Editing Extensible Provisioning Protocol (section)

== Security considerations ==
EPP only offers plain text passwords, additionally the EPP login password type is specified to be a string of 6-16 character length<ref name=":0" /> which might be considered very low for today's standards. Connections over TCP, therefore, must use [[Transport Layer Security|TLS]], and the use of [[Client certificate|client certificates]], as well as correct identity confirmation of the client and server, is strongly encouraged.<ref>{{Cite web |last=Hollenbeck |first=S. |date=August 2009 |title=Extensible Provisioning Protocol (EPP) Transport over TCP |url=https://doi.org/10.17487/RFC5734 |language=en |doi=10.17487/RFC5734 |issn=2070-1721 |doi-access=free}}</ref>

Many domain name registries also offer to set up a [[Whitelist|IP whitelist]] for connecting to their EPP servers.

EPP offers some protection against replay attacks via the client generated clTRID, however this element is optional and is therefore not used by every server software. Therefore, additional anti-replay mechanisms should be implemented by the used transport mechanism.<ref name=":0" />