Subject: Re: [secdir] secdir review of draft-ietf-regext-rfc7484bis

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 3 Dec 2021 13:03:58 -0800

Hi Scott, authors,

Thanks for raising this topic in your review; it's good to have the
additional focus on it.  In particular...

On Tue, Nov 30, 2021 at 09:42:39AM -0800, Scott G. Kelly wrote:
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
> 
> The summary of the review is almost ready
> 
> This review is quite late, but still ahead of the telechat, so I hope it is useful.
> 
> From the abstract:
>    This document specifies a method to find which Registration Data
>    Access Protocol (RDAP) server is authoritative to answer queries for
>    a requested scope, such as domain names, IP addresses, or Autonomous
>    System numbers.  This document obsoletes RFC7484
> 
> Here is the security considerations section:
> 
>    "By providing a bootstrap method to find RDAP servers, this document
>    helps to ensure that the end users will get the RDAP data from an
>    authoritative source, instead of from rogue sources.  The method has
>    the same security properties as the RDAP protocols themselves.  The
>    transport used to access the registries can be more secure by using
>    TLS [RFC8446], which IANA supports.
> 
>    Additional considerations on using RDAP are described in [RFC7481]."
> 
> Because this document is updating RFC7484, and because these security considerations are copied verbatim from that doc, I hesitate to raise my concern. Nonetheless, I think the assertion that this document "helps to ensure that the end users will get the RDAP data from an authoritative source, instead of from rogue sources." is questionable. I think the suggestion to use TLS helps, but I think it would be better to say something like this:
> 
> "This document specifies a method to find which RDAP server is authoritative to answer queries for a requested scope, such as domain names, IP addresses, or Autonomous System numbers. If this data is not authenticated, an adversary may inject data that redirects the user to a rogue RDAP server. A robust authentication method such as may be provided by TLS [RFC8446] SHOULD be utilized to protect against this.
> 
> Additional considerations on using RDAP are described in [RFC7481]."

This is a good template for actual text to put in the document that covers
TLS usage and the need for it.  However, I think we may even be able to do
better than "TLS SHOULD be utilized", since (as I understand it) RFC 7481
has a requirement that "HTTP over TLS MUST be used to protect all
client-server exchanges unless operational constraints make it impossible
to meet this requirement."  So, we might end this text instead with
"A robust authentication method is provided by TLS [RFC8446], and
accordingly the use of TLS is required by RFC 7481 in the absence of
operational constraints that make use of TLS impossible; in such cases,
alternative authentication methods SHOULD be utilized to protect against
such risks."

Thanks again,

Ben

> I'm not attached to the precise wording, but I think implementers should be told what the risks are, and how to mitigate them. I don't think the current security considerations quite hit that aspiration.
> 
> --Scott
> 
> 
> 
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: https://trac.ietf.org/trac/sec/wiki/SecDirReview