Subject: [regext] Security Lock anyone? (Was: Preliminary agenda for Prague, and call for agenda items)

From: Alexander Mayrhofer <[email-masked]>
Date: Mon, 25 Feb 2019 07:26:07 +0000

Antoin, all,

for now this is more a question / request to the group, rather than a specific agenda slot request - but:

In the light of the recent attacks on registration interfaces, do we want to take a fresh look at standardization of "Registry Lock" / "Security Lock". There's some previous work on this topic (see https://tools.ietf.org/html/draft-wallstrom-epp-registrant-problem-statement-00). As Patrick pointed out, there's also some IPR considerations in this area (See his blog post at http://www.circleid.com/posts/20150603_registry_lock_or_epp_with_two_factor_authentication/).

I constantly hear from registrars that "Security Lock" (our product name) would be much more attractive if there wasn't a myriad of different processes at each registry - so my take is that there's room for standardization (which probably goes beyond the pure EPP extension).  I'm also hearing some fellow ccTLD colleages are interesting in a common "profile".
Would regext be the right spot for such a discussion? If yes, would it be interesting to hold a 20 minutes slot in Prague? Or even a Bar-BoF before we "report back" to the working group?

Best,
Alex

Von: regext <[email-masked]> Im Auftrag von Antoin Verschuren
Gesendet: Sonntag, 24. Februar 2019 14:43
An: Registration Protocols Extensions <[email-masked]>
Betreff: [regext] Preliminary agenda for Prague, and call for agenda items

Hi all,

Please find the preliminary agenda for Prague attached.
I hope I captured everyone that has requested time to speak. If not, let the chairs know.
We still have a little bit of time left on the agenda, so if you have urgent agenda items, let us know as well.
If you are on the agenda, start preparing ;-)

Regards, Jim and Antoin

- --
Antoin Verschuren

Tweevoren 6, 5672 SB Nuenen, NL
M: +31 6 37682392

_______________________________________________
regext mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/regext

---

From: Kal Feher <[email-masked]>
Date: Mon, 25 Feb 2019 19:51:19 +1100

I won't be at Prague, but this is certainly a topic I'm interested in.

On 25/2/19 6:26 pm, Alexander Mayrhofer wrote:
>
> Antoin, all,
>
>  
>
> for now this is more a question / request to the group, rather than a
> specific agenda slot request – but:
>
>  
>
> In the light of the recent attacks on registration interfaces, do we
> want to take a fresh look at standardization of “Registry Lock” /
> “Security Lock”. There’s some previous work on this topic (see
> https://tools.ietf.org/html/draft-wallstrom-epp-registrant-problem-statement-00).
> As Patrick pointed out, there’s also some IPR considerations in this
> area (See his blog post at
> http://www.circleid.com/posts/20150603_registry_lock_or_epp_with_two_factor_authentication/).
>
>  
>
> I constantly hear from registrars that “Security Lock” (our product
> name) would be much more attractive if there wasn’t a myriad of
> different processes at each registry – so my take is that there’s room
> for standardization (which probably goes beyond the pure EPP
> extension).  I’m also hearing some fellow ccTLD colleages are
> interesting in a common “profile”.
>
> Would regext be the right spot for such a discussion? If yes, would it
> be interesting to hold a 20 minutes slot in Prague? Or even a Bar-BoF
> before we “report back” to the working group?
>
>  
>
> Best,
>
> Alex
>
>  
>
>  
>
> *Von:*regext <[email-masked]> *Im Auftrag von *Antoin Verschuren
> *Gesendet:* Sonntag, 24. Februar 2019 14:43
> *An:* Registration Protocols Extensions <[email-masked]>
> *Betreff:* [regext] Preliminary agenda for Prague, and call for agenda
> items
>
>  
>
> Hi all,
>
> We still have a little bit of time left on the agenda, so if you have
> urgent agenda items, let us know as well.
> [email-masked] <mailto:[email-masked]>
> [email-masked]

-- 
Kal Feher
Melbourne, Australia

---

From: Bill Woodcock <[email-masked]>
Date: Mon, 25 Feb 2019 01:06:05 -0800

We’d be _very interested_ in seeing a standardized, end-to-end registry-locking model. Specifically, one in which the registrant signs change requests, and the registry validates the signatures, and nobody in the registrar path is involved in any way. 

