Subject: [xmpp] Fwd: New Version Notification for draft-saintandre-xmpp-tls-04.txt

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 23 Jan 2014 19:04:22 -0700

I added a bit to the security considerations...

- -------- Original Message --------
Subject: New Version Notification for draft-saintandre-xmpp-tls-04.txt
Date: Thu, 23 Jan 2014 13:26:19 -0800
From: [email-masked]
To: Peter Saint-Andre <[email-masked]>, Peter Saint-Andre
<[email-masked]>

A new version of I-D, draft-saintandre-xmpp-tls-04.txt
has been successfully submitted by Peter Saint-Andre and posted to the
IETF repository.

Name:		draft-saintandre-xmpp-tls
Revision:	04
Title:		Use of Transport Layer Security (TLS) in the Extensible
Messaging and Presence Protocol (XMPP)
Document date:	2014-01-23
Group:		Individual Submission
Pages:		10
URL:
http://www.ietf.org/internet-drafts/draft-saintandre-xmpp-tls-04.txt
Status:
https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls/
Htmlized:       http://tools.ietf.org/html/draft-saintandre-xmpp-tls-04
Diff:
http://www.ietf.org/rfcdiff?url2=draft-saintandre-xmpp-tls-04

Abstract:
   This document provides recommendations for the use of Transport Layer
   Security (TLS) in the Extensible Messaging and Presence Protocol
   (XMPP).  This document updates RFC 6120.

Please note that it may take a couple of minutes from the time of
submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Dave Cridland <[email-masked]>
Date: Mon, 27 Jan 2014 17:39:31 +0000

I read through this (or rather, read through the diff2). Two points:

1) I noticed you've changed SSLv3 and TLSv1.0 from SHOULD NOT to MAY.

I don't think we really want to be suggesting that SSLv3 in particular is a
neutral decision; I think, though, that offering it as a server is
reasonable.

Is it worth splitting the requirement levels between initiator and
receiver, something like:

XMPP implementations MAY offer SSLv3 in the receiving role, however SHOULD
NOT negotiate it in the initiating role, preferring later versions.

I'm not so sure about the TLSv1.0 levels, I'll defer to more
cryptographically minded folk on that one.

2) For Security Considerations: It's trivial for an attacker to observe
data between two servers, and given the lack of obfuscation, it'd be fairly
trivial to handle stanza counts. If all the hops are under scrutiny, then
it's fairly easy to observe the stanzas on each hop and establish who is
talking to whom. If you'd like some "proper RFC" text for this I can think
on it (but I'm travelling shortly as you know).

On Fri, Jan 24, 2014 at 2:04 AM, Peter Saint-Andre <[email-masked]>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBAgAGBQJS4colAAoJEOoGpJErxa2pfKoP/As9w5Jl/R0usCA7u69hKJKw
> Ct8E3LL0HHz3kMLKKPlTrL7+qCqNXK2yKI5yfRbcBeg/0D2cUOtnNwhZPO+rFzWH
> K3q3A6zf/o+tLvw8ISPFDsrd1eXESNDBA620tieVEbJyT016+TuEHq/do9UDNnfW
> usyfPxutvFjI9hCgMNsR8FvIfFsiuKDUNxfGx+x6n4twIUSK5VRJlF4kbMVdATzz
> eypsFBTk+Y7WCRowPguUvqMURvoGiL3pqAXF5+DxzwobGlbpQh0kZlV+oiYHPksb
> d5uc1BYltcqbrC/vOoHOvA8sa7B49ZceqqcFYtb1NnTSlWzf+QPQi4FU2nRVK0zL
> 8SfJcX3ISeg4NJJBnJtiR1+wdkk8LduIqUfIcFoG03c/UBgARs8ukmgNMUqEI1bH
> dLQiYTdhD0MfQ2OmDcxaIpK56TNdn14aXG5nPCTd3ogA3Yx9IyxsA9fUF/nmvYkN
> cgszi2bG392S8AcAefXvu0QRg2wj38o8jQrE0yKfWjCKflIlbwOmnZ0pteFSFFpO
> XdUTZs0t3p9emcehoSZgX2KjigtI6PzH+cMl4vR2WLjtydz1bpDz0hltHGBTBEdb
> BoxTWqCTtcImKBhymrcnkgrFWl6RH74C4iMpxawUL7fSh7woJ9prsuQ5MVAs6r0z
> OWh3sy4JLxSXXztvVE9C
> =BwqQ
> -----END PGP SIGNATURE-----
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp
>