RE: security in draft-ietf-provreg-epp-0.txt

["Hollenbeck, Scott" <shollenbeck@verisign.com>]

Agreed, that's why the existing "Security Considerations" section describes
the weaknesses in the base protocol's security features, noting that
"better" services are required from other protocol layers.

<Scott/>

-----Original Message-----
From: Bill Manning
To: shollenbeck@verisign.com
Cc: ietf-provreg@cafax.se
Sent: 3/20/01 10:14 AM
Subject: Re: security in draft-ietf-provreg-epp-0.txt

% We've already architected a solution that allows appropriate security
% service layers, and forcing those services into the base protocol can
% introduce redundancy -- such as when SMTP transport with S/MIME or PGP
% security is required.
% 
% <Scott/>

We should be very clear that the architected solution is an acceptable
solution not THE solution.  Determining what is appropriate is...
(outside the scope?) 
What we are required to do is document the security (authentication &
integrity checks for sure) methods that the architected solution is
using and note the strengths and weaknesses in the selected methods.

--bill