A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Registration Protocols Extensions WG of the
IETF.
Title : Extensible Provisioning Protocol (EPP) Secure
Authorization Information for Transfer
Authors : James Gould
Richard Wilhelm
Filename : draft-ietf-regext-secure-authinfo-transfer-05.txt
Pages : 28
Date : 2021-01-04
Abstract:
The Extensible Provisioning Protocol (EPP), in RFC 5730, defines the
use of authorization information to authorize a transfer. The
authorization information is object-specific and has been defined in
the EPP Domain Name Mapping, in RFC 5731, and the EPP Contact
Mapping, in RFC 5733, as password-based authorization information.
Other authorization mechanisms can be used, but in practice the
password-based authorization information has been used at the time of
object create, managed with the object update, and used to authorize
an object transfer request. What has not been fully considered is
the security of the authorization information that includes the
complexity of the authorization information, the time-to-live (TTL)
of the authorization information, and where and how the authorization
information is stored. This document defines an operational
practice, using the EPP RFCs, that leverages the use of strong random
authorization information values that are short-lived, that are not
stored by the client, and that are stored using a cryptographic hash
by the server to provide for secure authorization information used
for transfers.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-regext-secure-authinfo-transfer/
There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-regext-secure-authinfo-transfer-05.html
A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-regext-secure-authinfo-transfer-05
Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
