Subject: [regext] EPP Extension Object Search

From: Tobias Sattler <[email-masked]>
Date: Tue, 14 Dec 2021 15:29:03 +0100

Dear Working Group,

Jody and I wrote a draft on EPP Extension called Object Search.

We want to spin this idea with this group because using EPP for searching is more secure than RDAP by reducing a threat vector.

https://github.com/seitsu/epp-object-search/blob/main/draft-sattler-epp-object-search.txt <https://github.com/seitsu/epp-object-search/blob/main/draft-sattler-epp-object-search.txt>

Please note that this is an early draft that is not submitted yet. Therefore, the approach used in this document is only to illustrate the idea, not necessarily the final approach.

We are looking forward to hearing your feedback.

Thanks,
Tobias

---

From: "Thomas Corte (TANGO support)" <[email-masked]>
Date: Tue, 14 Dec 2021 17:24:08 +0100

Hello,

On 12/14/21 15:29, Tobias Sattler wrote:

> We want to spin this idea with this group because using EPP for searching 
> is more secure than RDAP by reducing a threat vector.
> 
> https://github.com/seitsu/epp-object-search/blob/main/draft-sattler-epp-object-search.txt 
> <https://github.com/seitsu/epp-object-search/blob/main/draft-sattler-epp-object-search.txt>
> 
> Please note that this is an early draft that is not submitted yet. 
> Therefore, the approach used in this document is only to illustrate the 
> idea, not necessarily the final approach.
> 

As a (registrar) EPP client developer, I'd surely actually welcome a way 
to obtain ad-hoc lists of sponsored objects via EPP (rather than having 
to rely on out-of-band reports, which aren't really standardized yet, see 
below).

However, as a (registry) EPP server developer, I'm wary of the extra 
stress that could be caused by excessive list queries (with search 
filters) hitting the main SRS database, especially if registrars took the 
availability of this feature as an incentive to neglect their local 
inventory management.

This is one of the reasons why our own TANGO registry system is using a 
dedicated reporting server that offers daily inventory reports, 
pre-generated from a local, partial copy of the registry's data.

The registration reporting draft at

https://datatracker.ietf.org/doc/draft-ietf-regext-simple-registration-reporting/

seems to be aiming at standardizing such registry reports, which at this 
point seems to be the preferable option to get inventory information IMHO 
- registrars could use them to easily get full inventory data, allowing 
them to filter them offline in any way they see fit (compared to the 
simple filtering options the object search branch offers right now). 
Also, the standardized reports are supposed to also include data about 
transactions, RGP, reserved names, premium names etc.; the EPP object 
search would really only offer a small subset of this data.

By the way, the text and examples don't seem to be aligned with the XSD 
in the draft; for example, "type" and "filter" are defined as XML 
elements, while they occur as XML attributes in the examples.

Best regards,

Thomas

-- 
TANGO REGISTRY SERVICES®
Knipp Medien und Kommunikation GmbH                    Thomas Corte
Technologiepark                             Phone: +49 231 9703-222
Martin-Schmeisser-Weg 9                       Fax: +49 231 9703-200
D-44227 Dortmund                      E-Mail: [email-masked]
Germany

---

From: "Patrick Mevzek" <[email-masked]>
Date: Tue, 14 Dec 2021 13:17:53 -0500

On Tue, Dec 14, 2021, at 09:29, Tobias Sattler wrote:
> We want to spin this idea with this group because using EPP for 
> searching is more secure than RDAP by reducing a threat vector.

Which threat vector? Or can you explain what is not secure in RDAP?
Because it uses HTTPS so it can be "secured" by any and all well-known mechanisms,
from shared secret, to full Oauth/WebAuthn things.

Also the exact same EPP security mechanisms (as laid out by RFC5734), namely
1) IP access lists 2) clients X509 certificates 3) login+password, can be done exactly
as is with RDAP, if so wished.

EPP is Extensible *Provisioning* Protocol (yes, I know not fully true already).
I am into the personal position that a lot of stuff added lately/being added to EPP would in fact have been better through RDAP, because it also for some opens the use by other
entities than registrars.

I think the authentication/authorization stuff is orthogonal to the features provided
by the protocol.

-- 
  Patrick Mevzek
  [email-masked]

---

From: Mario Loffredo <[email-masked]>
Date: Wed, 15 Dec 2021 11:24:28 +0100

> from shared secret, to full Oauth/WebAuthn things.

