Subject: Re: [secdir] [Last-Call] Secdir last call review of draft-ietf-regext-epp-registry-maintenance-16

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 7 Oct 2021 14:57:53 -0700

Hi Melinda,

Thanks for the review!  The confusion about transport security requirements
is quite understandable, and we actually ended up having a discussion in
the IESG about TLS usage for EPP when the core EPP specs were getting
promoted to Internet Standard.  I no longer remember the specifics of the
discussion, but we did conclude that TLS or equivalent is required, across
the whole collection of documents.

-Ben

On Sun, Aug 08, 2021 at 08:29:14PM -0700, Melinda Shore via Datatracker wrote:
> Reviewer: Melinda Shore
> Review result: Has Issues
> 
> The security considerations section is scanty - transport security is not
> described at all, nor is the question of defense against a malicious actor
> spoofing a server.  It may be the case that there are, in fact, mitigations in
> common use but they are not spelled out in this draft nor in RFC 5730 (and I’ll
> be the first to admit that I may have missed something).  Because of this I do
> have reservations about progressing the document towards publication.
> 
> Section 3.3: Is it the case that if an element is not explicitly identified as
> optional, it’s mandatory?  If that’s the case you may want to mention that in
> the first paragraph of this section
> 
> Nits:
> 
> There’s occasionally some unidiomatic English (for example, “The command
> mappings described here are specifically for the use to notify [ … ]” rather
> than, for example, “The command mappings described here are specifically used
> to notify [ … ]”, “The information on a [ … ]” rather than “The information
> about a [ … ], etc.),
> 
> Section 1, first paragraph:  It’s actually not very clear about what registries
> are informing registrars.  It may be clearer to start with something along the
> lines of “Registries usually inform registrars of maintenance activities in
> different ways.”
> 
> 
> -- 
> last-call mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/last-call