Subject: [xmpp] Position Paper on Strengthening XMPP

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 15 Jan 2014 11:49:42 -0700

I have submitted an initial version of a position paper about
strengthening XMPP for the W3C/IAB workshop to be held before IETF 89:

http://datatracker.ietf.org/doc/draft-saintandre-strint-workshop-xmpp/

https://www.w3.org/2014/strint/

The document is a bit of a stub, so I would love to receive some
feedback in the next 48 hours. I'll then submit a revised I-D for
formal consideration by the workshop committee.

Thanks!

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/

---

From: Dave Cridland <[email-masked]>
Date: Wed, 15 Jan 2014 20:15:03 +0000

Is this somewhere in XML form? I'll wordsmith a patch.

It'd be interesting to discuss the (now ancient history) of C2S security
pushes, I suspect.

On Wed, Jan 15, 2014 at 6:49 PM, Peter Saint-Andre <[email-masked]>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBAgAGBQJS1thGAAoJEOoGpJErxa2pLvwP/220ahT+W4lhJWzSrPEGHuef
> HFh7DSSSNfUTO+8JD/NlRsCGWBg5Uz2vIXoRRahXAiCa1T0YFk9T5tsAO9488tWq
> lgCfhjtUVq8fEzEHvS0w7c9TSlKVUGMH29Q4gLlFwlkCqsFSCJvYsZ86+I+fgnPX
> jAtf7k9BJD9CMxzf7LDbdx0nBvqPc0SRgYZFjnGGHpr0gOWmPOZf+gbFa6uCJYsJ
> lniYlwwE5r+bxE5orhTgDwZoAkyua829Yqq4NZkiwpWMDZRq/+bSbpZgjuf/MECo
> SCB9iQQz3phzZ7fKFdvSnNWUM31AwBFZHIX0eOzuTP9HCAT6tnCsTx/CMc8oUXVp
> mpoekm2ed6N+DGmZrgBWn3AjSxXCX80o7xKBDVtmgtg5oYQI2hw+qcv9w3JmMqHA
> QbzaDwXDLLAfG+vCKucgOwLctYrPmopcnbxz2bxaOkA29trRYYzIq/8Uhn3n8muT
> 1i+igp5Fr6cCQ3qZ2ojim91rCWSrDYHgz19lOMtZ+zm7+w78dQpZzZx8QqAWQCk6
> uB+NBNdr5ysI7wpq2v9XRHy3cBiGZMBUQlOv0qbw9ChML4iFzJs+8IX4BJpsexyI
> i0XgzuPMkMOUlXpavFwUya7spPSXggQREhf9q3MXWW+DcGNtEl0k6gIpaCTyQXe2
> d+moDu+bxZveMn1ZMD9T
> =w7rg
> -----END PGP SIGNATURE-----
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 15 Jan 2014 13:27:18 -0700

> Is this somewhere in XML form? I'll wordsmith a patch.

The .xml is linked from

It's also here:

https://github.com/stpeter/xmpp-sec/blob/master/draft-saintandre-strint-workshop-xmpp.xml

Peter

---

From: Philipp Hancke <[email-masked]>
Date: Thu, 16 Jan 2014 07:42:14 +0100

> formal consideration by the workshop committee.

Looks good in general. I think it would make sense to note that XMPP 
does not attempt to hide / protect communication metadata.
That's just the way it is.

There might be some techniques (based on servers adding a from to a 
stanza before sending it out or xep-0198 acks) to make length-based 
guessing harder by adding a different padding on different streams. But 
I don't expect those to effectively counter any sophisticated attack due 
to lack of randomness.

philipp