Subject: [ietf-provreg] EPP Server Implementer Help Needed

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 18 Aug 2009 07:16:48 -0400

I still need info from one server implementer that is willing to be
included in an implementation report and confirm that they have
implemented the TLS client identification features described in section
9 of 4934bis.  Specifically:

1. TLS implementations are REQUIRED to support the mandatory cipher
suite specified in the implemented version:

2. Mutual client and server authentication using the TLS Handshake
Protocol is REQUIRED.

3. Signatures on the complete certification path for both client machine
and server machine MUST be validated as part of the TLS handshake.

4. Information included in the client and server certificates, such as
validity periods and machine names, MUST also be validated.

5. EPP service MUST NOT be granted until successful completion of a TLS
handshake and certificate validation

Most of these come for free with a good TLS toolkit.  Are there any
server implementers willing to confirm that they've implemented these
features?  I've already confirmed that VeriSign has implemented these
features.

-Scott-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
List run by majordomo software.  For (Un-)subscription and similar details
send "help" to [email-masked]

---

From: Francisco Obispo <[email-masked]>
Date: Tue, 18 Aug 2009 11:29:03 -0430

Hi Scott,

Although this comment might seem odd, I was wondering, why the TLS  
feature is required.

When I was in charge of .VE we decided not to include any encryption/ 
auth features besides regular user/pass simple auth.

Later on, we decided to use SSL/TLS tunneling with a sepparate  
software package, that will provide the encryption services. At first  
we used ssh, but stunnel turned out to be a better solution.
if we were to require stronger encryption, we could start by  
introducing other software packages, but taking the complications  
outside of the EPP implementation...

I don´t know if using third party software will comply with this  
requirement, because if it does, then it might be a good idea to  
switch to that instead.

Regards

Francisco

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 18 Aug 2009 12:45:43 -0400

TLS was selected because it was thought to provide the best fit for the requirements identified in RFC 3375.

-Scott- 

> -----Original Message-----
> From: Francisco Obispo [mailto:[email-masked]] 
> Sent: Tuesday, August 18, 2009 11:59 AM
> To: Hollenbeck, Scott
> Cc: [email-masked]
> Subject: Re: [ietf-provreg] EPP Server Implementer Help Needed
> 
> Hi Scott,
> 
> Although this comment might seem odd, I was wondering, why 
> the TLS feature is required.
> 
> When I was in charge of .VE we decided not to include any 
> encryption/ auth features besides regular user/pass simple auth.
> 
> Later on, we decided to use SSL/TLS tunneling with a 
> sepparate software package, that will provide the encryption 
> services. At first we used ssh, but stunnel turned out to be 
> a better solution.
> introducing other software packages, but taking the 
> complications outside of the EPP implementation...
> 
> I don´t know if using third party software will comply with 
> this requirement, because if it does, then it might be a good 
> idea to switch to that instead.
> 
> Regards
> 
> Francisco
> 
> 
> 
> > 3. Signatures on the complete certification path for both client 
> > machine and server machine MUST be validated as part of the TLS 
> > handshake.
> >
> > 5. EPP service MUST NOT be granted until successful completion of a 
> > TLS handshake and certificate validation
> >
> > List run by majordomo software.  For (Un-)subscription and similar 
> > details send "help" to [email-masked]
> >
> >
> 
>

---

From: Frederico A C Neves <[email-masked]>
Date: Wed, 19 Aug 2009 11:59:05 -0300

Scott,

> features?  I've already confirmed that VeriSign has implemented these

I could confirm that our server does implement all these features.

On the client side I could confirm several production clients. Some
using our own client, private implementations and at least two client
using Verising NameStore and Key-Systems.

Our own client software does almost all checks except the validation
of the server name and the CN on the server certificate. Next release
will include this small patch.

> -Scott-

Fred

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 19 Aug 2009 11:28:36 -0400

Great - thanks!  Can you tell me how you would want to see your server
implementation identified in the implementation report?

-Scott- 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Frederico A C Neves
> Sent: Wednesday, August 19, 2009 10:59 AM
> To: [email-masked]
> > machine and server machine MUST be validated as part of the 
> TLS handshake.
> > 
> On the client side I could confirm several production 
> clients. Some using our own client, private implementations 
> and at least two client using Verising NameStore and Key-Systems.
> 
> Our own client software does almost all checks except the 
> validation of the server name and the CN on the server 
> certificate. Next release will include this small patch.
> 
> > -Scott-
> 
> Fred
> List run by majordomo software.  For (Un-)subscription and 
> similar details send "help" to [email-masked]
> 
>

---

From: Frederico A C Neves <[email-masked]>
Date: Wed, 19 Aug 2009 13:22:10 -0300

> implementation identified in the implementation report?

Registro.br

Fred