: Wednesday, July 15, 2009 11:46 AM
> To: Sandra Murphy
> Cc: Hollenbeck, Scott; [e-mail]; 
> [e-mail]; [e-mail]; Sandy Murphy
> Subject: Re: [secdir] Secdir review of draft-hollenbeck-rfc4930bis-02
> 
> Sandra Murphy wrote:
> 
> > On Tue, 14 Jul 2009, Hollenbeck, Scott wrote:
> >
> >> Doesn't TLS provide protections for this issue?
> >>
> >> -Scott-
> >
> > (a) rfc4930 does not mandate use of TLS as a tranport 
> connection, by 
> > design (so I don't know why you mention it):
> 
> rfc4934 (binding to TLS over TCP) mandates use of TLS.
> 
> >    EPP is intended for use in diverse operating environments where
> >    transport and security requirements vary greatly.  It is unlikely
> >    that a single transport or security specification will 
> meet the needs
> >    of all anticipated operators, so EPP was designed for use in a
> >    layered protocol environment.  Bindings to specific transport and
> >    security protocols are outside the scope of this specification.

As Alexey noted, I mentioned it because there's an EPP specification for
transport over TLS.  4934bis is part of the document set that's being
reviewed for progression to Standard status.  That's why I'm having some
trouble understanding if/how I should address the channel binding risk
comments in 4930bis or one of the other documents.

-Scott-