I fully agree with Patrick on this point. On the contrary, being an RDAP 
server a REST service, some security features like 2-factor 
authentication are provided by IdPs and can be implemented by RDAP 
operators with little to no effort.

> entities than registrars.

Right.

Additionally, I would like to outline that sooner or later the 
registries will be recommended to meet the requirements coming from  EU 
E-evidence 
<https://ec.europa.eu/info/policies/justice-and-fundamental-rights/criminal-justice/e-evidence-cross-border-access-electronic-evidence_en> 
directive that is to implement systems allowing cybercrime investigators 
(e.g. Europol) to access the registration data quickly (the response 
time should be to the tune of hours rather than days). From that 
perspective, surely RDAP fits much better than EPP.

> I think the authentication/authorization stuff is orthogonal to the features provided

Agreed. The security level in EPP and RDAP implementations depends on 
the security policy of each registry.

Best,

Mario

-- 
Dr. Mario Loffredo
Technological Unit “Digital Innovation”
Institute of Informatics and Telematics (IIT)
National Research Council (CNR)
via G. Moruzzi 1, I-56124 PISA, Italy
Phone: +39.0503153497
Web:http://www.iit.cnr.it/mario.loffredo

---

From: "Thomas Corte (TANGO support)" <[email-masked]>
Date: Wed, 15 Dec 2021 18:45:45 +0100

Hello,

> entities than registrars.

All of this is correct; however, for registrars seeking to keep their 
inventory up-to-date with such a feature, it seems rather awkward having 
to implement *two* instead of one real-time connection to the registry.

Right now, registrars have little to no reason to include an RDAP client 
implementation in their software at all, as everything they need to do in 
terms of domain/contact/host inventory management can/must be done via 
EPP, and EPP provides more information about sponsored objects than RDAP 
anyway.

As such, IF e.g. a "list my domains" feature shall be made available in a 
real-time interface, IMHO it would make more sense to add it to EPP, as 
registrars can then handle all of their business with the registry over 
their existing EPP connection, rather than having to add one for RDAP.
Given that maintaining a registry connection involves more and more 
effort these days (thanks to short-lived client certificates, frequent 
registry migrations etc.), adding yet another one to maintain should 
better be avoided.

Best regards,

Thomas

---

From: "Patrick Mevzek" <[email-masked]>
Date: Wed, 15 Dec 2021 13:00:26 -0500

> to implement *two* instead of one real-time connection to the registry.

I don't think this should be what drives protocol design.
Because that same argument could then be applied to many other things,
basically barring any innovation.

I see really nothing "awkward" by just using the proper tool for each job.
EPP for provisioning, other interfaces (they exist already: custom resports through
FTP/SFTP/SCP, or registry website, etc.) for other needs not related to provisioning.

The constraints are completely different: EPP is a "real-time" "always on"
kind of interface, as you need live results.

Synchronizing a portfolio or doing searches is something not needing real-time
and which (for synchronization) shouldn't happen "often".

The SLAs and rate-limits will be wildly different between the two features.
Trying to cram everything inside EPP basically just because EPP exists
(both as protocol and as connection for registrars) seems the wrong direction
to me.

Also, I do recall that often/sometimes (and that was the case for EPP itself),
there is first a draft of the requirements/contraints/desires, without any
technical stuff, and only when that is agreed upon, the technical work on
finding the correct protocol and way to reach that goal is started.
Using EPP just because it is there seems to me to go too quickly to the "solution".

> EPP,

Which is not/was not already true. Think FOAs in gTLDs (not all registry
allow domain:info on domain you don't sponsor, even with the correct authInfo)
for one thing.

> and EPP provides more information about sponsored objects than RDAP 
> anyway.

In what sense?
And even if true, what prohibits to add more data to RDAP?

> real-time interface,

Why? Registrars certainly don't need that often/in real time.

> IMHO it would make more sense to add it to EPP, as 
> their existing EPP connection,

First not all registries use EPP.
Second, it could be good to hear from more registrars and registries in fact
to know if that is really a factor for them.
Third, for any registrar stack, adding a new "client" for RDAP stuff
may be easier than changing their EPP stack to add yet one more extension.

-- 
  Patrick Mevzek
  [email-masked]