Lack of end-to-end protection was one of the key weaknesses attacked in this campaign. 

We had “registrar lock” enabled prior to the attack (but it was inapplicable); we went through the “registry lock” process after the attack had already begun, and we were very, very unimpressed. As currently implemented, it would not have successfully defended against the attack, since it involves both shared secrets and registrar-registry trust, which were both compromised. Neither is necessary, both weaken the security of the process. 
    
                -Bill

> On Feb 24, 2019, at 23:26, Alexander Mayrhofer <[email-masked]> wrote:
> 
> Antoin, all,
>  
> for now this is more a question / request to the group, rather than a specific agenda slot request – but:
>  
> In the light of the recent attacks on registration interfaces, do we want to take a fresh look at standardization of “Registry Lock” / “Security Lock”. There’s some previous work on this topic (see https://tools.ietf.org/html/draft-wallstrom-epp-registrant-problem-statement-00). As Patrick pointed out, there’s also some IPR considerations in this area (See his blog post at http://www.circleid.com/posts/20150603_registry_lock_or_epp_with_two_factor_authentication/).
>  
> I constantly hear from registrars that “Security Lock” (our product name) would be much more attractive if there wasn’t a myriad of different processes at each registry – so my take is that there’s room for standardization (which probably goes beyond the pure EPP extension).  I’m also hearing some fellow ccTLD colleages are interesting in a common “profile”.
> Would regext be the right spot for such a discussion? If yes, would it be interesting to hold a 20 minutes slot in Prague? Or even a Bar-BoF before we “report back” to the working group?
>  
> Best,
> Alex
>  
>

---

From: Martin Casanova <[email-masked]>
Date: Mon, 25 Feb 2019 12:49:57 +0100

Hi all

This topic would also be of interest to us. We are currently evaluating
if and how we could realize Registry Lock.

See you

Martin

-- 
--- 
SWITCH 
Martin Casanova, Domain Applications
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland 
phone +41 44 268 15 55, direct +41 44 268 16 25
[email-masked], www.switch.ch 
 
Working for a better digital world

---

From: Tony Finch <[email-masked]>
Date: Mon, 25 Feb 2019 12:17:28 +0000

Bill Woodcock <[email-masked]> wrote:

> We’d be _very interested_ in seeing a standardized, end-to-end
> registry-locking model. Specifically, one in which the registrant signs
> change requests, and the registry validates the signatures, and nobody
> in the registrar path is involved in any way.

How do you see this interacting with DNSSEC key rollovers?

I would like to see better automation for KSK rollovers, but the poor
state of registrar APIs and the added risk of exposing registrar
credentials makes it more difficult than I would like. I guess the best
answer is more RFC 7344 CDS/CDNSKEY support, because that avoids the
shared secret risks and it won't be made more difficult by security
hardening the delegation update process.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
East Sole, Lundy, Fastnet, Irish Sea: Southeasterly 4 or 5. Rough or very
rough, but slight or moderate in Irish Sea. Mainly fair. Good, occasionally
poor.

---

From: Gavin Brown <[email-masked]>
Date: Mon, 25 Feb 2019 13:57:08 +0000

If a BoF happens in Prague I will certainly attend.

