Subject: Re: [regext] How to handle Domain Info Command with empty authinfo/pw tag in command?

From: "Patrick Mevzek" <[email-masked]>
Date: Wed, 26 Feb 2020 18:27:24 -0500

On Thu, Jan 23, 2020, at 01:01, Patrick Mevzek wrote:
> 2) for the login security draft I said from the beginning that instead
> of just relaxing the limits on password length, we may want to use
> more standardized methods such as SASL, and in particular there are mechanisms
> to authenticate without exchanging any password (SRP)
> See https://mailarchive.ietf.org/arch/msg/regext/iMfmuxNgDbMHGMGehg8VT_oSklU

FWIW, here is a recent attempt to retrofit SASL inside HTTP, and while
it is not applicable exactly as is to EPP, it shows other people wanting to have
SASL as default in "legacy" protocols,
in order to plug in later other authentication mechanisms.

https://datatracker.ietf.org/doc/draft-vanrein-httpauth-sasl/

-- 
  Patrick Mevzek
  [email-masked]

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 27 Feb 2020 18:11:15 +0000

> -----Original Message-----
> From: regext <[email-masked]> On Behalf Of Patrick Mevzek
> Sent: Wednesday, February 26, 2020 6:27 PM
> To: [email-masked]
> Subject: [EXTERNAL] Re: [regext] How to handle Domain Info Command with
> empty authinfo/pw tag in command?
> 
> > more standardized methods such as SASL, and in particular there are
> > mechanisms to authenticate without exchanging any password (SRP) See
> >
> https://mailarchive.ietf.org/arch/msg/regext/iMfmuxNgDbMHGMGehg8VT
> _oSk
> > lU
> 
> FWIW, here is a recent attempt to retrofit SASL inside HTTP, and while it is
> not applicable exactly as is to EPP, it shows other people wanting to have
> SASL as default in "legacy" protocols, in order to plug in later other
> authentication mechanisms.
> 

Thanks, Patrick, this may be worth exploring if there's interest in adding this kind of capability to EPP. I don't know if that interest exists in this WG, but with the drip WG also looking at EPP they might bring some motivation to the party.

Scott