Subject: Re: [xmpp] New(ish) draft: Secure Messaging in XMPP

From: Dave Cridland <[email-masked]>
Date: Thu, 17 Dec 2015 20:45:38 +0000

On 23 October 2015 at 22:18, Adam Roach <[email-masked]> wrote:

> XMPP folks:
>
> Martin and I put together a proposal for an approach that allows for
> end-to-end encrypted XMPP conversations, including in the presence of MUC.
> Although not a completely implementable spec, this should give a good idea
> about the direction we have in mind:
>
> https://tools.ietf.org/html/draft-thomson-xmpp-secure-00
>
> Anyone interested in this work should give it a read and provide feedback.
> In particular, I'm curious if anyone interested in implementing this kind
> of thing has requirements can't be addressed with the high-level approach
> we're describing.
>

I'm nothing if not prompt in my reviews. :-)

Overall, I'm thinking this deserves more investigation, although §8 really
needs pulling out and turning into a (much longer) XEP. It may need killing
with fire; right now it's simply far too sparse to properly judge. But on
the assumption that this is orthogonal to the remainder of the spec, the
actual e2e protocol looks essentially OK to me.

A key factor will be supporting Pubsub (XEP-0060), and (probably)
advertising keys over PEP (XEP-0163) rather than presence - and since PEP
*is* PubSub, that leads into a fascinating discussion of recursion. We need
to look at Carbons (XEP-0280) and MAM (XEP-0313), and how these fit in, too.

I'm in two minds as to the right venue for discussion of the bulk of this,
however.

Part of me feels that the IETF has the better understanding of cryptography
and commsec, but with all the other proposals we've ever had, bar one,
being discussed in the XSF I'd be inclined to suggest you brought it there.
This also has the advantage that the majority of the client developers are,
more or less, based within the XSF rather than here, so I think that if
there's traction to be had, it'll be had within the XSF.

Finally, this gives you the golden opportunity to travel to Belgium at the
end of January and discuss this in person at the XSF's Summit - which I'd
love to see happen, and I promise to buy you both a beer or two if you do.

Dave.