On 25/02/2019 07:26, Alexander Mayrhofer wrote:
> for standardization (which probably goes beyond the pure EPP extension).
>  I’m also hearing some fellow ccTLD colleages are interesting in a
> common “profile”.
> 
> *Betreff:* [regext] Preliminary agenda for Prague, and call for agenda items
> 
>  
> 
> Hi all,
> 

-- 
Gavin Brown
Chief Technology Officer
CentralNic Group plc (LSE:CNIC)
Innovative, Reliable and Flexible Registry Services
for ccTLD, gTLD and private domain name registries
https://www.centralnic.com/
+44.7548243029

CentralNic Group plc is a company registered in England and Wales with
company number 8576358. Registered Offices: 35-39 Moorgate, London,
EC2R 6AR.

---

From: Marc Groeneweg <[email-masked]>
Date: Mon, 25 Feb 2019 16:11:52 +0000

All,

At SIDN (for .nl) we have our own form of registry lock called .nl control (https://www.sidn.nl/en/nl-control?language_id=2). Perhaps this can be used as input for a joined effort in increasing security around registry/registrar operations.

Regards,
Marc Groeneweg

On 25/02/2019, 14:57, "regext on behalf of Gavin Brown" <[email-masked] on behalf of [email-masked]> wrote:

---

From: Erwin Lansing <[email-masked]>
Date: Mon, 25 Feb 2019 17:25:19 +0100

Folks,

At .dk we also offer a form form of registry lock, called VID, which I’d like to redesign at some point.  Having a standardised, or at least similar “enough” product offering across different registries and TLDs would make it much more attractive for registrants.  Even though I won’t be in Prague, I’m certainly interested in following any standardisation effort.

Best,
Erwin

> On 25 Feb 2019, at 17.11, Marc Groeneweg <[email-masked]> wrote:
> 
> All,
>

---

From: Tongfeng Zhang <[email-masked]>
Date: Mon, 25 Feb 2019 17:46:46 +0000

At .ca and all the TLDs CIRA operates,  we have a similar feature of registry lock.
We are interested in standardization for sure.

There is a regiOps workshop coming up in May in Bangkok. I see a fit there if regext is not the right place.

Cheers,
Tongfeng 

-----Original Message-----
From: regext <[email-masked]> On Behalf Of Erwin Lansing
Sent: Monday, February 25, 2019 11:25 AM
To: [email-masked]
Subject: Re: [regext] Security Lock anyone? (Was: Preliminary agenda for Prague, and call for agenda items)

Folks,

Best,
Erwin

>> different processes at each registry – so my take is that there’s 
>> room for standardization (which probably goes beyond the pure EPP extension).
>> Would regext be the right spot for such a discussion? If yes, would 
>> it be interesting to hold a 20 minutes slot in Prague? Or even a 
>> Bar-BoF before we “report back” to the working group?
>> 
>> 
>> 
>> Best,
>> 
>> Alex
>> 
>> 
>> 
>> 
>>

---

From: Rubens Kuhl <[email-masked]>
Date: Tue, 26 Feb 2019 00:15:18 -0300

I imagine that DNS as a communication channel to assure registrant willingness to change something, similar to CDNS/CDNSKEY, could be quite useful. For instance, if the name servers that are delegated on the registry are now pointing to new name servers, and this response is signed by the current DS/DNSKEY on the delegation, changing the DNS servers for that domain is pretty safe.

If registrant's adversary already has control of the domain DNS servers, preventing the change of name servers gives very little to the registrant.

Rubens

> On 25 Feb 2019, at 14:46, Tongfeng Zhang <[email-masked]> wrote:
>

---

From: Tony Finch <[email-masked]>
Date: Tue, 26 Feb 2019 17:46:20 +0000

Rubens Kuhl <[email-masked]> wrote:
>
> I imagine that DNS as a communication channel to assure registrant
> willingness to change something, similar to CDNS/CDNSKEY, could be quite
> useful. For instance, if the name servers that are delegated on the
> registry are now pointing to new name servers, and this response is
> signed by the current DS/DNSKEY on the delegation, changing the DNS
> servers for that domain is pretty safe.

There is RFC 7477 CSYNC, but I don't know of any implementations.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
safeguard the balance of nature and the environment